Cyberattack Pushes Fridge Temperatures to 50°C at Hundreds of French Supermarkets

Hundreds of French supermarkets threw out fresh and frozen stock on Monday, Oct. 12, after hackers remotely drove refrigeration temperatures as high as 50°C (122°F) overnight.

The Paris prosecutor's office said the "large-scale" attack affected "connected refrigerators in several major food retailers across France." It reported food losses and fires.

Which stores were hit

The retailers' own numbers vary and don't add up to one clean total.

Les Mousquetaires, owner of Intermarché, said about 150 of its stores had fridges heated to 50°C for six hours overnight. In separate statements to AFP, retailers said at least 300 shops of Intermarché or its Netto brand were targeted. A spokesman told the BBC that another 100 shops were cut off from the internet as a precaution.

Coopérative U said more than 100 of its outlets were hit. CEO Dominique Schelcher said its refrigeration systems had been disrupted since Sunday night.

Carrefour said 80 supermarkets were affected, out of roughly 6,000 stores. Monoprix said about 5 percent of its stores were hit. E.Leclerc said several of its stores felt the effects. Based on the chains' own figures, roughly 400 stores were affected out of about 15,000 in France.

The damage

Intermarché said affected stores had to discard all fresh and frozen products to eliminate health risks. Some display units were still out of service Monday afternoon.

A witness in central Paris watched staff at an Intermarché haul cartfuls of defrosted food into a giant trash container, with melted ice cream spilling onto the street.

Intermarché CEO Thierry Cotillard told BFM TV the attack would cost "tens of millions of euros nationwide in a single day." Regional outlet Sud Ouest reported that an Intermarché and an E.Leclerc in Haguenau, eastern France, together estimated stock losses at €270,000.

Schelcher called the attack "of extreme gravity and unprecedented" on X. He said targeting equipment essential to preserving fresh products and feeding the French public was "unacceptable."

The Danfoss link

A person in Prime Minister Sébastien Lecornu's office said the national cybersecurity agency ANSSI had identified a vulnerability in software supplied by Danish manufacturer Danfoss and had contacted the company. Lecornu ordered ANSSI to investigate.

Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems. Most of the affected equipment, it said, was "legacy" product that no longer receives software or security updates. It named its AK-SM800 and AK-SC355 regulators, and said a version of the AK-SM800 was running outdated firmware.

The company said it had long advised customers to keep supported systems updated and to migrate legacy units to current-generation products. Danfoss gave no figures on how many systems were affected. E.Leclerc said the attack hit one of its refrigeration equipment suppliers.

The retailers' public statements so far do not say whether they had been warned to replace the older units, or why those units were reachable from the internet. Supermarket cold aisles are typically run from control panels that maintenance companies can access remotely, which is what makes this kind of attack possible.

The attackers did not shut the systems off. According to BFM TV, they remotely forced the defrost cycle. The BBC reported that normal overnight defrosts raise temperatures only slightly, while the hackers ordered the units to heat up and stay hot.

Beyond France

The Lecornu aide said France was coordinating with European counterparts because other countries could also be affected, and was working to identify other French companies at risk.

Félix Aimé, a senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, said Spain, Portugal, Poland, Germany and Belgium had also been affected.

Dutch retailer Ahold Delhaize, parent of Albert Heijn and Delhaize, said it was dealing with a "security issue" in its network and had taken several systems offline. Albert Heijn stores stayed open, but its app and delivery service were down and electronic price tags often showed wrong information. It is not clear whether that incident is connected to the French attack.

Authorities have not publicly named a suspect or a motive.

EU agriculture commissioner Christophe Hansen said "food security requires more attention at all levels" and called such "exploitation of food" a "reality." Christel Delberghe, director general of retail association Eurocommerce, said the incident "underlines the importance of resilience across the entire supply chain."

A pattern of breaches

France has taken other hits through third-party systems. In August, hackers breached the country's tax agency, compromising income and property records for 678,000 taxpayers and businesses. In early 2024, the payment processors Viamedis and Almerys were compromised, exposing data on 33 million healthcare policyholders.

This attack differs in kind. Those cases stole data. This one destroyed physical goods and started fires.

Several questions remain open. ANSSI has to establish who is behind the attack and how many Danfoss units remain exposed in France and elsewhere in Europe. Retailers have not yet said whether the unsupported controllers will be replaced or simply taken offline.