French freezers at 50 °C and Dutch empty shelves: no evidence of a joint attack yet

On the night leading into Monday, October 12, hackers remotely changed cooling settings in hundreds of French supermarkets, and freezers, instead of freezing, started heating up, in some places reaching as high as 50 or even 80 °C. Le Figaro ↗ Economy Minister Roland Lescure speaks of approximately 700 affected sites out of about 10,000 food distribution locations in France, and does not mention a risk of food shortages. BFM TV ↗ In the Netherlands, meanwhile, part of Albert Heijn's IT systems has not been working since Sunday afternoon, and fresh food is disappearing from stores. The Dutch NCSC authority, however, sees no reason to link these two events. NRC ↗

France: an old controller connected to the internet

The attack hit several chains at once. According to AFP, it involved at least 300 Intermarché and Netto stores, nearly a hundred Coopérative U stores, several E.Leclerc stores, and about thirty Monoprix stores. La Libre ↗ Media figures range from 150 stores to 700, depending on who counted and when. Kurier ↗

NZZ described the mechanism. Regulators are cabinets in a store's technical room that can be controlled via a browser. Hackers exploited a common defrosting function and extended it overnight to several hours. NZZ ↗ Danfoss claims that most of the affected units are old models that have reached end of life and no longer receive security updates. Some newer devices, however, were running on older software. NZZ ↗ According to Le Figaro, the vulnerable software was supposedly connected directly to the internet, without VPN protection. Le Figaro ↗

Damages differ by chain. Coopérative U chief Dominique Schelcher says 80 out of about 2,000 stores were affected, and most of them "were able to fend off the attack." The others suffered losses ranging from tens of thousands of euros to 200,000 euros in hypermarkets. He called the attack "unprecedented, unexpected, and extremely serious." BFM TV ↗ Intermarché chief Thierry Cotillard estimates his chain's losses at several tens of millions of euros. BFM TV ↗

It is not even certain that a single manufacturer is involved. According to BFM TV, a Leclerc store in Lescure-d'Albigeois, which has equipment from the Italian company Dixell, also lost its refrigeration chain. BFM TV ↗ Schelcher also points out that his stores are not customers of Danfoss itself, but of refrigeration companies that supply them with Danfoss solutions. Whether those companies informed the stores of the risks is, in his view, something the investigation should reveal. Le Figaro ↗

The Paris public prosecutor's office is investigating, the case is being handled by the Office for Combating Cybercrime (Ofac), and Prime Minister Sébastien Lecornu has ordered the ANSSI agency to take over oversight of the case. BFM TV ↗ Neither the perpetrator nor the motive is known, and so far nobody is talking about a ransom or data theft. NZZ ↗

Netherlands: not cooling, but logistics

Albert Heijn, Etos, and Gall & Gall have been reporting a "cybersecurity incident" since Sunday afternoon. Part of the distribution centers are at a standstill, online orders and deliveries have been halted, and stores are mainly missing fresh products. NRC described an Amsterdam store where there was no delivery of fresh goods in the morning and the tomato bins were gaping empty. NRC ↗ According to NOS, only three out of the usual twenty daily pallets arrived at the store in Lelystad. NOS ↗

What we know about the attack is little. NOS learned from security sources that Albert Heijn detected suspicious traffic and preemptively shut down its systems. The attackers reportedly used servers in the USA, Poland, Moldova, and Turkey, though this says nothing about where they are physically located. NOS ↗ Parent company Ahold Delhaize states that it has no indications of customer or employee data being leaked, and is restarting systems gradually. NOS ↗ It remains silent on specific technical details.

The Dutch government is projecting calm. State Secretary Silvio Erkens told the Dutch House of Representatives that food security is not at risk, and that supplies at manufacturers and distribution centers will last about a week. The national food security crisis plan is not expected to be ready until next year. NRC ↗

The Czech side of the group also reports problems. iROZHLAS wrote on Monday evening that the owner of the Albert stores is dealing with a cyber incident, and in the Czech Republic the problems manifested in the app. iROZHLAS ↗

Are the two incidents related? So far, nothing suggests they are

Both events started at the same time, but they look like two different phenomena. In France, it was an intrusion into physical cooling via an exposed control system. In the Netherlands, it was an IT shutdown that halted logistics. According to the NCSC, there is no reason to assume they are connected. NRC ↗ An SRF editor called the French attack a likely hybrid warfare action aimed at causing uncertainty and panic buying. This, however, is his personal assessment, not a finding by investigators. SRF ↗

What they do have in common is something else: dependence on a single supplier or a single node. Belgian expert Charles Cuvelliez of ULB speaks of an "alarm signal" and of the risks of concentration. A web interface is convenient, but it requires serious security guarantees, and supermarkets in Belgium are not among the regulated critical sectors. La Libre ↗ Lescure urges companies not to limit cybersecurity to their own systems, but to also monitor their suppliers. BFM TV ↗

Neighboring countries are responding cautiously. Germany's BSI says the attack could have hit any country and may have imitators, and recommends disconnecting control systems from the internet. Switzerland's Bacs admits similar attacks are possible there too, and according to the local refrigeration technology association, Danfoss systems are used by roughly 10 to 15 percent of Swiss supermarkets. NZZ ↗ Austria's Spar claims it does not use Danfoss software. Kurier ↗ Denmark's Coop also states that it remains vigilant. DR ↗

Limits of this account

All figures come from national press and company statements and are changing hour by hour; no investigative conclusion exists yet. The Dutch picture rests on anonymous security sources cited by NOS and on brief statements from Ahold Delhaize, which remains silent on technical details. NOS ↗ The information about Dixell in France comes from BFM TV via the regional channel ICI Occitanie, and other sources have not yet confirmed it. BFM TV ↗ This status corresponds to Tuesday, October 13, afternoon.

What hotinfo is monitoring

*Illustrative photo: an empty freezer in a Dutch supermarket. Photo: Donald Trung, Wikimedia Commons, CC BY-SA 4.0*