Hackers sabotage French supermarket refrigeration systems, causing fires and massive food losses

Overnight on a Monday in October, hackers remotely seized control of refrigeration systems across hundreds of supermarkets in France and beyond, turning freezers into ovens. The temperature inside connected refrigerators and freezers climbed to 50 degrees Celsius—122 degrees Fahrenheit—hot enough to melt ice cream and trigger fires. By morning, the damage was visible and immediate: food spoiled in bulk, equipment damaged, and the fragile infrastructure that keeps fresh products moving through Europe's supply chain exposed as vulnerable to remote attack.

The Paris prosecutor's office confirmed the scope on Monday, describing a "large-scale" coordinated assault on refrigeration systems at multiple major food retailers. Carrefour, one of Europe's largest grocery chains, reported 80 of its French supermarkets hit. Monoprix, operating roughly 490 stores across France, saw 5 percent of its locations compromised. Les Mousquetaires, which owns the Intermarche chain, disclosed that refrigerators at around 150 of its stores had been heated to 50 degrees Celsius for six hours straight. A witness in central Paris watched staff at an Intermarche location wheel cartfuls of defrosted frozen goods to a dumpster, with melted ice cream pooling onto the street. Cooperative U, another major French supermarket operator, confirmed it had also been targeted.

The attack was not confined to France. Felix Aime, a senior cyberthreat intelligence analyst at Sekoia Threat Detection and Research, identified the same intrusions affecting supermarkets in Spain, Portugal, Poland, Germany, and Belgium. The scope suggested a coordinated campaign rather than isolated incidents. Prime Minister Sebastien Lecornu instructed France's National Cybersecurity Agency to investigate and coordinate with European partners to determine whether additional countries and companies faced exposure. Authorities began assessing which other French businesses might be vulnerable to the same attack vector.

The financial toll was staggering. No industry-wide estimate emerged immediately, but Thierry Cotillard, CEO of Intermarche, told French television the attack was "unprecedented" and would cost the retail sector "tens of millions of euros nationwide in a single day." Christel Delberghe, director general of the European retail association Eurocommerce, framed the incident as a stark reminder of how fragile interconnected supply chains had become. The attack had exposed a critical weak point: supermarket cold aisles are typically managed by control panels that regulate all of a store's refrigeration equipment and can be accessed remotely over the internet—a feature designed to allow maintenance companies to make adjustments from anywhere, but one that also opened a door for attackers.

Investigators quickly identified the vulnerability. The National Cybersecurity Agency traced the breach to outdated firmware in refrigeration management systems supplied by Danfoss, a Danish company. In August, cybersecurity researchers at Claroty's Team82 had published detailed findings about weaknesses in the Danfoss AK-SM 800A controller, documenting how software flaws could allow attackers to bypass authentication and execute code on the devices. Danfoss acknowledged the incidents, stating that affected units "were running outdated firmware" and that the company had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions." The company said it was aware of the French incidents but characterized them as affecting "a limited number" of systems. The French retail association demanded full transparency from Danfoss about what had happened and what customers should do next.

The attack rippled beyond France. Ahold Delhaize, a Dutch retailer operating Albert Heijn, the Netherlands' largest supermarket chain, and major operations across the United States, disclosed it was managing a "security issue" on its network and had taken systems offline as a precaution. Its grocery delivery service went dark; a message on the company's app told customers it could not fulfill orders because of a "cybersecurity incident." Online grocery sales typically account for about 10 percent of Albert Heijn's revenue, but the disruption was enough to send customers to rival retailers, who reported a surge in delivery orders. In the United States, Ahold's Stop & Shop, Giant, Hannaford, and Food Lion chains all displayed notices that their websites were temporarily unavailable. Ahold stated there was no apparent connection between its incident and the French attacks, though the timing and nature of the disruptions raised questions about whether a single campaign had cast a wider net than initially apparent.

The French attacks echoed a pattern. In late August, about a dozen U.S. military commissaries had experienced similar disruptions when their refrigeration systems were compromised, leading to significant food losses. The parallel suggested either a recurring vulnerability being exploited by multiple actors or a sustained campaign testing the same weakness across different targets and geographies. As some French supermarkets began restoring normal operations, authorities and retailers were left grappling with a fundamental question: how many other interconnected systems, designed for convenience and efficiency, were running on outdated software and exposed to the same kind of remote manipulation.