Massive cyberattack in France: Hackers raise temperature in refrigerators, spoil food in hundreds of stores

A large-scale cyberattack on the refrigeration systems of French supermarkets forced hundreds of stores to discard fresh and frozen food overnight from Sunday to Monday.

According to AFP, the incident—described as "unprecedented" by one of the affected groups—raised the temperature of refrigerators and freezers to 122 degrees Fahrenheit in some cases and caused fires in several stores.

The Paris Prosecutor's Office confirmed the opening of an investigation. The goal is to identify the victims and establish a link to the reported damages, including food losses and the fires that occurred.

Sabotaged chains

The E.Leclerc, Intermarché, and Coopérative U chains confirmed they had been targeted. Intermarché reported that at least 300 of its own stores or those under its Netto brand were targeted, while Coopérative U counted more than 100 affected locations; E.Leclerc also acknowledged impacts at several of its stores.

According to a report by BFM TV, the attackers targeted the refrigeration control systems manufactured by the Danish company Danfoss, which are used by numerous retail chains in France. Specifically, they managed to remotely trigger a forced defrost cycle in the systems—a function normally used to remove ice buildup in the equipment—which caused the refrigerators and freezers to overheat.

"The affected stores will have to throw away all fresh and frozen products," Intermarché told AFP. The company condemned the food waste and economic losses, though it did not provide figures.

The focus: Danfoss software

The investigation points to a vulnerability in refrigeration control systems supplied by the Danish company Danfoss. E.Leclerc explained that the cyberattack affected "one of its refrigeration equipment suppliers," impacting the operation of systems in several stores.

Danfoss acknowledged that most of the affected equipment consisted of older models that no longer receive software or security updates. The company specifically cited its AK-SM800 and AK-SC355 controllers, noting that a version of the former was running obsolete firmware. It also stated that it had been recommending for some time that supermarkets update those models.

Antoine Hautin, of the cybersecurity consulting firm Almond, told AFP that the fact that hundreds of units were likely affected at the same time demonstrates "a certain level of sophistication."