eualive.net
Cyberattack on French supermarket chains raises alarm over connected devices vulnerability
Hackers targeted connected refrigeration systems at hundreds of French supermarkets overnight on 11–12 October, forcing refrigerators and freezers up to 50°C for hours. The attack hit around 150 Intermarché stores (and more when including related Netto outlets), nearly 100 Cooperative U locations, and reportedly others including some Leclerc and Carrefour sites.
Fresh and frozen stock was spoiled; affected stores discarded the products, with Intermarché’s parent estimating losses in the tens of millions of euros nationwide in a single day.
Paris prosecutors opened an investigation into the large-scale incident on connected refrigerators, which also caused fires in some cases. The systems involved Danfoss refrigeration controllers, some running outdated firmware.
Editorialist Cyprien Ronze-Spilliaert posted on X: “Imagine: in wartime, an enemy triggers a major food crisis in France without firing a single missile. This scenario is not at all fanciful.Today, it’s supermarkets. Tomorrow, it could be logistics platforms, cold storage warehouses, or entire distribution networks. A coordinated attack against these infrastructures could disrupt the food supply of entire regions.Food security is also a matter of national security. Companies cannot expect everything from the state: they must invest heavily in their cybersecurity.”
The incident underscores the growing risks of everyday connected devices.
Recent reporting has detailed how internet-linked CCTV cameras have been weaponised in the Russia-Ukraine war: Russian forces and intelligence have hacked residential and street cameras in Kyiv and elsewhere to monitor air defences, critical infrastructure, and troop movements in order to plan and adjust missile and drone strikes.
Ukraine’s security service has identified and secured, reoriented or blocked roughly 40,000 such cameras since the full-scale invasion began. The same tactic works in reverse – Ukrainian-linked hackers, including the group Team OneFist, have compromised cameras in occupied Crimea (including Sevastopol) to track Russian aircraft, ships and a previously unknown airbase, intelligence later used in strikes that damaged planes and air defences.
Dutch and other European intelligence services have also warned of systematic Russian efforts to hack cameras across Europe to track arms shipments and personnel movements. What begins as a consumer or commercial IoT device can, once compromised, feed real-time targeting data or enable physical disruption far beyond the original purpose.
Concerns are particularly acute over the widespread use of Chinese-made CCTV systems, including those from manufacturers such as Hikvision and Dahua. Western governments have repeatedly flagged these devices for national-security risks, citing Chinese national-intelligence laws that can compel companies to assist Beijing’s intelligence services, documented technical vulnerabilities that allow remote access or data exfiltration, and default connections to manufacturer servers in China.
The United States has barred federal agencies from procuring equipment from these firms, the United Kingdom has ordered the removal of such cameras from sensitive government sites, and similar steps have been taken in Australia and elsewhere. Critics warn that the low cost and ubiquity of these systems – deployed in homes, businesses, critical infrastructure, and public spaces – create a ready-made surveillance infrastructure that could be exploited for espionage, mapping of networks, or real-time intelligence collection, whether through intentional backdoors, forced cooperation, or simple exploitation of weak security.
In the context of modern conflict, the same class of internet-connected cameras has already been shown to be hackable for military purposes, amplifying the stakes of relying on equipment whose design, firmware, and supply chain remain under the influence of an authoritarian state.
Caption: Photo of an affected store posted by Cyprien Ronze-Spilliaert on X