Hacker attacks on European supermarkets, EU: food supplies targeted

On the night between Sunday 11 and Monday 12 October, a cyberattack hit the refrigeration systems of hundreds of supermarkets in France. The attackers remotely took control of the systems that run refrigerators and freezers, triggering forced defrost cycles that pushed internal temperatures up to 50 degrees Celsius. Large quantities of fresh and frozen products spoiled and had to be thrown away in the affected stores.

The chains affected include Intermarché and Netto, part of the Les Mousquetaires group, Carrefour, Monoprix, Coopérative U and E.Leclerc. Estimates of the number of stores affected vary by chain: Les Mousquetaires reported around 150 to 180 outlets, Carrefour 80, and Monoprix about 5 percent of its French stores. Losses, still provisional, are estimated at several million euros.

According to initial findings, the hackers exploited a vulnerability in software made by the Danish company Danfoss, which runs much of the refrigeration equipment used in European supermarkets. Many of the affected devices are reportedly older models that no longer receive security updates. The Paris prosecutor's office has opened an investigation, also assigned to the French cybersecurity agency Anssi, to identify those responsible and to check reports of fires starting in some stores. No group has claimed responsibility for the attack so far.

Christophe Hansen, the EU Commissioner for Agriculture and Food, commented on the episode on X, writing that "the weaponization of food has become a reality," and calling for more attention to the security of food supplies at every level. According to a researcher at cybersecurity firm Sekoia, signs of similar vulnerabilities also appeared in stores in Spain, Portugal, Poland, Germany and Belgium.

The risk for Switzerland

Sebastian Obermeier, a cybersecurity expert at the Lucerne University of Applied Sciences, believes a similar risk exists in Switzerland too, since Danfoss systems are widely used across Europe. Many refrigeration systems remain connected to the network for remote maintenance, which can become an entry point for attackers. Obermeier says a distinction should be made between the occasional loss of fresh products, which does not amount to a supply crisis, and coordinated attacks on central cold-storage warehouses and logistics platforms, which would be far more worrying.

The main retailers active in Switzerland, asked about the case, report no problems: Migros has no indication of attacks on its own facilities, Lidl Switzerland says it was not involved in the French incident, Coop says it has security measures that are regularly updated, and Aldi says it periodically checks the technical equipment in its stores.