Hackers Turn French Supermarket Refrigerators Into Furnaces

Hackers remotely took control of refrigeration systems in hundreds of French supermarkets, raising temperatures inside to 50 degrees Celsius and spoiling large amounts of food, according to multiple reports. The cyberattack occurred overnight on October 11 to 12, triggering intense defrost cycles that caused fires and forced stores to discard perishable goods. A Dutch grocery giant also reported a cybersecurity incident, though specific details remain unclear. The Paris Prosecutor’s Office confirmed that a national criminal investigation has begun, focusing on identifying victims and linking the incident to reported damages such as food spoilage and fire outbreaks. The attack exploited vulnerabilities in internet-connected refrigeration systems, particularly those manufactured by Danish company Danfoss. Security firm Claroty had previously warned about potential breaches involving Danfoss controllers in a report released in August. Researchers demonstrated how attackers could exploit a hidden "code-of-the-day" authentication mechanism and a command-injection vulnerability to gain control of Danfoss AK-SM 800A platforms. Although Danfoss issued a firmware update in August 2025 to address these flaws, recent scans revealed that approximately 2,765 Danfoss controllers remained exposed online. France’s national cybersecurity incident response center, CERT-FR, confirmed that the vulnerabilities extended beyond Danfoss systems, including Copeland XWEB and Dixell XWEB monitoring systems used in commercial refrigeration. These devices allow operators to remotely monitor temperatures, trigger alarms, and manage energy consumption. CERT-FR warned that attack campaigns might still be ongoing and urged users to avoid exposing these management interfaces to the public internet. A simple factory reset was deemed insufficient for unpatched equipment, which would likely be compromised again. The impact on French supermarkets was severe, with food losses estimated in the tens of millions of euros. Retail chains such as Carrefour, Monoprix, E.Leclerc, and Les Mousquetaires reported being affected. Some stores had to discard food to prevent health risks, while others faced complete system failures. Coopérative U, a supermarket chain operating nearly 2,000 stores, confirmed that 80 of its locations were targeted. Despite staff efforts to maintain the cold chain, affected products were removed and destroyed in many instances. French Prime Minister Sebastien Lecornu directed the National Cybersecurity Agency (ANSSI) to investigate the incident, with coordination extending to European counterparts due to concerns that other countries might also be affected. Felix Aime, a senior cyber threat intelligence analyst, indicated that Spain, Portugal, Poland, Germany, and Belgium had also suffered similar attacks. Danfoss acknowledged that some of its systems were affected, noting that the compromised units were running outdated firmware. The company reiterated its long-standing advice for customers to keep systems updated with the latest firmware and to transition legacy systems to modern solutions. The attack highlighted the critical need for improved cybersecurity measures in sectors reliant on interconnected infrastructure. Retail associations called for greater transparency from manufacturers and emphasized the importance of building resilient supply chains. Meanwhile, experts warned that the increasing sophistication of cyber threats, especially with the rise of artificial intelligence, could lead to more frequent and widespread attacks targeting essential services and infrastructure.