Massive cyberattack sabotages French supermarket refrigeration, spoiling millions in food

On Sunday night, hackers broke into the refrigeration systems of hundreds of supermarkets across France and turned up the heat. By Monday morning, when store managers arrived to find their cold aisles warm, the damage was already done. Temperatures in fridges and freezers had climbed to 50 degrees Celsius—122 Fahrenheit—hot enough to spoil everything inside and, at several locations, to trigger fires. The attack was sweeping and coordinated. At least 300 stores carrying the Intermarche or Netto brands were hit. More than 100 Cooperative U outlets went down. Carrefour lost 80 supermarkets to the breach. Monoprix saw roughly 5 percent of its roughly 490 stores affected. E Leclerc reported strikes against several of its locations. By Monday, the country's largest retailers had all confirmed what they were calling an "unprecedented" cyberattack.

The mechanics of the breach were straightforward, if audacious. Supermarket refrigeration systems are controlled by panels that manage an entire store's cold equipment and can be accessed remotely over the internet—a feature designed to let maintenance technicians adjust temperatures and diagnose problems from anywhere. Hackers found their way into these systems and, according to reporting from BFM TV, remotely triggered what's called forced defrosting: a sudden, violent warming that destroys everything stored inside. Intermarche told the AFP news agency that affected stores had no choice but to throw away all fresh and frozen products. There was no salvaging anything. Thierry Cotillard, the CEO of Intermarche, told BFM TV that the losses would amount to "tens of millions of euros nationwide in a single day." No industry-wide estimate had been calculated by Monday, but that figure alone suggested the scale of the catastrophe.

The vulnerability that made the attack possible came from equipment made by Danfoss, a Danish company that supplies refrigeration management systems to supermarkets across Europe. The systems were running outdated firmware—old software that Danfoss said it had "long advised customers" to update or replace. In August, the cybersecurity firm Claroty had published detailed research describing how attackers could bypass authentication on Danfoss systems, essentially handing hackers a roadmap. The company acknowledged being "aware of incidents in France affecting a limited number of refrigeration management systems," but the scale of what unfolded suggested the problem was far larger than Danfoss's initial characterization.

Dominic Schelcher, the chief executive of Cooperative U, called the attack "extremely serious and unprecedented." He wrote on X that targeting equipment essential to preserving fresh food and supplying the French people was "unacceptable." His teams were working to restore normal operations, but the investigation into how the breach happened and how deep it went had only just begun. France's retail federation, the FCD, demanded that Danfoss provide "full transparency" about the vulnerability and what customers should have done differently. Some affected stores were already back online by Monday, but many remained dark.

The French government moved quickly. Prime Minister Sebastien Lecornu ordered the National Cybersecurity Agency, known as ANSSI, to investigate. A source in his office told Reuters that France was already coordinating with European counterparts because the attack appeared to have crossed borders. Felix Aime, a senior cyberthreat intelligence analyst at Sekoia, confirmed that Spain, Portugal, Poland, Germany, and Belgium had also been affected. The breach was not confined to France. Authorities were assessing whether other French companies beyond retail had been compromised and remained vulnerable. The attack bore a resemblance to disruptions that had hit about a dozen U.S. military commissaries in late August, where refrigeration system failures had also led to significant food losses. The pattern suggested a new frontier in cyberattacks: not data theft or ransomware extortion, but the sabotage of physical infrastructure that ordinary people depend on every day.