FREEZERS TURNED INTO OVENS: Massive Cyberattack Hits French Supermarkets, Spoiling Millions in Food and Triggering Fires
Hundreds of supermarkets across France were thrown into chaos after hackers remotely manipulated refrigeration systems, causing temperatures inside food storage units to soar as high as 122 degrees Fahrenheit and forcing retailers to discard enormous quantities of perishable merchandise. The unprecedented cyberattack, which affected at least five major grocery chains, is believed to have caused tens of millions of euros in damage.
The attack struck stores operated by Carrefour, Monoprix, Les Mousquetaires, E. Leclerc and Coopérative U, disrupting refrigeration equipment essential to keeping meat, dairy products, frozen foods and other temperature-sensitive items safe for consumption. Some locations also experienced fires associated with the incident.
The scale of the disruption prompted an investigation by French authorities and raised serious concerns about the vulnerability of computerized systems used to operate essential commercial infrastructure.
The head of Coopérative U, a network of independently owned supermarkets, publicly acknowledged the incident Monday, revealing that the company’s refrigeration equipment had been compromised overnight.
“I confirm that a cyberattack has been affecting, since last night, the cold production facilities of several stores in our network Coopérative U,” he wrote on X.
He said the company was working urgently with refrigeration professionals to bring the affected equipment back into operation and determine how the intrusion occurred.
“Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be necessary to shed full light on this attack. Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable,” he concluded.
France’s Paris prosecutor’s office confirmed that authorities were examining what it described as a “large-scale” cyberattack involving “connected refrigerators in several major food retailers across France.”
Among the companies reporting disruptions was Carrefour, which said approximately 80 of its stores had been affected. Monoprix, which operates roughly 490 locations throughout France, reported that about 5% of its stores had experienced problems.
Les Mousquetaires, the retail group behind Intermarché, reported particularly serious damage, with refrigeration units in approximately 150 stores subjected to temperatures reaching 50 degrees Celsius, equivalent to 122 degrees Fahrenheit, for approximately six hours.
A company representative said all food exposed to the compromised refrigeration conditions had been thrown away, reflecting the potentially serious health risks posed by products that had been stored at unsafe temperatures.
The financial consequences are expected to be substantial. Although the total cost has not yet been officially determined, preliminary estimates placed losses above 10 million euros, or approximately $11.2 million.
Intermarché CEO Thierry Cotillard suggested that the nationwide damage could be considerably higher, describing the incident as having potentially caused “tens of millions of euros nationwide in a single day.”
Investigators are now examining whether vulnerabilities in refrigeration control technology supplied by Danish industrial equipment manufacturer Danfoss allowed the attackers to gain access to the systems.
According to information provided to French authorities, the affected equipment included older refrigeration controllers running software that had not received recent security updates.
Danfoss acknowledged that many of the compromised systems were “legacy” products which “no longer receive software or security updates.”
The manufacturer also said some equipment was operating with “outdated firmware,” despite previous recommendations that customers install available updates or replace aging controllers with newer technology.
The investigation has identified Danfoss AK-SM800 and AK-SC355 refrigeration management systems among the equipment affected. These controllers allow supermarkets to monitor and regulate refrigeration equipment electronically, making them particularly sensitive to unauthorized remote access.
Reports indicate that the attackers manipulated automatic defrosting functions, effectively transforming systems designed to preserve food at low temperatures into equipment capable of generating dangerous heat.
The incident highlights a growing cybersecurity concern involving industrial machinery that was once operated independently but is now connected to networks for remote monitoring, maintenance and automated management.
French Prime Minister Sébastien Lecornu directed the country’s National Cybersecurity Agency, ANSSI, to investigate the attack and determine whether additional businesses remain vulnerable.
Investigators have identified a software weakness associated with the Danish supplier and have contacted the company as part of their efforts to establish how the intrusion occurred.
French officials are also communicating with cybersecurity authorities elsewhere in Europe amid concerns that similar refrigeration equipment may be vulnerable in other countries.
The investigation is seeking to identify additional companies using the affected technology so they can be warned and take preventive measures before further damage occurs.
Additional reporting indicates that the number of affected stores may be considerably greater than initially disclosed. Some accounts placed the number of targeted Intermarché and Netto locations at approximately 300, while more than 100 Coopérative U outlets and several E. Leclerc stores were also reported to have experienced disruptions.
In an update Tuesday, Coopérative U CEO Dominique Schelcher said 80 of his company’s approximately 2,000 stores had been affected. He estimated that individual smaller stores could face losses amounting to tens of thousands of euros, while damage at larger hypermarkets could reach 200,000 euros.
The disruption has also coincided with cybersecurity problems elsewhere in Europe’s supermarket industry.
Dutch retailer Ahold Delhaize, which operates the Albert Heijn supermarket chain and has extensive operations in the United States, reported a separate security incident that prompted it to take several computer systems offline.
The company’s problems temporarily interrupted online grocery deliveries, although its physical stores remained open.
In the United States, websites associated with Ahold Delhaize’s Stop & Shop, Giant, Hannaford and Food Lion supermarket brands also displayed notices indicating that their services were temporarily unavailable.
Authorities have not established whether those disruptions were connected to the attack on French refrigeration systems.
European Union Commissioner for Agriculture and Food Christophe Hansen condemned the sabotage, warning that attacks against the infrastructure used to preserve and distribute food represent a serious threat.
“I strongly condemn the cyberattack targeting food products at Intermarche, Cooperative U, Leclerc. Food security requires more attention at all levels. Because the weaponization of food has become a reality,” Hansen wrote Monday on X.
French investigators are continuing to examine the attack’s origins, the extent of the financial damage and the circumstances surrounding the reported fires. As of Tuesday, authorities had not publicly identified those responsible for the intrusion.
