Hackers Spoil Food at French Supermarkets by Overheating Danfoss Fridges

Unknown attackers remotely manipulated refrigeration systems at hundreds of French supermarkets this weekend, raising internal temperatures to 122 degrees Fahrenheit (50 degrees Celsius) and causing significant food spoilage, French authorities told Reuters. Paris prosecutors have classified the coordinated incident as a large-scale attack that also reportedly resulted in fires within the affected retail locations.

The full financial impact remains unclear, but Intermarche CEO Thierry Cotillard stated on BFM TV that damages are likely in the tens of millions of euros, according to Reuters. A source in Prime Minister Sebastien Lecornu’s office confirmed that France’s National Cybersecurity Agency (ANSSI) is leading the investigation. ANSSI has already identified signs that the attack exploited a vulnerability linked to Danish engineering firm Danfoss.

Context and Background

Danfoss acknowledged the situation in a statement to Reuters, noting the company is aware of incidents in France affecting a limited number of refrigeration management systems. The company told reporters that the root cause of the breach was outdated firmware. Operational technology systems connected to the internet often lack robust security designs, making them vulnerable to remote manipulation.

Threat actors frequently target such infrastructure to cause costly downtime, a tactic common among ransomware gangs. In this specific case, the attackers disabled equipment functionality by raising temperatures. This approach highlights the risks of legacy firmware in critical retail infrastructure, where security considerations may not have been prioritized during initial design.

Who Is Affected

Reuters counted confirmed targets including Intermarche owner Les Mousquetaires, with 150 stores impacted, and Carrefour, with 80 stores affected. Monoprix reported that around 5% of its 490 French stores, or approximately 25 locations, were hit. The Cooperative U chain was also listed as a target, though the extent of damage there remains unclear.

Beyond France, Sekoia Threat Detection and Research senior cyber intelligence threat analyst Felix Aime told the news agency that other organizations in Spain, Portugal, Poland, Germany, and Belgium appeared to be hit. This indicates the attack may have a broader European footprint, targeting retailers using similar Danfoss refrigeration management systems across multiple countries.

What should you do?

Organizations using connected operational technology should immediately audit firmware versions on critical infrastructure. Security teams should monitor for unusual temperature fluctuations or remote access attempts on industrial control systems. Retailers should verify vendor security advisories and isolate affected networks to prevent further compromise.

What to do and how to stay safe: Danfoss

• Audit firmware versions on all connected refrigeration and operational technology systems for outdated or unsupported releases.
• Monitor industrial control networks for unauthorized remote access attempts or unexpected configuration changes to thermostats and sensors.
• Isolate affected operational technology segments from corporate networks to prevent lateral movement if a breach is suspected.
• Review vendor security advisories for critical infrastructure components and prioritize updates once the vendor provides an update.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific retailers were confirmed as targets in France?

Confirmed targets include Les Mousquetaires (150 stores), Carrefour (80 stores), Monoprix (around 25 stores), and Cooperative U, according to Reuters.

What caused the security breach in these refrigeration systems?

Danfoss stated that the root cause was outdated firmware in their refrigeration management systems, which allowed remote manipulation.

Are there signs of attacks outside of France?

Yes, Sekoia Threat Detection and Research analyst Felix Aime reported that organizations in Spain, Portugal, Poland, Germany, and Belgium also appeared to be hit.