France Supermarket Cyberattack: Hackers Heat Fridges to 50°C, Spoil Food and Trigger Fires

France is investigating a major cyberattack that targeted refrigeration systems at hundreds of supermarkets, forcing refrigerators and freezers into defrost mode and causing widespread food losses.

The attack, reported on October 12, affected major retail chains including Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc. Reports put the number of affected stores in the hundreds, although the exact total remains unclear as retailers continue assessing the damage.

Some refrigeration units reportedly reached temperatures of up to 50°C, or 122°F. The attack also triggered fires at several locations, according to the Paris prosecutor’s office.

Affected stores had to discard fresh and frozen food because it could no longer be considered safe for sale.

French Government Orders Cybersecurity Investigation

French Prime Minister Sébastien Lecornu instructed the country’s National Cybersecurity Agency (ANSSI) to investigate the incident.

The Paris prosecutor’s office described the attack as large-scale and confirmed that connected refrigeration systems at several major food retailers had been affected.

French authorities are also coordinating with European counterparts to determine whether companies in other countries have been targeted or remain at risk.

The incident has raised concern because supermarket refrigeration is not merely a convenience: it is essential infrastructure for keeping meat, dairy products, frozen food and other perishable goods safe.

How Did Hackers Turn Refrigerators Into Heaters?

Supermarket refrigeration systems are often controlled by central panels that manage dozens of refrigerators and freezers. Maintenance companies can sometimes access these systems remotely through internet-connected software.

If an attacker gains unauthorised access, they may be able to change settings without physically entering the store.

In this incident, reports indicate that attackers remotely activated the systems’ defrost function. Defrosting normally melts ice that builds up inside refrigeration equipment, but if the process is triggered improperly or continues for too long, temperatures can rise and food can spoil.

The attack demonstrates how a weakness in a computer system can cause physical damage and disrupt everyday services.

Why Is Danfoss Under Scrutiny?

Investigators have identified a potential connection to refrigeration management software supplied by Danish company Danfoss.

Danfoss said it was aware of incidents in France involving refrigeration management systems and that the affected units were running outdated firmware. The company said it had advised customers to install updates and move away from older systems.

Cybersecurity company Claroty had previously published research describing vulnerabilities in Danfoss’s AK-SM 800A refrigeration controller. According to the researchers, the flaws could allow attackers to bypass normal authentication controls or execute commands on affected devices. Danfoss released fixes for the reported vulnerabilities.

However, the existence of earlier software vulnerabilities does not by itself prove exactly how the attackers entered every affected store. Investigators still need to establish the precise attack method and whether the same weakness was used across all incidents.

Retailers Face Heavy Financial Losses

Intermarché reported that around 150 of its stores were affected in initial reports, while other chains also reported disruptions. Retailers have warned of substantial losses from food that must be thrown away.

Intermarché chief executive Thierry Cotillard estimated that losses across the wider retail sector could reach tens of millions of euros in a single day. The final figure has not yet been established.

Coopérative U chief executive Dominique Schelcher described the incident as unprecedented and said the attack had affected the systems used to preserve food and supply consumers.

Could This Happen in Other Countries?

French authorities are working with European partners to determine whether the incident has affected businesses beyond France. Cybersecurity analysts have raised concerns about possible exposure in other European countries, but the extent of any linked attacks remains under investigation.

The wider lesson is that internet-connected equipment can become a target even when it is not part of a bank, government office or traditional computer network. Refrigeration, heating, factory controls and other systems can all create real-world risks if their digital security is weak.

The takeaway: The attack has exposed how a cyber intrusion can damage food supplies, cause financial losses and potentially create fire hazards. Updating old software, limiting remote access and monitoring industrial control systems are essential steps for protecting businesses and the public.