Hackers Turn Supermarket Fridges Into Heaters in 'Unprecedented' French Cyberattack

It is the kind of cyberattack that sounds like a prank until you see the bill. In the early hours of Monday morning, staff arriving at supermarkets across France found their fridges had spent the night cooking instead of cooling. Hackers had taken remote control of the refrigeration systems and forced them into a continuous defrost cycle, pushing temperatures as high as 50°C for hours. By dawn, tonnes of fresh meat, dairy and frozen food were ruined.

The attack, which the BBC reported on Monday, was described by one supermarket chief as unprecedented. It hit some of the biggest names in French retail. Around 300 Intermarché and Netto stores were affected, along with nearly 100 Coopérative U outlets, several E.Leclerc stores and around 30 Monoprix shops, according to statements the chains gave to AFP. Trade-press reports suggest Carrefour Market may also have been caught up, though the company has not confirmed it. All told, several hundred stores across the country were hit in a single night.

What happened overnight

The intrusion began on Sunday night and ran into the early hours of Monday. Store managers received automated alerts flagging unusual temperature rises and defrost programmes running at the wrong times — the first sign that something was badly wrong. By the time staff arrived on Monday morning, the damage was done: refrigeration units that should have held steady at a few degrees above freezing had been sitting at tropical temperatures for hours.

Row of chilled supermarket display fridges behind glass doors Credit: Wolfmann / Wikimedia Commons, CC BY-SA 4.0

French broadcaster BFMTV, which first revealed the attack, reported that the hackers had remotely triggered forced defrosting of refrigeration systems in numerous stores. Rather than switching the fridges off — which would at least have been obvious — the attackers turned the equipment's own defrost function against it, transforming cooling units into heat sources. Intermarché told AFP that affected branches would have to throw away all fresh and frozen products in order to respect the cold chain.

The financial toll is still being counted, but early figures are stark. Two supermarkets in Haguenau, in eastern France's Bas-Rhin region — an Intermarché and an E.Leclerc — estimated their combined stock losses at €270,000. Nationwide, the damage is expected to run into several millions of euros, and Intermarché has warned of an additional sting: insurers, it says, typically do not cover this kind of incident in stores.

How the attackers pulled it off

The common thread running through the affected stores is a single supplier: Danfoss, the Danish manufacturer whose refrigeration controllers manage the cold chain in a large share of France's supermarkets. A source close to the case told AFP that Danfoss control systems were the target, and Danfoss itself confirmed to the news agency that most of the affected equipment was legacy hardware that no longer receives software or security updates.

The technique was elegant in its malice. Modern commercial refrigeration runs periodic defrost cycles — short bursts of heat that clear frost from cooling coils so the system keeps working efficiently. The hackers seized the controllers and locked the defrost function on, running it continuously instead of in brief cycles. French outlets report the attackers pushed set temperatures as high as 50°C, effectively converting every compromised fridge and freezer into an oven.

Security specialists say the incident exposes a familiar weakness: operational technology that was never designed with hostile internet exposure in mind. Refrigeration controllers, like much industrial equipment, are often installed and then forgotten — left running for a decade or more on software that stopped being patched years ago, sometimes reachable remotely for maintenance convenience. Once attackers found a way in, they found hundreds of doors already open.

The scale of the damage

The victim list reads like a roll call of French grocery retail. The Groupement Mousquetaires, which owns Intermarché, confirmed that around 300 of its stores were affected — roughly double the first estimates. Coopérative U said fewer than 100 of its stores were hit. E.Leclerc, France's largest supermarket chain, confirmed to AFP that a cyberattack had affected one of its refrigeration equipment suppliers, with knock-on effects on refrigeration in several stores.

Dominique Schelcher, the president of Coopérative U, confirmed the attack publicly on Monday. "Targeting equipment essential for preserving fresh produce and supplying food to the French people is an extremely serious matter and is unprecedented," he said. "It is unacceptable." His teams, he added, were working with refrigeration specialists to restore normal operations and a full investigation would be carried out.

Beyond the spoiled food, the Paris prosecutor's office noted something more alarming: the attack also caused outbreaks of fire in some stores — a reminder that sabotaging industrial control systems can have physical consequences far beyond the intended target.

An investigation is under way

The Paris prosecutor's office moved quickly, announcing on its own initiative an investigation into the large-scale cyberattack on connected refrigerators at major food retailers across France. The inquiry, led by the anti-cybercrime section and entrusted to the national cybercrime office OFAC, must identify all victims and establish the link between the attack and the damage reported — both the food losses and the fires.

The political response has been swift too. Christophe Hansen, the EU's commissioner for agriculture and food, condemned the attack, saying that food security requires more attention at all levels and describing such exploitation of food as a new reality. His intervention underlines how the incident has crossed from a policing matter into a question of European food security policy.

As with the recent Asos customer data breach in the UK, the French attack shows how retail infrastructure has become a front line in cyber conflict — except this time the target was not customer data but the food itself.

Why refrigeration was such a soft target

The uncomfortable truth behind the attack is that the victims' equipment was old, unpatched and, in many cases, connected to networks it was never designed to face. Industrial control systems in supermarkets, factories and utilities across Europe share the same profile: long service lives, infrequent updates, and remote-access features added for convenience long after installation.

Updating them is genuinely hard. Patching a refrigeration controller can require a technical shutdown, an on-site visit and validation by specialists — expensive and disruptive for a supermarket operating on thin margins. Many operators simply never do it. The result is a vast installed base of legacy equipment running software with known weaknesses, a fact the attackers clearly understood.

The incident also highlights a supply-chain risk: when hundreds of competing retailers all buy control systems from the same Danish manufacturer, a single vulnerability becomes a national incident. Concentration, in this case, was the attacker's best friend.

Food security enters the cyber age

France has suffered serious cyberattacks before — in 2024, breaches at payment processors exposed the health data of 33 million policyholders — but targeting the cold chain is new. It crosses a line from stealing data or demanding ransoms into sabotaging the physical systems that keep a population fed. That is why prosecutors, ministers and EU commissioners have all reached for the same word: unprecedented.

The coming weeks will determine whether this was a one-off act of vandalism, a criminal extortion attempt gone public, or something more organised. Investigators will be tracing how the attackers found the vulnerable controllers, whether they lingered in the systems before striking, and whether similar equipment in other countries is exposed. For France's supermarkets, the immediate priority is simpler: restock the shelves, replace the ruined food, and patch — finally — the fridges that were never supposed to be hackable. Read more of our technology coverage, including our reporting on tech regulation, or visit our homepage and about page.