Vulnerabilities
Cyberattack Disrupts Refrigeration at Hundreds of French Supermarkets
A cyberattack hit refrigeration systems at about 700 French supermarkets, causing food losses and fires. The attack affected controllers from Copeland and Dixell. Authorities are investigating.
Ross GrantUpdated 3 min read
The short version
A cyberattack hit the cooling systems at hundreds of supermarkets in France. This caused food to spoil and even led to fires in some stores. The attack targeted devices that control refrigeration, many of which were old or not updated. Authorities are still investigating how it happened.
By the numbers
- 700French supermarkets affected by the attackSecurityWeek
- 150Intermarché stores impactedSecurityWeek
- 80Carrefour stores impactedSecurityWeek
- €270,000Combined food loss at two Alsace supermarketsSecurityWeek
What happened?
A cyberattack disrupted refrigeration systems at about 700 French supermarkets, affecting controllers from Copeland, Dixell, and Danfoss. Some stores had to discard all refrigerated food, and there were reports of fires. The attack method is not yet confirmed, and authorities are investigating.
What happened to supermarket refrigeration?
A cyberattack disrupted refrigeration systems at around 700 supermarkets across France. The attack affected equipment from Copeland and its Dixell brand, as well as Danfoss controllers. The French national cybersecurity agency, ANSSI, confirmed the incident and issued alerts about the affected devices. Supermarket chains including Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix reported being impacted. Some stores had to discard all refrigerated food, and there were reports of fires linked to the attack. The Paris prosecutor’s office has opened a criminal investigation.
Which devices were targeted?
The attack hit several types of refrigeration controllers. Initially, ANSSI warned about Danfoss AK-SM and AK-SC series controllers. Later, the agency updated its alert to include Copeland XWEB and Dixell XWEB systems. Many of the affected devices were older models that are no longer supported or patched. For example, Danfoss stopped supporting the AK-SM 800 in 2021 and the AK-SC 355 in 2016. Some newer devices were also affected if they were running outdated firmware. Copeland acknowledged a vulnerability in its systems and said it is working with customers to reduce risk.
How did the attack work?
It is not yet clear how the attackers gained access to the refrigeration controllers. The French CERT-FR did not link the compromises to any specific vulnerability. Earlier in the year, security researchers at Claroty had found and reported flaws in both Danfoss and Copeland controllers, but there is no confirmation that these were used in the attack. The attackers changed the settings on the controllers, such as lengthening defrost cycles, which delayed alarms and caused food to spoil. In some cases, this led to refrigeration units running at dangerously high temperatures for hours.
Impact on supermarkets and food safety
The human impact was significant. At Intermarché, about 150 stores were affected, with refrigeration units reaching 50°C for six hours. All food in those units had to be thrown away. Carrefour said 80 of its stores were impacted. Coopérative U reported 80 stores targeted, but only a minority had to discard products. Two supermarkets in Alsace reported a combined loss of €270,000 due to spoiled food. The attack also caused fires in some locations. The financial and operational impact is still being assessed, but the incident has raised questions about liability between supermarkets and their suppliers.
What are authorities and vendors doing?
CERT-FR has advised operators to disconnect affected controllers from the internet and only restore remote access through a secure VPN or protected network. Filtering connections by IP address is only a temporary emergency measure. For end-of-life devices, a factory reset is not enough to secure them if they remain exposed online. Copeland has released patches for known vulnerabilities and is working with affected customers. The Paris prosecutor’s cybercrime unit is investigating, but so far, no group has claimed responsibility and no ransom demand has been made. Investigators are also looking into similar incidents in other European countries, though details are limited.
Lessons for operators and defenders
This incident highlights the risks of leaving industrial control systems exposed to the internet, especially when devices are no longer supported by the manufacturer. Operators should ensure that critical systems are not accessible from the public internet and that all firmware is up to date. Using secure remote access methods, such as VPNs, and replacing unsupported devices are key steps to reduce risk. The attack also shows the importance of clear responsibility between suppliers and operators when it comes to managing and securing critical infrastructure.
Claimed vs confirmed
- Unconfirmed
Attackers exploited known vulnerabilities in Danfoss and Copeland controllers.
Authorities and vendors have not confirmed that the attack used previously disclosed flaws.
- Confirmed
The attack caused fires in addition to food losses.
The Paris prosecutor’s office confirmed fires were caused by the attack.
- Unconfirmed
Stores in other European countries were affected.
A researcher told Reuters that stores in Spain, Portugal, Poland, Germany, and Belgium were affected, but details are lacking.
The impact
- Money
- Some supermarkets reported losses, such as €270,000 at two Alsace locations. The full cost is still being assessed. Under EU GDPR, fines for security failures can reach €20 million or 4% of global turnover.
- Reputation
- Supermarkets faced public scrutiny and operational disruption. The incident has raised questions about supplier responsibility and trust in critical infrastructure.
- Customers
- Customers faced food shortages and potential safety risks. No personal data was reported stolen, but food safety was directly affected. Affected stores discarded spoiled products.
Why it matters
Supermarkets rely on these controllers to keep food safe. When they fail, it can mean huge food losses, safety risks, and financial damage. The attack shows the real-world impact of insecure industrial systems and the need for better protection.
How does it work?
Attackers changed settings on internet-exposed refrigeration controllers, such as lengthening defrost cycles, which delayed alarms and caused food to spoil. It is not confirmed which vulnerability was used, but many affected devices were old and unpatched.
Key points
- About 700 French supermarkets had their refrigeration systems disrupted by a cyberattack.
- The attack affected controllers from Copeland, Dixell, and Danfoss, many of which were outdated or unsupported.
- Some stores lost all refrigerated food, and there were reports of fires.
- Authorities urge disconnecting vulnerable devices from the internet and using secure remote access.
- No group has claimed responsibility, and the method of attack is still under investigation.
Sources
SecurityWeek
Reference
