Cyberattacks hit European supermarket chains

Paris (AP):

Cyberattacks disrupted European supermarket chains, affecting refrigeration systems at hundreds of stores in France and forcing a major grocer to shut down websites serving customers in Europe and the US.

French Finance Minister Roland Lescure told parliament yesterday that about 700 of the country’s 10,000 supermarkets were affected. He said there was no risk to France’s food supplies, but acknowledged that the attack “touches the heart of our food security”.

“It was a wake-up call for everyone,” he said.

Separately, Dutch supermarket giant Ahold Delhaize said it was working to restore systems it had shut down following what it described as a security issue. The company said its stores — including Albert Heijn in the Netherlands, Delhaize in Belgium and Stop & Shop, Food Lion and Giant in the US — remained open, but the websites for those brands stayed offline on yesterday. Ahold Delhaize said it had no evidence that customer or employee data had been stolen.

The Paris prosecutor’s office said its cybercrime unit was investigating the large-scale attack in France, including the extent of damage caused by spoiled food and reported fires. According to BFM-TV, hackers forced a continuous defrost cycle and set temperatures as high as 50°C on stores’ refrigeration systems. French supermarket group Groupement Mousquetaires, which operates more than 4,000 stores across Europe, said 300 of its Intermarché and Netto stores were impacted. Some refrigerated and frozen food display cases remained out of service. Dominique Schelcher, CEO of French grocery chain Cooperative U, said 80 of the company’s 2,000 stores were affected. Most managed to prevent disruptions to refrigeration, but some had to discard food, he said in a post on X.

“Targeting equipment essential to the preservation of fresh products is an attack on the French food supply chain. It is unprecedented, extremely serious, and unacceptable,” Schelcher said. Carrefour and Monoprix supermarkets were also impacted.

The French government’s cybersecurity agency said it was “aware of numerous compromises” involving refrigeration system remote control modules made by Danish company Danfoss as well as US-based Copeland.