Hackers raised the temperature of refrigerators and freezers at hundreds of French supermarkets to as high as 50 degrees Celsius (122 Fahrenheit), spoiling food and starting fires. Authorities and retailers have described the attack as unprecedented.
What happened
The attack struck overnight, and the Paris prosecutor’s office said a “large-scale” operation was affecting connected refrigerators at several major food retailers across France. French broadcaster BFM TV reported that the attackers remotely triggered forced defrosting in numerous stores.
The retailers have begun to put numbers on the damage. Carrefour reported 80 affected stores and Monoprix said about 5% of its locations were hit. Les Mousquetaires, which owns Intermarché, said fridges at roughly 150 stores were heated to 50C for six hours. Coopérative U chief executive Dominique Schelcher confirmed that his group was also targeted and called the attack unprecedented and of extreme gravity.
The effects were visible on the street. A Paris resident watched staff at an Intermarché in the city centre throw cartloads of defrosted frozen food into a large container. A company spokesperson said all affected food had been discarded to eliminate health risks.
How a fridge becomes a target
Supermarket refrigeration is rarely managed by hand. Cold aisles are typically run by control panels that manage a whole store’s fridges and freezers and can be reached over the internet, which lets maintenance companies adjust them from anywhere.
That convenience is also a weakness. A system that an engineer can reach remotely can, if poorly protected, be reached by an attacker as well. Security specialists have long warned that internet-connected building and industrial controllers are often installed once and rarely updated.
The equipment supplier’s statement points in that direction. Danish firm Danfoss said it was aware of incidents affecting a limited number of its refrigeration management systems in France and that the affected units were running outdated firmware. The company said it had long advised customers to keep supported systems updated and to move legacy systems to current-generation products.
The French retail federation, the Fédération du Commerce et de la Distribution, has called on Danfoss for full transparency about the incident. In early reports no group had been named as responsible, and investigators have not publicly said how the attackers gained access.
Spreading beyond France
The government has moved quickly. Prime Minister Sébastien Lecornu ordered a cybersecurity investigation, and similar incidents have been reported in Spain, Portugal, Poland, Germany and Belgium. French authorities say they are coordinating with European counterparts because other countries could be affected, and are assessing whether other French companies are at risk.
Why it matters
The immediate cost is financial. Early coverage has pointed to fires and losses running into the millions. The wider concern is food security. Chilled and frozen goods have narrow safety margins, and a failure that spreads across many stores at once can strip shelves faster than supply chains can replace stock.
The incident also shows how cyber risk has moved from screens into physical systems. Attacks on operational technology, the equipment that heats, cools and moves things, can cause damage that is expensive and visible in a way that stolen data often is not.
What businesses can take from it
Security experts generally recommend a few basic steps for any organisation running connected equipment:
- Keep firmware and software on control systems up to date, and replace unsupported devices.
- Remove unnecessary internet exposure and require strong authentication for remote maintenance access.
- Separate control networks from the rest of the corporate network.
- Rehearse manual backup plans so stores can protect stock if automation fails.
What happens next
Prosecutors will try to establish who was behind the attack and how it was carried out. Retailers are working to restore normal operations and replace lost stock, while regulators and industry bodies are likely to press equipment suppliers on how quickly vulnerable systems are patched. For shoppers, the practical message from the retailers is that affected products have been thrown away.
