Hackers sabotage French supermarket refrigeration systems across Europe

Overnight, hackers seized control of refrigeration systems at hundreds of supermarkets across France and beyond, turning freezers into ovens. The temperature inside connected fridges climbed to 50 degrees Celsius—122 degrees Fahrenheit—hot enough to melt ice cream and trigger fires. By Monday morning, the Paris prosecutor's office confirmed what retailers were discovering in real time: a coordinated, large-scale attack had struck major food chains, spoiling inventory and forcing staff to haul cartloads of ruined food to dumpsters.

The breach was not confined to France. A senior cyber threat intelligence analyst at Sekoia identified affected supermarkets in Spain, Portugal, Poland, Germany, and Belgium. In France alone, the damage was immediate and measurable. Carrefour reported 80 stores hit. Monoprix, operating roughly 490 locations nationwide, lost 5 percent of its stores. Les Mousquetaires, which owns Intermarche, saw refrigerators at around 150 stores heated for six straight hours. A witness in central Paris watched staff dump defrosted frozen goods into a trash container, melted ice cream spilling onto the street. Cooperative U, another major supermarket group, confirmed it had also been targeted.

The financial toll was staggering. Intermarche's CEO told a television station the attack would cost the industry tens of millions of euros in a single day—unprecedented in scale and impact. No comprehensive damage estimate existed yet, but the number was climbing as stores across multiple countries assessed their losses. The attack struck at the infrastructure most essential to food retail: the cold chain itself. Supermarket refrigeration systems are typically managed by control panels that regulate an entire store's fridges and freezers, and these panels are accessible over the internet to allow maintenance companies to adjust settings remotely from anywhere in the world.

Investigators quickly identified the vulnerability. The French National Cybersecurity Agency, instructed by Prime Minister Sebastien Lecornu to investigate, traced the breach to software supplied by Danfoss, a Danish company. The affected refrigeration units were running outdated firmware—software versions that Danfoss had long urged customers to update. In August, cybersecurity researchers at Claroty's Team82 had published detailed findings about vulnerabilities in the Danfoss AK-SM 800A controller, documenting how attackers could bypass authentication controls and execute code on compromised devices. Those same vulnerabilities, it appeared, had now been weaponized at scale.

Danfoss acknowledged the incidents but framed them as affecting only a limited number of systems running legacy software. The company reiterated that it had repeatedly advised customers to keep their systems current and migrate away from older equipment. The French retail association demanded full transparency from Danfoss about what had happened and what safeguards existed. Some affected stores were already restoring operations, but the breach had exposed a critical weakness: the infrastructure that keeps food fresh and safe was connected to the internet and, in many cases, inadequately protected.

The attack was not isolated to Europe. In late August, about a dozen U.S. military commissaries had experienced similar disruptions when their refrigeration systems were compromised, leading to food losses. Now, as French authorities coordinated with European counterparts to assess the full scope of the breach, a Dutch supermarket giant reported its own security crisis. Ahold Delhaize, which operates Albert Heijn in the Netherlands and major chains across the United States—Stop & Shop, Giant, Hannaford, and Food Lion—said it was dealing with a cybersecurity incident and had taken systems offline as a precaution. Its grocery delivery service, which accounts for roughly 10 percent of Albert Heijn's sales, went dark. The company insisted there was no connection between its incident and the French attacks, but the timing raised questions about whether this represented something larger: a coordinated campaign targeting food supply chains across continents.