Cleanup in Aisle IT: Hackers Spoil the Food at French Supermarkets

Ahold Delhaize, the Dutch conglomerate behind Stop & Shop, Hannaford, and Food Lion, pulled parts of its network offline this week after discovering a cybersecurity problem. Customers who tried to order groceries online instead saw maintenance notices.

The stores stayed open. For customers with unfulfilled online orders, the chains promised refunds. Giant Food and Food Lion pointed shoppers toward outside delivery services, including Instacart, DoorDash, and Uber Eats, while their own systems were unavailable.

Ahold said Tuesday that some systems were beginning a controlled return:

Our teams are working with urgency to investigate the incident and restore affected systems safely. As they make progress in assessing and mitigating the issues, we are in the process of starting a controlled re-launch of certain systems.

Refrigeration and sales systems were unaffected, a company spokesperson said. That distinction became especially relevant this week, given what supermarket employees in France were pulling out of their freezers.

At least 350 French stores were hit by an attack on refrigeration controls. Carrefour, Monoprix, Intermarché, and Coopérative U were among the chains affected. In Paris on Tuesday, workers dumped boxes of spoiled meat and frozen goods into trash containers. Whoever changed the temperatures had left store employees to clean up.

Dutch cybersecurity authorities said they saw no connection to Ahold's troubles. Nor had anyone publicly taken credit for the French attack or issued a reported ransom demand. Investigators were still trying to establish who did it and why, leaving supermarket operators to absorb spoiled inventory costs with no one to hold accountable.

Some of the equipment was already past the point of receiving security updates. Danfoss said affected units included older products that had reached the end of their supported lives, along with systems running outdated firmware. The manufacturer said it had advised customers to update supported equipment and replace obsolete systems.

Ken Munro of Pen Test Partners offered a less corporate explanation:

“This is about basic cyber hygiene. Get it wrong and you get a smelly mess of defrosted food.”

France’s cybersecurity agency identified compromised refrigeration controllers from Danfoss, Copeland, and Dixell. Its instructions included removing direct internet access, restoring compromised equipment, and securing remote connections. It also warned that a factory reset alone would leave unpatched, unsupported equipment vulnerable to another intrusion.

Ahold's latest update said it had found no evidence, at that point in its investigation, that customer or employee data had been taken. That finding remains preliminary.

RedState previously covered hackers’ claims of access to California water utilities, where access to actual control systems remained in doubt. The French supermarkets show what happens when attackers reach operational equipment: Workers have to dispose of the damage.

Danfoss had already told customers to retire equipment that no longer received security fixes. After this week, some French supermarket owners will have to pay for spoiled inventory alongside whatever repairs or replacements they need. Leaving the old controls running turned out to carry its own costs.

Editor's Note: Do you enjoy RedState's conservative reporting exposing the radical left and woke media? Support our work so we can keep bringing you the truth.

Join RedState VIP and use promo code FIGHT to receive 60% off your membership.