French supermarket cyberattack exposes vulnerability in connected refrigeration systems

On Monday, October 12th, French supermarket chains discovered that their refrigeration systems had turned against them. Hackers had remotely seized control of connected fridges and freezers across hundreds of stores, forcing temperatures upward to 50 degrees Celsius—122 degrees Fahrenheit. The units held at that lethal heat for roughly six hours. Food that should have been kept cold spoiled. Fires broke out at some locations. By the time store managers regained control, the damage was done: tens of millions of euros in losses across a single day, according to Intermarché's chief executive Thierry Cotillard.

The scale became clear as reports arrived from major retailers. Intermarché's parent company, Les Mousquetaires, confirmed that around 150 of its stores had been hit. Carrefour reported 80 supermarkets affected. Monoprix said roughly 5 percent of its locations were compromised. Coopérative U and other chains also reported disruptions. The Paris prosecutor's office confirmed what was becoming obvious: this was a large-scale, coordinated cyberattack. Stores across the country were forced to discard spoiled inventory—meat, seafood, dairy, frozen goods—anything that had warmed beyond safe storage temperatures. Simply turning the refrigeration back on would not make the food safe again. Customers arriving at supermarkets found refrigerated sections closed or emptied while staff assessed what could be salvaged.

The method was both simple and devastating. Supermarket refrigeration systems operate through centralized digital controls that allow staff and maintenance teams to monitor temperatures and manage cooling cycles remotely across entire chains. This remote access makes operations efficient. It also creates a vulnerability. Investigators identified the weakness in software supplied by Danish engineering company Danfoss. According to sources close to Prime Minister Sébastien Lecornu, the affected systems were running outdated firmware—old code that Danfoss had already flagged as needing updates. The attackers exploited this gap by remotely triggering forced defrost functions, causing the refrigeration units to heat rather than cool. A compromised digital control system had become a tool for physical destruction.

What made this attack unusual was what it targeted. Most cyberattacks aim at data—customer information, payment records, corporate secrets. This one aimed at machinery. It demonstrated that access to a digital control system could do far more than interrupt a computer network; it could change how physical equipment behaves. A hacker sitting somewhere with access to the right credentials could turn a supermarket's refrigerators into furnaces. The consequences were immediate and tangible: spoiled food, disrupted supply chains, fires, and financial losses that Cotillard suggested could run into the tens of millions across France in a single day.

French authorities, including the National Cybersecurity Agency (ANSSI), launched an investigation into how the attackers gained access and whether they had targeted other countries. The incident raised an urgent question about the cybersecurity of everyday equipment connected to the internet. Retailers increasingly rely on digital systems to control not just refrigeration but heating, ventilation, security, and other essential functions. These technologies reduce manual work and improve efficiency. They also create entry points for cybercriminals. A weakness in one component—outdated firmware, poor authentication, inadequate network separation—can have consequences that ripple through physical operations.

Danfoss acknowledged that the affected systems were running legacy code and said it had advised customers to update to supported versions and move away from outdated solutions. But the damage was already done. Investigators were still examining the incident, and authorities had not publicly identified who carried out the attack. Meanwhile, Dutch retail group Ahold Delhaize, which operates Albert Heijn in the Netherlands and supermarket chains in the United States, separately reported a cybersecurity issue and took some systems offline as a precaution. Whether the Dutch incident was connected to the French attack remained unclear.

The investigation now centers on fundamental questions about how connected infrastructure is protected. Keeping firmware updated is one safeguard. Businesses also need to restrict remote access, use strong authentication, monitor for unusual activity, and separate operational technology from other corporate networks. The findings from French authorities could reshape cybersecurity requirements not just for retail but for any business that relies on internet-connected equipment to manage physical operations. For now, supermarket chains across France were assessing damage, restocking shelves, and confronting the reality that the systems designed to make their operations more efficient had become a vector for attack.