French Supermarket Cyberattack Sends Fridges to 50°C, Destroying Food Stocks Across Hundreds of Stores

Hackers remotely manipulated refrigeration systems at hundreds of French supermarkets overnight on 11–12 October, forcing some units to reach 50°C and spoiling fresh and frozen food. Reports described attackers triggering continuous defrosting, disrupting normal cooling and leaving retailers assessing losses.

The Paris prosecutor's office opened an investigation into what it described as a 'large-scale' cyberattack affecting connected refrigerators at several major food retailers. Prosecutors said investigators would identify the victims and establish links between the attack and reported damage, including food losses and fires.

France Calls in Cybersecurity Agency to Investigate

Prime Minister Sébastien Lecornu tasked France's cybersecurity agency, the National Agency for the Security of Information Systems (ANSSI), with examining the incident and coordinating with European counterparts.

Danish engineering company Danfoss said affected French refrigeration management systems were running outdated firmware. Although researchers previously disclosed vulnerabilities in some Danfoss controllers, investigators have not publicly established whether those specific flaws were exploited.

Supermarket Freezers Hit as Food Stocks Are Discarded

Les Mousquetaires, the group behind Intermarché and Netto, told Reuters that around 150 stores had been affected. Separately, BFM TV reported a figure of 300 across the two chains. The estimates came from different accounts and should not be treated as a confirmed total.

Coopérative U, which operates Super U and other U-branded supermarkets, reported nearly 100 affected outlets. The overall number of affected stores remained uncertain as retailers assessed the disruption.

Dominique Schelcher, chief executive of Coopérative U, described the incident as 'extremely serious'. Retailers discarded food after refrigeration temperatures rose beyond safe limits, with fresh and frozen products among the stock affected.

The national cost had not been established. The extent of the damage depended on conditions at individual stores, and the reported number of affected outlets did not establish that every supermarket suffered the same level of stock loss.

Danfoss Says Affected Systems Used Outdated Firmware

Danfoss said the affected French units were running outdated firmware and that it had long advised customers to update supported systems and move legacy equipment to current-generation solutions.

The company described the incidents as affecting a limited number of refrigeration management systems. Its advice includes avoiding direct internet exposure and replacing obsolete equipment that no longer receives security updates.

The presence of Danfoss equipment does not, by itself, establish how attackers gained access. Investigators must distinguish between the systems involved, any weaknesses identified and the method used to manipulate refrigeration settings.

Researchers Previously Identified Controller Vulnerabilities

On 9 August, Team82, the cybersecurity research division of Claroty, published findings on vulnerabilities in Danfoss AK-SM 800A refrigeration management controllers. The systems allow operators to monitor and configure commercial refrigeration equipment.

Researchers identified flaws that could allow authentication bypass and remote code execution. Those capabilities can enable unauthorised access or the running of commands on a vulnerable system.

Danfoss released firmware version R4.3.1 to address the vulnerabilities described in the research. Claroty also identified thousands of management interfaces accessible over the internet.

Reuters reported, citing a source close to the prime minister, that ANSSI had identified a vulnerability in Danfoss software. However, the publicly available reporting does not establish whether the French attack exploited the specific flaws documented by Claroty.

Investigators Examine System Access and Food Losses

BFM TV reported that attackers remotely triggered forced defrosting in refrigeration systems at numerous stores. The resulting temperature increases disrupted the cold chain, which is the temperature-controlled storage needed to preserve fresh and frozen food.

Intermarché told AFP that affected branches would have to discard their fresh and frozen products. The retailer condemned the resulting food waste and financial losses but did not provide a total loss figure.

The Paris prosecutor's office said its investigation would establish the links between the attack and reported damage, including food losses and fires. Investigators are also seeking to determine how the refrigeration systems were accessed.

Authorities had not publicly identified a perpetrator in the initial reports. The total value of discarded food and other losses remained unclear as retailers continued assessing the damage.