France Supermarket Cyberattack: Hackers Raise Fridge Temperatures to 50°C, Spoil Food and Trigger Fires at Hundreds of Stores - Check Affected Retailers
A cyberattack targeting internet-connected refrigeration systems at hundreds of French supermarkets has forced major retailers to dispose of perishable goods after hackers manipulated temperature controls, with some units reportedly reaching 50°C. The incident affected prominent chains including Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E. Leclerc, prompting a government investigation into the security of critical retail infrastructure.
Intermarché and its Netto brand reported that at least 300 stores experienced disruptions, while more than 100 Coopérative U outlets faced similar problems. Carrefour confirmed that 80 supermarkets were affected, and Monoprix said approximately 5% of its store network encountered issues. E.Leclerc also reported that several locations were targeted. Some stores experienced fires in addition to food spoilage, though the full extent of damage across affected chains remains under assessment.
Attack Method Exploited Refrigeration Control Systems
The attackers reportedly manipulated software controlling refrigeration equipment, forcing units to run defrost cycles instead of maintaining safe storage temperatures. The compromised systems included refrigeration controllers manufactured by Danish company Danfoss, specifically the AK-SM 800A model widely deployed in supermarkets, cold-storage facilities, warehouses and other commercial environments across multiple sectors globally.
Cybersecurity research firm Claroty had identified vulnerabilities in these controllers earlier in 2024. A Censys scan conducted in August revealed 2,765 Danfoss AK-SM 800A refrigeration controllers publicly exposed to the internet, highlighting the global scale of potentially vulnerable devices. The identified security flaws included authentication bypass issues and remote code execution vulnerabilities.
Danfoss released firmware version R4.3.1 in August 2024 to address these vulnerabilities, including patches for authentication bypass (CVE-2025-41450) and remote code execution (CVE-2025-41451) flaws. However, many systems apparently remained unpatched at the time of the French supermarket attack.
Danfoss acknowledged awareness of the incidents, stating that affected units were running outdated firmware. The company said it had advised customers to update their systems and replace older equipment. More than 50% of IoT devices contain critical vulnerabilities that attackers can exploit immediately, and industrial controllers have a median patching time exceeding 45 days, contributing to ongoing security risks.
Government Investigation and Industry Response
French Prime Minister Sebastien Lecornu ordered the National Cybersecurity Agency of France (ANSSI) to investigate the attack. ANSSI, established in 2009 with approximately 600 staff members and an annual budget of around €100 million, serves as France's national authority for cybersecurity and cyberdefence. The Paris prosecutor's office confirmed a separate criminal investigation into the incident.
The French retail federation (FCD) called on Danfoss to provide full transparency regarding the security breach. Retailers have been working to restore refrigeration systems and assess food losses, while investigators seek to establish how attackers gained unauthorized access to the control systems.
Intermarché CEO Thierry Cotillard told BFM TV that the attack would result in losses amounting to tens of millions of euros nationwide in a single day. Affected stores must discard all fresh and frozen products because they cannot verify that food remained at appropriate temperatures. Some refrigeration display units remained out of service while staff worked to restore operations and replace stock.
Dominique Schelcher, chief executive of Coopérative U, described the attack as extremely serious and unprecedented. He stated that targeting equipment essential to food preservation and supply was unacceptable, and that his teams were working to restore normal operations while an investigation proceeded.
Broader Security Implications
The French incident follows similar disruptions reported at approximately a dozen US military commissaries in late August 2024, which also experienced food losses after refrigeration systems were affected. The pattern suggests coordinated targeting of refrigeration infrastructure across multiple countries.
Cyberthreat intelligence analyst Felix Aime of Sekoia Threat Detection and Research told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected, though investigators are still establishing the full geographical scope and connections between reported incidents.
The attack occurs against a backdrop of escalating threats to internet-connected industrial systems. Organizations globally face an average of 820,000 IoT cyberattacks daily, with IoT attacks surging 107% in the first half of 2024 compared to the prior year. Nearly 75% of companies recognize that hackers are increasingly targeting industrial control systems and IoT devices, yet more than half have already experienced cyberattacks through operational technology or IoT devices.
Security vulnerabilities in refrigeration control systems extend beyond Danfoss products. Cybersecurity research has identified 23 vulnerabilities in Copeland XWEB Pro refrigeration controllers used by supermarkets, warehouses and hospitals, demonstrating industry-wide security challenges.
Cybersecurity analyst Steven Lachance told Al Jazeera that while such attacks are rare in scale, they represent a global wake-up call. He warned that connected infrastructure live on the internet can be compromised and called for national and international measures to prevent future incidents. Lachance cautioned that future attacks could target more critical infrastructure, including energy systems and hospitals.
Historical precedents demonstrate the serious consequences of cyberattacks on physical control systems. The Stuxnet attack in 2010 destroyed approximately 1,000 uranium enrichment centrifuges by manipulating variable frequency drive speeds, while the BlackEnergy attack in 2015 targeted Ukraine's power grid, causing 230,000 people to lose power for six hours.
French authorities are coordinating with European counterparts as the investigation continues. The incident has renewed concerns about cybersecurity vulnerabilities in internet-connected equipment that businesses rely on for critical operations, highlighting the need for robust security measures and timely software updates across industrial control systems.
