Hackers Force Defrost Mode in French Supermarket Freezers, Ruining Stock
Attackers manipulated cooling systems at Intermarché and other chains, heating units to 50°C for six hours and forcing retailers to discard perishable goods.
Key points
- Approximately 150 Intermarché stores were impacted by the cyberattack on Sunday night.
- Cooling units were forced into defrost mode, reaching temperatures of 50°C for roughly six hours.
- Claroty researchers previously identified flaws in Danfoss controllers that could allow admin access.
Cyberattackers breached the refrigeration infrastructure of hundreds of French supermarkets on Sunday night, according to reports from Bloomberg and other outlets. The intrusion forced cooling systems into defrost mode, causing freezers and fridges to heat up significantly. This disruption compelled store managers to discard large quantities of meat, frozen items, and vegetables that were no longer safe for sale.
A spokesman for Groupement Mousquetaires, the owner of the Intermarché chain, confirmed that approximately 150 locations were affected by the incident. The attackers manipulated the settings so that refrigeration units heated to 50°C for around six hours. This sustained high temperature rendered the perishable inventory unsellable, forcing retailers to throw out the affected goods.
Context and Background
The refrigeration systems managed by the affected stores were supplied by Danfoss, a Danish industrial group specializing in refrigeration solutions. Mousquetaires stated that it was up to the supplier to file a formal complaint with the authorities regarding the breach. It is not yet known whether the attackers exploited specific vulnerabilities previously identified in Danfoss equipment. Neither the retailers nor Danfoss have publicly disclosed how the attackers initially gained access to the systems.
In August, researchers from Claroty’s Team82 flagged security flaws in Danfoss controllers commonly used in supermarkets and cold storage facilities. The team discovered a hidden login mechanism based on a daily code that could grant an attacker administrative access to the devices. Team82 also reported finding thousands of these controllers reachable directly from the internet, posing a significant exposure risk.
Who Is Affected
Beyond Intermarché, other major French retail chains reported similar disruptions. Dominique Schelcher, chief executive of Coopérative U, stated on X that his company was also targeted. Agence France-Presse reported that fewer than 100 Coopérative U stores were affected by the attack. Additionally, French broadcaster BFM reported that some Leclerc stores experienced issues, though Leclerc did not immediately respond to requests for comment from Bloomberg.
This incident contributes to a growing trend of cyberattacks designed to halt physical operations rather than steal data. Previous high-profile breaches, such as those against Jaguar Land Rover and Boston Scientific, similarly disrupted production lines and shipping logistics. These attacks demonstrate how digital intrusions can cause tangible physical damage and operational downtime in industrial and retail environments.
What should you do?
Security professionals should monitor for unusual temperature fluctuations or unexpected mode changes in industrial control systems. Organizations using Danfoss or similar controllers should verify that firmware updates provided by the vendor are applied promptly. Network segmentation should be enforced to prevent internet-facing devices from communicating directly with critical infrastructure. Regular audits of exposed ports and hidden administrative interfaces can help identify unauthorized access vectors before they are exploited.
What to do and how to stay safe: Danfoss
- Verify that all industrial control system firmware is updated to the latest version provided by the vendor.
- Segment networks to ensure that refrigeration controllers cannot be accessed directly from the public internet.
- Monitor system logs for unauthorized configuration changes or unexpected temperature spikes in cold storage units.
- Audit administrative access methods to ensure that default or daily-code-based logins are disabled or secured.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which French supermarket chains were affected by the refrigeration hack?
Intermarché, Coopérative U, and some Leclerc stores were affected by the attack.
Did the attackers use the Danfoss flaws found by Claroty?
It is not yet known whether the attackers exploited the specific flaws identified by Claroty researchers.
What temperature did the freezers reach during the attack?
The refrigeration units heated to 50°C for approximately six hours.
