Hackers hit refrigeration systems at French supermarkets, pushing fridges and freezers to temperatures as high as 50°C, spoiling food and causing fires at several stores.
Intermarché, Coopérative U, E.Leclerc and other major retailers confirmed the attack on Monday. Carrefour said 80 of its supermarkets were affected, and Monoprix said around 5% of its roughly 490 stores were hit.
Coopérative U chief executive Dominique Schelcher said on Tuesday that 80 of 2,000 stores in the group were affected. “It affected a minority of our stores,” he told RTL radio.
He said the financial impact couldn’t yet be quantified precisely, but estimated losses of several tens of thousands of euros for a smaller store and up to €200,000 for a large hypermarket
Prime Minister Sébastien Lecornu has reportedly ordered France’s National Cybersecurity Agency (ANSSI) to investigate.
Fridges Forced To Defrost
The hackers remotely triggered forced defrosting of refrigeration systems across numerous stores. Units were locked into a continuous defrost cycle, destroying millions of euros’ worth of fresh and frozen food.
Intermarché said affected stores would have to discard all their fresh and frozen products.
Stores are now following a set procedure: emptying refrigerated cabinets, getting a bailiff’s report and throwing out the stock.
France may not be the only target. Felix Aime, a senior threat intelligence analyst at Sekoia, said the attack also affected five countries beyond France: Spain, Portugal, Poland, Germany and Belgium.
Legacy Equipment to Blame
The attack targeted refrigeration controllers made by Danish manufacturer Danfoss. The company said most affected units were legacy AK-SM800 and AK-SC355 controllers that no longer receive software or security updates, and that it had long urged supermarkets to replace them.
Team82 researched the attack surface of the Danfoss AK-SM 800A platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version.
Danfoss says it was in close contact with affected customers, and that the majority of hit units were either legacy products or current products running outdated firmware.
Intermarché owner Groupement Mousquetaires said the refrigeration systems were under Danfoss’s management, and that filing a complaint with authorities would fall to the supplier. E.Leclerc told franceinfo that a cyberattack had hit one of its refrigeration equipment suppliers.
No group has claimed responsibility.
Why It Matters for Enterprises
This was an attack on operational technology, with physical consequences rather than stolen data.
Predictable credentials and exposed interfaces leave commercial refrigeration systems vulnerable, alongside slow adoption of firmware updates.
Danfoss’s advice to customers includes avoiding direct internet exposure and replacing obsolete equipment that no longer gets security updates.
A single supplier’s equipment also sat across competing chains, which is the kind of third-party risk that rarely appears on an IT asset register.
Comments ( 0 )