Cyberattack remotely sabotaged French supermarket refrigerators, forcing mass food disposal

Someone, somewhere, sent a command through the internet and the refrigerators stopped working properly. At supermarkets across France—Intermarché, Carrefour, and others—the temperature inside the cooling units began to climb. The products inside, meant to stay cold, started to thaw. Milk spoiled. Meat warmed. And hundreds of retailers had no choice but to throw it all away.

This was not a power outage or a mechanical failure. This was a deliberate act. Unknown attackers had found their way into the refrigeration systems remotely and turned up the heat. The incident was serious enough that French Prime Minister Sébastien Lecornu became personally involved in managing the fallout. The European Union coordinated information sharing across member states as the scope of the problem became clear.

The attackers' identities remain unknown, as do their motives. But cybersecurity researchers believe the method was straightforward: the attackers exploited devices that should never have been connected to the internet in the first place. One manufacturer in particular, Danfoss, had built refrigeration equipment with a software vulnerability. Claroty, a cybersecurity firm, had identified this flaw previously. Danfoss patched it in 2025, but by then the damage was already done—systems in the field were still running the vulnerable code.

What made this attack especially alarming was how easily it could have been worse. French authorities immediately began assessing which other critical systems depended on temperature control. Vaccine storage during flu vaccination campaigns came to mind. If attackers could warm refrigerators at a supermarket, they could warm refrigerators at a clinic or distribution center. No such attacks were reported, but the vulnerability was now visible to everyone paying attention.

The French incident was not isolated. That same week, separate cyberattacks hit supermarkets in the Netherlands and Belgium, though with less severe consequences. Silvio Erkens, the Dutch food security minister, used the moment to state something obvious but often overlooked: food supply chains now depend entirely on IT systems and networks. Break the networks, and you break the supply chain.

French and German cyber agencies issued a warning: the attacks were likely still ongoing. Researchers and industry trackers had identified hundreds of devices still connected to the internet that could be vulnerable to the same exploitation. The number was slowly decreasing as organizations scrambled to disconnect or secure their systems, but progress was uneven. Not all of those devices were necessarily vulnerable, but enough were that the risk remained real.

The economics of the threat are shifting. Claroty demonstrated that a skilled attacker could reproduce the initial Danfoss vulnerability in 28 minutes for a cost of six dollars. As artificial intelligence tools become more sophisticated and widely available, that time and cost will only drop. Cyberattacks could become faster, cheaper, and more frequent. Yet cybersecurity experts were clear on one point: defending critical infrastructure does not require exotic solutions. It requires the basics—keeping unnecessary devices offline, patching known vulnerabilities, monitoring what is connected to the network. The technology exists. The question is whether organizations will use it before the next attack arrives.