Overnight on Sunday 11 October, hackers turned up the temperature in supermarket fridges and freezers across France. By morning, staff were throwing out trolley loads of thawed food.
Reuters reported temperatures as high as 50°C. The Paris prosecutor’s office said the “large-scale” attack had caused food losses and fires.
Les Mousquetaires owns the Intermarché chain. It told Reuters that fridges at about 150 of its stores ran at 50°C for six hours, and that all the affected food had been thrown out.
Carrefour said 80 of its supermarkets were hit. Intermarché chief executive Thierry Cotillard told French broadcaster BFM TV the losses would reach “tens of millions of euros nationwide in a single day”.
“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” Coopérative U chief executive Dominique Schelcher wrote on X.
A known weakness
A supermarket’s fridges are usually run from one control panel for the whole store. Maintenance contractors can reach that panel over the internet.
A source close to French Prime Minister Sébastien Lecornu told Reuters that France’s national cybersecurity agency, ANSSI, had found a vulnerability in software from the Danish manufacturer Danfoss.
Danfoss said the affected units “were running outdated firmware”. It said it had “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions”.
The flaw was already public. On 9 August, researchers at the cybersecurity firm Claroty published three vulnerabilities in the Danfoss AK-SM 800A, a controller that manages refrigeration in supermarkets, cold stores and warehouses.
One of them used a hidden “code-of-the-day” login to give an attacker administrator access. Danfoss had already released a firmware fix. Claroty found 2,765 of the controllers with their management pages open to the internet.
Felix Aimé, a senior analyst at the threat intelligence firm Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. No New Zealand cases had been reported by 12 October.
Food isn’t on New Zealand’s list
The Government’s Cyber Security Strategy 2026-2030, published in February, already describes the problem. “Technical debt and legacy systems often form the ‘weak links in the chain’, with many systems operating with limited security protections,” it says.
The Department of the Prime Minister and Cabinet published a discussion document the same month on protecting critical infrastructure.
It says New Zealand “currently takes a predominantly voluntary approach to cyber security” and that investment across critical infrastructure “is not always commensurate with the threats faced”.
It proposes defining critical infrastructure in law and setting minimum cyber security obligations for it. An initial assessment says the definition could cover about 200 entities across seven essential services.
Those are communications and data, defence, energy, finance, health, transport, and drinking water and wastewater.
Food and groceries aren’t among them.
Australia did include them. Its Security of Critical Infrastructure Act covers food and grocery as one of 11 sectors. Rules made in 2021 named Woolworths Group, Coles Group, Aldi and Metcash.
The owners of those distribution networks must report cyber incidents and keep a written risk management programme.
The New Zealand discussion document gives its own example of how far one weak point can reach. In November 2023, a cyber attack forced Australia’s largest port operator, DP World, to halt operations at its ports in Melbourne, Brisbane, Sydney and Fremantle.
More than 30,000 containers backed up, and they took seven days to clear after systems came back online. The document says commentators believed DP World hadn’t patched a known vulnerability.
What to check now
The fix Danfoss and Claroty describe applies to any business with connected refrigeration, from supermarkets and cold stores to food manufacturers and commercial kitchens.
Ask your refrigeration contractor which controller runs your cold rooms and cabinets, and which firmware version it’s on.
Install firmware updates, and plan to replace controllers that no longer get them.
Keep management pages off the open internet. Claroty recommends limiting admin access to trusted networks, a VPN or a segmented network.
Find out which contractors can reach the system remotely, and how.
“This incident underlines the importance of resilience across the entire supply chain,” Christel Delberghe, director general of the European retail association Eurocommerce, told Reuters.
SPONSORED
