Hundreds of supermarkets across France recently suffered food losses after hackers remotely changed the temperature settings of refrigerators and freezers, heating some units to as high as 50°C.
The attack, which took place overnight on October 11 and 12, affected major retailers including Intermarché, Carrefour, Monoprix, and Coopérative U, forcing stores to discard food and raising concerns about the security of connected refrigeration systems.
France’s cybersecurity agency, ANSSI, and the Paris prosecutor’s cybercrime unit are investigating the incident.
French Finance Minister Roland Lescure told Parliament that around 700 of the country’s 10,000 supermarkets had been affected. While the total financial damage remains unclear, Intermarché’s chief executive estimated that losses across the country could reach tens of millions of euros in a single day.
How Hackers Took Control of the Refrigeration Systems
The attackers accessed connected systems used to manage supermarket refrigeration equipment and changed settings that control temperatures and defrost cycles.
At an Intermarché store in Gradignan, southwestern France, the attack was discovered around 4 a.m. after a delivery driver noticed water flooding the storage area. Store owner Charles Dezon told Le Monde that the temperature in the cold room had reached 50°C, triggering a sprinkler system.
The attackers had also extended the defrost cycle from one hour to eight hours, delaying alarms and allowing temperatures to rise for longer, and making some equipment reportedly damaged by the heat.
Investigators identified refrigeration management systems supplied by Danish engineering company Danfoss among those affected. The company said many of the compromised units were outdated products that no longer received software or security updates.
However, France’s cybersecurity agency later identified basic security weaknesses, including exposed systems and weak passwords, as key concerns. Its preliminary assessment differed from earlier reports suggesting that known software vulnerabilities were directly responsible for the attack.
The precise method used to compromise every affected system has not been publicly established.
Supermarkets Count the Cost of Spoiled Food
The attack forced retailers to remove affected products to prevent food safety risks. Intermarché said around 150 of its stores were hit, while Carrefour reported 80 affected supermarkets. Monoprix also confirmed that around 5% of its French stores were impacted.
Coopérative U reported attacks against its refrigeration systems, with some stores discarding food despite efforts to prevent disruption.
And the financial impact went beyond the cost of only replacing stock. Some stores had to suspend operations while staff cleared affected products and checked their equipment. Retailers also faced delays in restoring refrigeration systems and replenishing shelves.
The incident showed how compromising a system used to manage industrial equipment can disrupt everyday business operations, even when the attack does not involve the theft of customer information.
Security Concerns Extend Beyond France
The attack has drawn attention to the risks created by refrigeration management systems that can be accessed remotely over the internet. These systems allow maintenance providers to monitor equipment and adjust settings without visiting individual stores, but inadequate security can also give attackers access.
Reuters reported that it found at least 4,500 Danfoss interfaces visible online during its investigation on October 13. While the number of exposed interfaces does not establish how many were vulnerable or compromised, it highlights the potential scale of the security challenge.
This incident has also exposed a gap in responsibility between supermarkets and the contractors that maintain their refrigeration equipment. Some retailers rely on external specialists to manage these systems and may not know whether their equipment is directly accessible online.
Investigation Continues as Security Questions Remain
French authorities have not publicly identified the attackers and no group has claimed responsibility. Investigators are working to establish how the systems were accessed, identify those responsible, and assess the full extent of the damage.
