In early October, a large‑scale cyber‑attack crippled the refrigeration systems of French supermarkets, turning cold aisles into hot zones and forcing retailers to discard perishable goods. The incident, which hit more than 400 stores across the country, highlights the growing vulnerability of critical food‑supply infrastructure to digital threats.
What happened
Hackers gained control of the software that regulates the temperature of fridges and freezers supplied by Danish engineering firm Danfoss. Instead of the routine overnight defrost cycle, the attackers ordered the units to heat up to as high as 50 °C (120 °F) and stay hot for several hours. This caused fresh and frozen products to spoil, with losses reported at €270,000 in just two supermarkets in the Alsace region.
Scope of the attack
Multiple retail chains reported being affected:
- Coopérative U: more than 100 stores hit.
- Intermarché/Netto (Mousquetaires Group): 180 stores affected, with an additional 100 stores disconnected as a precaution.
- Carrefour: fridges in 80 of its 6,000 stores compromised.
- Monoprix: about 5 % of its 400‑plus stores impacted.
- Other chains such as E.Leclerc also reported incidents.
Overall, the attack touched roughly 400 outlets out of an estimated 15,000 supermarkets in France, suggesting a significant but not total penetration of the targeted network.
Technical background
The compromised units were older models whose security software could not be updated to address a known vulnerability. Danfoss noted that it had "long advised" businesses to keep supported systems up to date, but the affected equipment lacked the ability to receive patches. This underscores a broader issue: many commercial refrigeration systems run on legacy firmware that is difficult to retrofit with modern security measures.
Immediate response
Retailers acted quickly to mitigate health risks. Stores removed spoiled items, and staff worked to restock shelves as soon as the units could be cooled again. In some locations, managers reported encountering hot air and even small fires emanating from the malfunctioning freezers. French prosecutors have opened a dedicated cyber‑crime investigation, and the Paris prosecutor’s office described the incident as a "large‑scale cyber‑attack affecting the refrigerators of several major food retail chains across France".
Broader implications
The incident raises several questions for policymakers and industry leaders:
- Supply‑chain resilience: How can essential food‑distribution assets be protected against digital sabotage?
- Regulatory oversight: Should there be mandatory security standards for refrigeration equipment used in public food retail?
- Investment in modernization: What incentives are needed for retailers to replace outdated hardware that cannot receive security updates?
European Food Commissioner Christophe Hansen warned that "the weaponisation of food has become a reality", emphasizing the need for heightened vigilance at all levels of the food system.
Analysis
The attack appears to have been a targeted operation against the Danfoss control software rather than a random ransomware incident. By focusing on temperature regulation, the perpetrators maximised economic disruption while avoiding direct data theft. The choice of older, unpatchable units suggests that the attackers performed reconnaissance to identify weak points across multiple chains. While the exact motives remain unconfirmed, the impact on food security and consumer confidence is evident.
From an operational standpoint, the incident demonstrates the perils of relying on legacy hardware in a highly connected environment. Even though the affected units constitute a fraction of the total refrigeration fleet, their failure caused measurable financial loss and public alarm. Retailers that had already migrated to newer, supported systems appear to have avoided the worst of the damage, reinforcing the business case for proactive technology refresh cycles.
Uncertainty
Several aspects of the event remain unclear:
- The identity and motives of the hackers have not been publicly disclosed.
- Exact figures for total food loss across all affected stores are still being compiled.
- It is not known whether any data was exfiltrated from the refrigeration control systems.
Further investigation by French authorities and independent cybersecurity analysts will be required to answer these questions and to determine whether additional sectors may be vulnerable to similar tactics.
Looking ahead
In the wake of the attack, French retailers are accelerating plans to upgrade or replace vulnerable refrigeration units. Industry groups are also calling for clearer guidelines on cybersecurity standards for food‑service equipment. As the investigation proceeds, the episode serves as a stark reminder that the digital frontier of food security is expanding, and that safeguarding it will demand coordinated action across manufacturers, retailers, and regulators.