Hackers remotely manipulated refrigeration systems at hundreds of supermarkets across France overnight, driving temperatures as high as 50 degrees Celsius, triggering fires and forcing retailers to throw away large quantities of fresh and frozen food, French authorities and supermarket chains said Monday.
The extraordinary cyberattack targeted the systems responsible for keeping food refrigerated, rather than stealing customer information or disrupting payment terminals. In some stores, attackers reportedly activated heating or defrosting functions remotely, turning equipment designed to preserve food into a source of destruction.
Gallery
Hackers turn supermarket fridges into ovens in unprecedented attack across France
(Photo: Shutterstock)
The Paris prosecutor's office confirmed that it had opened a preliminary investigation into what it described as a large-scale cyberattack affecting refrigeration systems at several major food retailers nationwide.
The incident has raised concerns about food security and the vulnerability of essential infrastructure across Europe, particularly as governments prepare for potentially destructive hybrid attacks, including cyber operations linked to Russia. Authorities have not identified those responsible for the attack.
Hundreds of stores affected, refrigerators heated to 50°C
According to initial reports from France, at least 300 Intermarché and Netto outlets were targeted, along with roughly 100 Coopérative U stores, about 80 Carrefour supermarkets, several E.Leclerc branches and approximately 30 Monoprix locations.
Les Mousquetaires, the retail group that owns Intermarché, confirmed that approximately 150 of its stores had been directly affected.
In those locations, refrigeration systems were reportedly heated to 50 degrees Celsius for six hours, rendering refrigerated and frozen products unsafe for sale.
A company spokesperson said the affected food had been discarded to prevent potential health risks to customers.
The attack has resulted in significant food waste and financial losses, although retailers have yet to determine the total cost.
Intermarché also warned that insurance coverage could become a major issue, as existing policies may not cover an incident of this kind.
Dominique Schelcher, chief executive of Coopérative U, described the attack as unprecedented in its severity.
"Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented," he said.
Schelcher said his company's teams were working alongside refrigeration technicians to restore the affected systems as quickly as possible.
He also called for a thorough investigation to establish how the attackers gained access and whether the incident could have been prevented.
Hackers exploited refrigeration control systems
Investigators believe the attackers targeted refrigeration management systems supplied by Danish manufacturer Danfoss, whose equipment is widely used in commercial refrigeration facilities.
French news channel BFMTV reported that hackers managed to remotely activate forced defrosting functions in refrigerators, freezers and cold-storage rooms at numerous stores.
An Intermarché supermarket in France. Refrigeration systems at approximately 150 of the chain's stores were affected, with temperatures reportedly reaching 50°C for six hours
(Photo: Fred TANNEAU / AFP)
Rather than maintaining the low temperatures required to preserve food, affected equipment began heating up, destroying large quantities of perishable products.
French cybersecurity investigators identified a vulnerability in software supplied by Danfoss and contacted the manufacturer.
The company acknowledged incidents involving its refrigeration management systems in France, saying affected equipment included older products and systems running outdated firmware.
Danfoss said it had previously advised customers to update supported systems and replace older equipment that no longer receives security updates.
In recent months, the company had disclosed critical vulnerabilities affecting software used in its refrigeration products.
One vulnerability reported on September 18 could potentially allow attackers to read and modify internal system variables and upload or execute unauthorized computer code.
However, investigators have not publicly established whether that specific vulnerability was exploited in Monday's attack.
France fears cyberattack could spread across Europe
French Prime Minister Sébastien Lecornu instructed the country's National Cybersecurity Agency, ANSSI, to investigate the attack and coordinate efforts to contain the damage.
Officials close to the prime minister said the government was treating the incident with the utmost seriousness.
"The state is fully mobilized," the prime minister's office said, adding that France was coordinating its response with European partners.
According to a source familiar with the investigation, ANSSI has been working to identify other potentially vulnerable French companies and alert them before further attacks occur.
The agency is also cooperating with cybersecurity authorities in other European countries amid concerns that the attack may not be confined to France.
European Commissioner for Agriculture and Food Christophe Hansen condemned the incident, calling for heightened vigilance over food security.
In a message posted on X, Hansen warned that the weaponization of food had become a reality.
A new threat to essential infrastructure
Cybersecurity experts say the attack demonstrates how vulnerable modern industrial equipment has become as more facilities connect their operational systems to the internet.
Commercial refrigeration units were once largely isolated from external networks. Today, many are connected through remote sensors, centralized monitoring platforms and software that allows operators to adjust temperatures and monitor performance from a distance.
Those capabilities improve operational efficiency but can also create new opportunities for hackers.
Antoine Hautin, secretary-general of cybersecurity consultancy Almond, told AFP that industrial systems were historically designed to prioritize operational reliability and economic efficiency over cybersecurity.
The assumption was that attackers would have little opportunity to access such equipment remotely.
That assumption no longer holds as more industrial systems become interconnected.
Hautin said the ability to compromise hundreds of installations simultaneously suggested a considerable degree of sophistication.
Unlike conventional cyberattacks aimed at stealing information or extorting businesses through ransomware, the French supermarket operation caused direct physical and economic damage by interfering with essential equipment.
The investigation will now focus on identifying the attackers, determining how they breached the refrigeration systems and establishing whether similar infrastructure elsewhere in Europe remains exposed.