Hundreds of French supermarkets suffered significant financial losses after hackers exploited ‘basic cybersecurity weaknesses’ to take control of refrigeration systems, causing widespread food spoilage and equipment damage.

The cyberattack, which affected retailers including Carrefour, Intermarché, Monoprix, Netto and Coopérative U, saw hackers remotely increase the temperature of fridges and freezers to as high as 80C.

The head of France’s national cybersecurity agency ANSSI, Vincent Strubel, said the attack had been made possible by fundamental security failures, including weak passwords and refrigeration equipment being directly exposed to the internet.

Speaking to the French Senate on Wednesday, Strubel said the agency’s initial findings suggested the hackers had exploited basic security shortcomings, rather than sophisticated software vulnerabilities.

The attack, which began overnight on 11 October, affected hundreds of stores across France, forcing retailers to dispose of large quantities of fresh and frozen food.

Some supermarkets also reported fires and damage to refrigeration equipment, with total losses across the industry potentially reaching tens of millions of euros.

Strubel warned that many businesses had failed to follow longstanding cybersecurity recommendations, despite ANSSI issuing guidance on securing industrial systems since 2014.

The attacks have raised concerns about retailers’ reliance on internet-connected refrigeration equipment, particularly where systems are managed by external suppliers.

Hackers initially targeted refrigeration control systems supplied by Danish manufacturer Danfoss, which said many affected devices were older products that no longer received security updates, or were running outdated software.

The incident has also prompted concerns over vulnerabilities within UK retail infrastructure.

Research by UK Cyber Defence found that the login pages of more than 800 refrigeration systems used by UK retailers were accessible over the internet, potentially exposing them to cyber threats.

French authorities have launched an investigation into the attacks, while cybersecurity officials continue to assess the wider risks posed by poorly protected connected equipment.

Click here to sign up to Retail Gazette‘s free daily email newsletter