Cyberattack targets French supermarket fridges, spoiling food at hundreds of stores

Hackers took control of refrigeration systems at hundreds of French supermarkets on Monday, forcing units to heat up and spoiling massive quantities of fresh and frozen goods.

Major retailers including Cooperative U, Intermarché, E. Leclerc, and Carrefour reported that their refrigeration units were remotely compromised overnight. Deutsche Welle and the BBC reported that hackers manipulated software to force a defrost cycle, with one chain stating that some units reached 50 degrees Celsius (122 degrees Fahrenheit) for more than six hours. The attack targeted equipment from Danish supplier Danfoss, specifically older models used for remote temperature management.

The scale of the disruption varies by chain. Intermarché told AFP that at least 300 of its stores and Netto branches were affected, while Cooperative U reported over 100 targeted outlets. Carrefour told Reuters that 80 of its 6,000 stores were hit, and Monoprix estimated that 5% of its locations were impacted. Paris prosecutors have opened an investigation into the incident, which reportedly caused fires at some sites.

Danfoss confirmed that a limited number of systems running outdated firmware were affected. The company stated it has long advised clients to update supported systems or migrate legacy equipment to current solutions. While the hackers reportedly ordered units to stay hot, the BBC noted that Danfoss did not confirm specifically how warm the refrigerators became. Meanwhile, Dutch retailer Ahold Delhaize took its systems offline as a precaution following a separate security issue, though it saw no direct link to the French attacks.

Retailers described the incident as a serious blow to food security. Cooperative U CEO Dominique Schelcher called the targeting of essential food supply equipment "unprecedented" and "of extreme gravity." Intermarché confirmed that impacted stores had no choice but to discard all fresh and frozen products from the compromised units.

Background

The incident occurred against a backdrop of increasing concern regarding industrial ransomware and vulnerabilities in legacy software systems. Retailers use remote management software to monitor cold units, which typically undergo brief, controlled defrosting periods overnight.