Attackers Remotely Hijack Supermarket Fridges in France, Raising Temperatures to 50°C
Cybercriminals reportedly altered cooling settings at major French chains, causing units to heat up and forcing the disposal of perishable goods.
Key points
- Attackers remotely changed refrigeration settings at Intermarché, E.Leclerc, and Système U stores.
- The incident began overnight between October 11 and October 12, affecting approximately 150 Intermarché locations.
- Systems made by Danfoss were targeted, with temperatures reportedly raised to 50°C via continuous defrost cycles.
Attackers reportedly hacked refrigeration controls at major French supermarket chains, remotely altering settings to raise temperatures to 50°C instead of cooling equipment. This incident began overnight between October 11 and October 12, impacting stores associated with Intermarché, E.Leclerc, and Système U, according to early reports from Cyber Security News.
The cyberattack targeted industrial technology systems manufactured by Danfoss, which manage cooling equipment inside supermarkets. Attackers reportedly manipulated these systems to trigger continuous defrosting cycles, effectively turning refrigeration units into heaters for several hours. This manipulation caused chilled cabinets and freezers to heat up, endangering temperature-sensitive goods such as fresh food, dairy, meat, and frozen products.
Operational Impact and Financial Losses
The disruption forced stores to inspect their inventory and discard items that no longer met food-safety requirements. BFMTV reported that some locations could face losses reaching hundreds of thousands of euros. Around 150 Intermarché stores were reportedly affected by the incident. The event demonstrates how a cybersecurity breach can quickly translate into physical damage and significant financial consequences for retail operations.
Technical Context and Investigation
Reports indicate that attackers may have abused a standard defrost feature built into the refrigeration-management software. While defrosting is a normal process to remove ice from cooling equipment, enabling it continuously or configuring it with unsafe values prevents the maintenance of necessary low temperatures. Early reporting suggests that older software versions may be involved in the vulnerability.
Dominique Schelcher, chief executive of Coopérative U, confirmed that cybercriminal activity had affected refrigeration production systems in several stores within the group’s network. He stated that teams were collaborating with refrigeration specialists to restore operations. Schelcher noted that an investigation would be required to establish exactly how the incident occurred.
What should you do?
The exact intrusion method, responsible group, and whether a known vulnerability was exploited have not been publicly confirmed. No fix has been confirmed yet. That suggests organizations should monitor their industrial control systems for unusual configuration changes.
What to do and how to stay safe: Danfoss
- Review configuration logs for refrigeration or HVAC systems to detect unauthorized changes to temperature settings or defrost cycles.
- Isolate network segments connected to industrial control systems to prevent lateral movement from IT networks to operational technology.
- Verify that firmware and software on cooling management systems are current, as older versions may be more susceptible to manipulation.
- Monitor for alerts indicating continuous defrosting or abnormal temperature readings that deviate from standard operational parameters.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which supermarket chains were affected by the refrigeration hack?
The incident affected stores linked to Intermarché, E.Leclerc, and Système U in France.
What technology was targeted by the attackers?
The attack targeted refrigeration-control systems made by Danish industrial technology company Danfoss.
How did the attackers disable the cooling?
Attackers reportedly changed settings to trigger continuous defrosting and raised temperatures to 50°C.
