Hackers Override French Supermarket Freezers, Causing Food Spoilage and Fires
Coordinated cyberattack forced hundreds of French grocery stores into defrost mode, raising temperatures to 122 F and damaging supplies.
Key points
- Attackers targeted Danfoss controllers at E. Leclerc, Intermarche, and Cooperative U stores early Monday.
- Fridge temperatures rose to 50 C, causing mass food disposal and some fires in affected locations.
- Danfoss confirmed outdated firmware was used and is helping customers implement mitigation measures.
Hackers executed a coordinated cyberattack against hundreds of French supermarkets early Monday morning, remotely overriding refrigeration systems. The intrusion forced connected fridges and freezers into defrost mode, causing internal temperatures to spike to 50 degrees Celsius (122 degrees Fahrenheit). This sudden heat surge led to widespread food spoilage and, in several instances, triggered fires within the affected retail locations.
According to reports from AFP, three major grocery chains—E. Leclerc, Intermarche, and Cooperative U—confirmed the incident. Paris authorities told the news agency that additional grocery chains were also impacted by the breach. The attackers exploited software vulnerabilities in Danfoss system controllers, specifically the AK-SM800 and AK-SC355 models. Danfoss stated to Cooling Post that these affected systems were running outdated firmware at the time of the compromise.
Context and Background
The attack highlights significant risks associated with operational technology (OT) connected to the internet. Although the refrigeration units were not consumer smart appliances with touch screens, their controllers were linked online to manage defrost cycles, temperatures, and alarms across multiple stores. Danfoss told Cooling Post that it is working with affected customers to implement mitigation measures. These steps include applying firmware updates where available, strengthening network protections, and removing direct internet exposure for applicable devices.
Dominique Schelcher, CEO of Cooperative U, described the incident as unprecedented in a post on X. He stated that targeting equipment essential to preserving fresh products and supplying the French people is of extreme gravity. An investigation into the attack is currently underway. The incident underscores how global food supply chains can be quickly and dangerously exploited through vulnerabilities in connected infrastructure.
Who Is Affected
The primary victims are the grocery chains operating the compromised refrigeration units. E. Leclerc, Intermarche, and Cooperative U reported the breaches, but Paris authorities indicated that other chains were also hit. The physical damage includes spoiled inventory and fire hazards caused by the malfunctioning equipment. Danfoss, the manufacturer of the targeted controllers, is addressing the security implications. A web page for the AK-SM800 controllers states that the company takes security seriously and is implementing new measures.
A representative for Danfoss did not immediately return a request for comment regarding the specific details of the exploit chain. It remains unclear who is responsible for the attacks or the exact method used to compromise the controllers. The incident proves that network-connected devices, particularly older ones with outdated firmware, remain viable targets for cybercriminals seeking to disrupt critical infrastructure.
What should you do?
Security professionals should audit their operational technology environments for direct internet exposure. Organizations using legacy OT devices must verify that firmware is current and that network segmentation isolates these systems from general corporate networks. Monitoring for unusual temperature readings or defrost cycle activations can provide early warning of remote manipulation.
What to do and how to stay safe: Danfoss
- Audit operational technology networks to identify devices with direct internet exposure and remove unnecessary connectivity.
- Verify that all OT controllers and industrial equipment are running the latest supported firmware versions.
- Implement strict network segmentation to isolate refrigeration and HVAC systems from general corporate IT networks.
- Monitor system logs for unauthorized changes to temperature settings or unexpected defrost cycle initiations.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which supermarkets were affected by the cyberattack?
E. Leclerc, Intermarche, and Cooperative U confirmed the attacks, with Paris authorities noting other chains were also hit.
What specific devices were targeted by the hackers?
Attackers targeted Danfoss AK-SM800 and AK-SC355 system controllers running outdated firmware.
Did the attack cause any physical damage?
Yes, the temperature rise caused food to spoil and led to fires breaking out in some stores.
