Hackers Turn Up The Heat on French Supermarket Fridges In “Unprecedented” Cyberattack

Some of France’s largest food retailers confirmed yesterday that refrigeration equipment in their stores had been hit by a cyberattack, with Coopérative U chief executive Dominique Schelcher saying systems had been disrupted since Sunday night.

Intermarché said at least 300 of its shops, including stores under its Netto brand, had been targeted. Coopérative U reported more than 100 affected outlets and Carrefour 80 supermarkets, while Monoprix, E.Leclerc and Auchan also confirmed that some of their stores had been affected.

According to BFM TV, the attackers remotely triggered forced defrosting cycles on refrigeration units, destroying fresh and frozen produce. Intermarché said affected branches would have to throw away all of their fresh and frozen products.

“The cyberattack on French supermarkets is a stark reminder that cyber threats extend far beyond stolen data and financial losses. Hackers reportedly manipulated refrigeration systems, raising temperatures to 50°C, causing fires and forcing retailers to dispose of large quantities of food. With hundreds of stores affected, the incident highlights how vulnerabilities in connected systems can have serious real-world consequences, disrupting operations, damaging equipment and potentially putting public safety at risk. It also demonstrates how increasingly interconnected technology can create new opportunities for cybercriminals.” said Jamie Akhtar, CEO and Co-founder of CyberSmart.

Schelcher described the targeting of equipment essential to preserving fresh products as being “of extreme gravity”.

Outdated Equipment in The Firing Line

The attack appears to have centred on refrigeration management systems made by Danish manufacturer Danfoss. A source close to Prime Minister Sébastien Lecornu said France’s National Cybersecurity Agency (ANSSI) had identified a vulnerability in the company’s software, and Lecornu has ordered the agency to investigate.

Danfoss said most of the affected equipment consisted of “legacy” products that no longer receive software or security updates, naming its AK-SM800 and AK-SC355 systems in particular. The company said it had long advised customers to update or replace older models.

“This incident is not surprising. A supermarket refrigerator is no longer just an electrical appliance. It is a computerised system connected to a network, enabling remote monitoring and control. While this connectivity allows refrigeration systems to be managed efficiently, it also exposes them to cyber security risks, particularly when operational equipment runs for years on outdated software, without regular security updates, and with management interfaces accessible from the internet.” said Oded Vanunu, Head of Vulnerability Research at Check Point.

Vanunu added that the attack did not necessarily require advanced skills: “One of the significant aspects of this incident is that the attackers did not necessarily need sophisticated cyber capabilities. Refrigeration systems have legitimate operational functions, such as defrost cycles, and when an unauthorized party gains access to the system, those same functions can be exploited to disrupt operations. Unlike attacks aimed at stealing data or encrypting files, the impact here is on the physical operation of the equipment itself, with direct consequences such as food inventory losses and potential safety hazards.”

No group has claimed responsibility, and there have been no reports of a ransom demand or of data being stolen. The Paris prosecutor’s office has opened an investigation into what it described as a “large-scale” attack on connected refrigerators at several major food retailers.

A Costly Weekend For Retailers

The full cost of the attack is not yet known, but early estimates suggest it will be substantial. Intermarché chief executive Thierry Cotillard told BFM TV that losses could reach “tens of millions of euros nationwide in a single day”. One Intermarché in Issy-les-Moulineaux reportedly discarded around €50,000 worth of food, including all of its ice cream and charcuterie.

“The refrigeration systems in supermarkets are operational technology. Building management controls, HVAC, cold chain infrastructure. These are the same category of systems that the security industry has been warning about as the next frontier for sabotage attacks, and they’ve now been weaponised against food retail infrastructure in one of Europe’s largest economies.” said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

“The immediate financial consequences are significant and visible. Failures at the stores means total write-off of perishable stock across every affected location simultaneously. The operational disruption compounds quickly. Staff cannot trade normally without functioning refrigeration. Products cannot be restocked until systems are restored and verified safe. The food retail sector across Europe should be treating this as a signal that they are being actively targeted.” he added.

France’s retail federation, the FCD, said some affected stores were already trading again, and called on Danfoss to provide “full transparency”.

Not Just a French Problem

Authorities in France are coordinating with European counterparts, and Sekoia analyst Felix Aime has said stores in Spain, Portugal, Poland, Germany and Belgium were also affected. EU food and agriculture commissioner Christophe Hansen wrote on X that “food security requires more attention at all levels”.

“Heating fridges to 50 degrees for six hours is not data theft, it is physical sabotage executed through software, and that is the lesson for every sector. Refrigeration controllers, building systems and point-of-sale equipment are now connected and remotely managed, often through a handful of suppliers, so one weak link scales to hundreds of stores overnight.” said Samuel Hassine, CEO and co-founder of Filigran.

Vanunu warned that the risks are compounded by the long lifespan of operational equipment and the fact that the same technology is used by retailers around the world: “The problem extends beyond a single refrigeration system or an isolated security vulnerability. Operational equipment is often designed to remain in service for 15 years or more, while cyber threats and technologies evolve at a much faster pace. In addition, the same controllers and management systems are deployed across retail chains worldwide, meaning that a compromise affecting widely used technology could potentially impact a large number of locations.”

“In previous research conducted by Check Point on smart devices, including LG products, we demonstrated how a vulnerability in a centralised management platform could allow attackers to gain control of connected devices. However, in the current incident, it is still unclear exactly how the attackers gained access to the systems.”

What Should Businesses Be Doing?

Experts say the incident should prompt organisations in every sector to look beyond traditional IT and review the security of connected operational equipment.

“For businesses, this reinforces the importance of securing all connected devices and systems, not just traditional IT infrastructure. Organisations should prioritise regular software and firmware updates, strong access controls, multi-factor authentication where supported and network segmentation to prevent attackers moving between systems. Regular security assessments and employee cybersecurity awareness training are also essential for identifying vulnerabilities before they can be exploited. Ultimately, businesses must recognise that cybersecurity is no longer just about protecting data, but also about safeguarding physical operations, customers and business continuity.” said CyberSmart’s Akhtar.

Check Point’s Vanunu recommended that organisations start by understanding their exposure:

“To reduce these risks, the first step is to identify which controllers and management interfaces are directly exposed to the internet and eliminate any unnecessary exposure. It is also important to keep systems updated, replace default passwords, restrict remote access, and enable multi-factor authentication wherever supported. Separating operational control networks from other networks and monitoring unusual changes in system behaviour are also essential measures. These recommendations apply not only to refrigeration systems, but also to HVAC, building management systems, and other operational infrastructure.”

Filigran’s Hassine said the issue should be on the boardroom agenda immediately:

“Boards should ask three questions this week. Which connected equipment could cause physical or financial damage if someone changed a setting, and who can reach it from outside. Which third parties hold remote access, and how that access is monitored and segmented. And has anyone tested that the response works, from detection to switching to manual operation. Resilience in retail now means knowing your exposure before an attacker maps it for you.”