Cyberattack heats French supermarket fridges, spoiling food and sparking fires

The Big Picture

Hackers disrupted refrigeration systems at hundreds of French supermarkets, causing fridges and freezers to heat up or enter forced defrosting cycles overnight from Oct. 11 to 12. The attack spoiled fresh and frozen food, prompted some retailers to take systems offline as a precaution and caused fires at some stores, according to the Paris prosecutor's office.

French prosecutors have opened a cybercrime investigation into what the office described as a large-scale attack affecting connected refrigerators at several major food retailers across the country. Prime Minister Sebastien Lecornu instructed France's National Cybersecurity Agency, known as ANSSI, to investigate, according to a person in his office cited by Reuters and The Guardian.

What Happened

The affected equipment used refrigeration-management software supplied by Danish engineering company Danfoss. The systems allow retailers to remotely manage cold units, including the temperatures of fridges and freezers.

Normally, freezers undergo brief overnight defrosting periods. But in this case, attackers appear to have forced some units to warm and remain hot. Intermarche said some of its refrigeration units reached 50C, or 122F, for about six hours overnight. The retailer said it discarded all affected fresh and frozen products to avoid health risks.

Carrefour said refrigeration units at 80 of its roughly 6,000 French stores were affected. Monoprix said about 5 percent of its more than 400 stores were hit and that products were removed from sale when their condition could not be guaranteed. Retailers reported that some refrigeration displays remained out of service as they worked to restock shelves.

The overall scale remains disputed. The BBC, based on figures supplied by individual chains, reported that about 400 stores may have been affected. Al Jazeera later reported that more than 500 shops had been hit. Reports also differ over Intermarche and Netto locations, with estimates ranging from about 150 affected stores to at least 300 targeted stores.

Why It Matters

The attack shows how a breach of internet-connected operational technology can quickly translate into physical disruption. In supermarkets, refrigeration is essential not only for sales but also for food safety. At some branches, managers arriving on Monday found unusually warm freezer areas, and authorities reported fires in some locations.

The losses could be substantial, though no industry-wide total has been established. The BBC reported that two supermarkets in the Alsace region put their combined losses at 270,000 euros. Separately, Intermarche chief executive Thierry Cotillard told BFM TV that nationwide losses could reach tens of millions of euros in one day, an estimate that has not been independently confirmed.

Dominique Schelcher, chief executive of Cooperative U, called the incident "extremely serious and unprecedented." He said that targeting equipment essential to preserving fresh products and supplying food to the French public was unacceptable.

What Each Side Is Saying

Danfoss said it was aware of incidents in France involving a limited number of refrigeration-management systems. The company said affected units were older or legacy systems running outdated firmware. It said it had long advised customers to keep supported equipment updated and to migrate legacy systems to current-generation solutions.

A source close to Lecornu said ANSSI had identified a vulnerability in Danfoss software. However, the perpetrators and the precise method used to obtain access have not been publicly identified. France was also coordinating with European counterparts because other countries or companies could potentially be affected, according to the source.

There were reports of disruptions elsewhere in Europe, but links to the French attack have not been established. Ahold Delhaize reported a separate security issue affecting systems in the Netherlands, Belgium and Luxembourg, while saying it was unclear whether that problem was connected. Cyberthreat analyst Felix Aime told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected, though the available reports do not establish those incidents as part of the same attack.

What Happens Next

Investigators are working to establish who carried out the attack, how the systems were accessed and whether other companies remain at risk. Some affected retailers disconnected refrigeration equipment from the internet or took other systems offline to prevent further disruption. Danfoss's comments and the reported ANSSI findings are likely to focus attention on the security of older connected industrial equipment used across food retail.