Refrigeration units at major supermarket chains across France were remotely compromised between late Oct. 11 and early Oct. 12, leaving fresh and frozen food spoiled at hundreds of stores.
According to BFM TV, the attackers seized control of the master controllers that manage refrigeration temperature across entire stores. They changed the defrost function, which normally runs for about two hours a day, into a continuous forced cycle and set the temperature to 50C. Instead of cooling, the units heated up.
Paris prosecutors call it a large-scale cyberattack
The Paris prosecutor's office said the "large-scale cyberattack" affected connected refrigeration systems used by multiple major food retail chains across the country. Retailers reported not only spoiled food but also fires.
Schelcher, chairman of French independent retail cooperative Coopérative U, wrote on X that the attack had been affecting refrigeration facilities at several of the group's stores since the previous night. He described the incident as "extremely serious" and "unprecedented."
Retail groups affected
Les Mousquetaires, the parent group of Intermarché, told Agence France-Presse that at least 300 Intermarché and Netto stores were hit. Coopérative U, which includes brands such as Super U, had about 100 affected stores. Carrefour reported 80 stores affected. At Monoprix, 5% of roughly 490 stores were impacted.
Cooling Post estimated the total number of affected stores at about 500.
An executive at Les Mousquetaires told BFM TV that the "unprecedented" attack would cause losses of "tens of millions of euros nationwide in a single day."
Old systems and unpatched firmware emerge as key leads
Authorities have not reached a final conclusion on the intrusion route, but the current leads point to outdated machines that had not been updated. Supermarket refrigeration units are typically managed by a central controller, and maintenance providers can connect remotely to monitor temperatures and change settings. If that external connection is not properly secured, it can become an entry point.
The controllers were made by Danish manufacturer Danfoss. Danfoss told media outlets that the incident in France affected "a limited number of refrigeration management systems." In a written response to Cooling Post, the company said most of the affected devices were older products, including the AK-SM800, which reached end of support in 2021, and the AK-SC355, discontinued in 2016. Those systems no longer receive security updates. Other affected devices were current-model AK-SM800A units, but their firmware had not been updated.
Danfoss said it has long advised customers to update firmware and replace older equipment.
A person close to the French prime minister said ANSSI, France's national cybersecurity agency, had found a vulnerability in software supplied by Danfoss and had informed the company.
No group has claimed responsibility
No organization has claimed responsibility, and authorities have not publicly named any hacking group. The Paris prosecutor's office has opened a case and assigned it to OFAC, the cybercrime unit, to identify victims and clarify the link between the attack, food losses and fires.
Outside France, ANSSI is working with cybersecurity agencies across Europe to determine whether other countries were also affected.
Félix Aimé, an analyst at cybersecurity firm Sekoia, said Spain, Portugal, Poland, Germany and Belgium were also affected, though officials in those countries have not confirmed that account.
