Hackers Turned France's Supermarket Freezers Into Ovens. The Bug Was Years Old.

Charles Dezon, who owns an Intermarche supermarket in Gradignan, in southwestern France, had never imagined he would have to throw away nearly an entire dumpster of frozen food because of a cyberattack. Overnight between Sunday October 11 and Monday October 12, his store's refrigeration systems were remotely forced to heat to 50 degrees Celsius, about 122 Fahrenheit. The temperature in the cold room climbed so high it set off the sprinkler system, flooding the storeroom. "We only realized it at 4 in the morning when our delivery driver saw the storeroom was flooded," Dezon told Le Monde.

His store was one of hundreds. Around 300 stores in the Intermarche and Netto group, roughly 100 Cooperative U stores, 80 Carrefour stores, several E.Leclerc locations, and about 30 Monoprix stores were hit by what the Paris prosecutor's office calls a "large-scale" attack on connected refrigeration. At least five other European countries, Spain, Portugal, Poland, Germany and Belgium, were also affected, according to Sekoia threat analyst Felix Aime. No group has claimed responsibility.

How the attack worked

The attackers did something more clever than simply turning the freezers off. They triggered forced defrosting and, crucially, extended the defrost cycle from one hour to eight hours. That detail mattered: a longer cycle meant the temperature alarms went off later, delaying intervention and maximizing damage. In one Intermarche in La Haye, Normandy, temperatures reportedly climbed to 80 degrees Celsius, high enough to melt store equipment. Because the cold chain was broken, stores had no choice but to empty every freezer and throw away everything inside.

The financial damage is still being counted, but the early numbers are ugly. Dezon lost 21,000 euros at purchase price after a bailiff certified the ruined stock. Cooperative U chief executive Dominique Schelcher estimated losses of several tens of thousands of euros for a smaller store and up to 200,000 euros for a large hypermarket. The total national loss will amount to at least several million euros, possibly tens of millions, Le Monde reports, especially since meat processors and wholesalers were hit too. Culture Viande, a group representing 300 meat companies, said at least two of its members were affected. Wholesaler Metro confirmed it was targeted through an external service provider.

This was not an attack on data. It was an attack on the machines that keep food cold, and the consequences were physical, immediate, and expensive.

The vulnerability was already known

The entry point was identified quickly: refrigeration control software made by the Danish manufacturer Danfoss. The company told Le Monde that most of the affected units were obsolete products that had reached end of life and no longer received software or security updates. It said it has long recommended that customers keep supported systems updated with the latest firmware and migrate obsolete systems to next-generation solutions.

The uncomfortable part is that this was not news. Danfoss published security alerts in March and August 2025 after fixing flaws in some of its refrigeration software, warning customers to install updates. Those vulnerabilities could allow an attacker to take full control of the affected systems, including changing freezer temperatures. The research firm Team82 had also investigated the Danfoss AK-SM 800A platform and found multiple vulnerabilities in its embedded web management interface, which Danfoss then addressed in a new firmware version. The fix existed. The obsolete controllers in French stores simply never got it.

This pattern, known flaws on legacy operational technology running on unpatched firmware, is the industrial sector's version of a problem IT security solved years ago. Danfoss now advises customers to avoid direct internet exposure of controllers and to replace obsolete equipment that no longer receives security updates. Security researchers say predictable credentials and exposed interfaces left commercial refrigeration systems vulnerable, alongside slow adoption of firmware updates.

A structural problem, not a one-off

Several features of this incident make it a textbook case for operational technology security. First, the attack did not target networks or data, so the usual defenses, firewalls, email filters, endpoint detection, were beside the point. It targeted small embedded controllers sitting at the edge of store infrastructure, managed in most French supermarket groups not by a central IT team but by refrigeration specialists, with each store or franchise member responsible for its own systems.

Second, one supplier's equipment sat across competing chains, a form of third-party concentration risk that rarely appears on an IT asset register. Intermarche, Cooperative U, Carrefour, E.Leclerc and Monoprix compete fiercely on groceries, but they shared a single point of failure in their cold rooms. That shared dependency is why a single flaw could hit hundreds of stores in one night.

Third, the response was hampered by insurance gaps. According to Intermarche, standard store insurance does not cover this type of incident, which means the losses land directly on the retailers. That gap may do more to change behavior than any government advisory, once insurers and boards start pricing the risk of connected operational technology.

What comes next

The investigations are stacking up. The Paris prosecutor's office has opened a criminal probe through the anti-cybercrime office to identify the victims and establish the link between the attack and the reported losses. Prime Minister Sebastien Lecornu has ordered France's national cybersecurity agency, ANSSI, to take up the issue, and France is coordinating with European counterparts because other countries may also be affected. The European commissioner for agriculture and food, Christophe Hansen, condemned the attack, saying "the weaponization of food has become a reality."

For now, the affected stores have brought their systems back online but, on Intermarche's advice, have not reconnected them to the network, to avoid a repeat. The retailer said a return to normal would take several days as central purchasing offices and wholesalers deliver replacement merchandise.

Meanwhile, one coincidence is worth noting: at the same time, Dutch grocery giant Ahold Delhaize took several systems offline after finding a security issue in its network, disrupting websites and apps for brands including Albert Heijn, Stop & Shop, Giant Food, Food Lion and Hannaford. The Dutch National Cyber Security Centre has said there is no reason to believe the two incidents are linked. Either way, the same 48 hours produced two separate reminders that the systems feeding people are now digital systems, with all the fragility that implies.