Hackers Defrost French Supermarket Fridges, Spoiling Food

A cyberattack on supermarket refrigeration systems in France turned an ordinary overnight shift into a costly food-safety emergency. Attackers remotely triggered defrosting at stores belonging to several major chains, leaving some refrigerators and freezers too warm to preserve their contents. Retailers had to discard fresh and frozen stock, while French prosecutors opened an investigation into the disruption.

Intermarche and Cooperative U confirmed the incident on Monday, October 12, after the systems were affected overnight. The two chains told AFP that roughly 150 to 200 Intermarche shops and nearly 100 Cooperative U outlets were hit. Those figures are estimates from the retailers, not a final count of every affected store. Other chains have appeared in reporting, but the full reach of the attack remains under investigation.

This was not a breach whose damage was confined to stolen files or an unavailable website. Cooling equipment is part of a supermarket’s physical operation. Once chilled food spends too long above its safe temperature, restoring power or resetting a controller does not make that stock saleable again. Intermarche said affected branches would have to throw away their fresh and frozen products.

The Paris prosecutor’s office confirmed an investigation into what it called a large-scale attack on connected refrigeration systems. It is working to establish which retailers were affected and the link between the intrusion and reported losses, including fires. Reuters reported that temperatures in some units were pushed as high as 50 degrees Celsius. That is a reported peak in affected equipment, not the temperature recorded in every store.

Danfoss, the Danish company whose refrigeration management systems have been identified in the reporting, said it was aware of incidents in France affecting a limited number of systems. That does not, by itself, establish how attackers first gained access. The precise entry point, the identity of the attackers and the total financial loss have not been publicly confirmed.

The distinction matters because earlier research can easily be mistaken for an explanation of this particular attack. Security firm Claroty has highlighted prior vulnerabilities in Danfoss refrigeration controllers and the risks of exposing their management interfaces to the internet. Danfoss addressed the flaws disclosed by the researchers, but no public evidence has yet tied those specific flaws to the supermarket incidents this week.

Remote monitoring makes commercial refrigeration easier to manage. A technician can check alarms, adjust settings and spot a failing unit without driving to each location. The same connectivity becomes dangerous when access controls, supported software or network separation are weak. In this case, the attacker did not need to break a freezer door to make food unusable; changing the system’s behaviour was enough.

There is a broader lesson for warehouses, food distributors, hospitals and any business that relies on networked equipment to keep temperature-sensitive goods safe. Defenders need to know which controllers are reachable remotely, who can administer them and whether alerts still work when normal settings are changed. The familiar work of securing connected systems is not only about protecting data. As this incident illustrates, a digital intrusion can rapidly become a physical and commercial loss. That is the same operational risk behind the urgency of patching exposed systems, from industrial controllers to the internet-facing administration tools businesses use every day.