Coordinated cyberattack heats French supermarket fridges to 50°C, causing fires and massive food waste

Overnight, without warning or forced entry, hackers remotely seized control of refrigeration systems across hundreds of supermarkets in France. They turned the temperature dials up to 50 degrees Celsius—hot enough to melt ice cream, thaw frozen meat, and ignite fires in sealed compartments. By Monday morning, when the Paris prosecutor's office announced what had happened, the damage was already done: food spoiled across entire store networks, flames had broken out in multiple locations, and the bill was climbing toward tens of millions of euros in losses.

The attack was coordinated and large-scale. Carrefour, France's largest retailer, lost 80 stores. Intermarche, which operates roughly 150 affected locations, had its refrigeration systems deliberately heated for six hours straight. Monoprix saw 5 percent of its roughly 490 stores compromised. Cooperative U and other chains were hit as well. In a Paris Intermarche, a witness watched staff shovel defrosted food into industrial trash bins—cartloads of ruined inventory, with melted ice cream pooling on the street.

The attack did not stop at France's borders. Spain, Portugal, Poland, Germany, and Belgium all reported similar incidents, according to Felix Aime, a senior cyber threat intelligence analyst. The Dutch supermarket chain Ahold Delhaize, which operates Albert Heijn and major US grocery brands including Stop & Shop, Giant, Hannaford, and Food Lion, disclosed a separate security breach on its network and took systems offline as a precaution. Its online grocery delivery service went dark. The company said there was no confirmed link between its incident and the French attacks, but the timing and scope suggested something larger was moving through European retail infrastructure.

The vulnerability lay in the systems themselves. Supermarket cold aisles run on control panels that manage entire stores' refrigeration networks and can be accessed over the internet—a feature designed to let maintenance technicians adjust temperatures and diagnose problems remotely. The Paris prosecutor's office identified the weak point: outdated firmware in refrigeration controllers made by Danfoss, a Danish company. In August, cybersecurity researchers at Claroty's Team82 had published detailed research showing how attackers could bypass authentication controls on Danfoss AK-SM 800A units and execute code directly on the devices. Danfoss had issued software updates to patch these holes, but many supermarkets had not installed them. The company later acknowledged that affected units "were running outdated firmware" and said it had repeatedly advised customers to update their systems.

Prime Minister Sebastien Lecornu ordered France's National Cybersecurity Agency to investigate immediately. Officials began coordinating with European counterparts to assess whether other companies and countries remained at risk. The French retail association called for full transparency from Danfoss and said some stores were already restoring operations. But the scale of the immediate loss was staggering. Intermarche's CEO told a television station the attack would cost the industry "tens of millions of euros nationwide in a single day"—an unprecedented strike against the food supply chain itself.

The pattern was not entirely new. In late August, about a dozen US military commissaries had suffered similar attacks: hackers remotely heated refrigeration systems, spoiled food, and forced closures. That incident had been treated as isolated. This one suggested something different—a coordinated campaign, possibly still unfolding, targeting the infrastructure that keeps perishable food cold across continents. The question now was whether the attackers had moved on or were still inside the systems, waiting.