Hackers Heat French Supermarket Fridges to 50°C

Hundreds of supermarkets across France have been affected by a cyberattack that remotely interfered with refrigeration systems, causing temperatures to rise as high as 50°C and forcing retailers to dispose of fresh and frozen food.

The incident, which began overnight on Sunday, 11 October, affected several major supermarket chains, including Intermarché, Carrefour, Monoprix and Coopérative U. French authorities have opened an investigation into the attack, which has also been linked to reports of fires and substantial financial losses.

According to Reuters, Les Mousquetaires, the retail group behind Intermarché, confirmed that refrigeration systems at approximately 150 of its stores had been heated to 50°C for six hours. A company spokesperson said all affected food had been discarded to eliminate potential health risks.¹

Carrefour separately confirmed that 80 of its supermarkets had been affected, while Monoprix reported disruption at approximately five per cent of its French stores. AFP also reported incidents involving E.Leclerc, whose representatives said a cyberattack against a refrigeration equipment supplier had disrupted systems in several stores.²

The Paris prosecutor's office confirmed on Monday that it had opened an investigation into the large-scale attack affecting connected refrigeration equipment across several major food retailers. Prosecutors said the investigation would seek to identify the affected businesses and establish the relationship between the cyberattack and reported damage, including spoiled food and fires.¹

French Prime Minister Sébastien Lecornu instructed the country's national cybersecurity agency, ANSSI, to investigate the incident, according to a source in his office cited by Reuters. French authorities are also coordinating with European counterparts amid concerns that similar equipment may be vulnerable elsewhere.

The attack has drawn attention to the security of operational technology, particularly connected systems that control physical equipment. Supermarket refrigeration installations commonly use centralised controllers to manage temperatures and operating conditions across multiple units. These systems can also be accessed remotely by maintenance providers, allowing equipment to be monitored and adjusted without an engineer being physically present.

While remote management can improve efficiency and maintenance, it also creates potential points of entry for attackers if systems are inadequately protected or contain exploitable vulnerabilities.

According to Reuters, a source close to the French prime minister said ANSSI had identified a vulnerability in software supplied by Danish industrial technology manufacturer Danfoss. The company subsequently confirmed that it was aware of incidents involving a limited number of refrigeration-management systems in France.

Danfoss said the affected equipment was running outdated firmware and reiterated that customers had previously been advised to install supported updates and migrate older systems to newer products.¹

In a separate statement reported by AFP, the company identified older refrigeration-management products, including the AK-SM800 and AK-SC355, among the affected equipment. Danfoss said some legacy systems no longer received software or security updates.²

The manufacturer has not publicly confirmed the precise method used by the attackers to compromise the systems.

Security researchers have previously documented vulnerabilities in Danfoss refrigeration controllers. In August, researchers at Claroty published findings concerning weaknesses in the AK-SM 800A controller that could potentially allow attackers to bypass authentication or execute code.^1,4

However, investigators have not established whether those particular vulnerabilities were exploited in the French supermarket attack. The existence of previously disclosed security weaknesses does not, by itself, establish how the latest incident occurred.

The commercial consequences are already becoming apparent. Reuters reported that Intermarché employees in Paris were seen disposing of defrosted frozen products, while affected retailers have been assessing the extent of their losses.

Intermarché chief executive Thierry Cotillard told French broadcaster BFM TV that the attack could result in losses amounting to tens of millions of euros across France in a single day. That figure was an estimate rather than a confirmed industry-wide assessment.¹

The attack has also raised questions about insurance coverage. Intermarché told AFP that existing policies might not cover this type of incident, potentially leaving businesses exposed to substantial losses from damaged stock and interrupted operations.²

Coopérative U chief executive Dominique Schelcher described the incident as unprecedented and raised concerns about the consequences of targeting equipment essential to food preservation. Speaking to RTL radio on Tuesday, he said approximately 80 of the group's 2,000 stores had been affected, although many stores had managed to protect their stock and limit food losses.⁵

The attack illustrates how cybersecurity incidents involving operational technology can produce consequences that extend beyond compromised information or unavailable digital services. By interfering with refrigeration equipment, attackers can potentially damage stock, interrupt trading and create safety risks without needing to access payment systems or customer databases.

For supermarkets, these risks are particularly significant because refrigeration systems operate continuously and are essential to maintaining food safety. Equipment may also remain in service for many years, creating challenges when older controllers no longer receive security updates or when maintenance arrangements depend on remote access.

French authorities have not publicly identified the attackers or established a motive. Although researchers and officials are examining whether similar systems elsewhere in Europe may be exposed, the full international extent of the incident remains unclear.³

The immediate focus for affected retailers is restoring equipment, assessing losses and determining whether additional refrigeration systems remain vulnerable. For investigators, establishing how the attackers accessed the equipment will be central to understanding the incident and preventing similar disruptions.

The attack is a reminder that connected industrial systems have become an important part of everyday commercial infrastructure. Their security is no longer solely a technical matter for equipment suppliers and maintenance teams, but a business concern with direct implications for operations, safety and financial resilience.