Hackers heated up fridges in French supermarkets, spoiling millions of euros of food

Hundreds of supermarkets in France opened on Monday, October 12, to find their fridges and freezers warm. Overnight, attackers had taken remote control of the refrigeration controllers in the stores and switched them into defrost mode, with the target temperature set as high as 50 °C. Intermarché told AFP that 150 to 200 of its stores were hit, and Coopérative U, which runs the Super U and Hyper U chains, said fewer than 100 of its outlets were affected. The Paris prosecutor's office has opened a criminal investigation.

How a fridge gets hacked

According to BFMTV, cited by AFP, the attack targeted refrigeration control systems made by the Danish manufacturer Danfoss, which are installed in a large share of French stores. These controllers let a refrigeration contractor watch and adjust temperatures remotely. Defrost is a normal, short phase in which a unit heats up to melt the ice on its coils. The attackers reportedly triggered it remotely and kept it running.

The 50 °C figure is the setpoint the attackers entered, not necessarily the temperature the food reached. But a few hours were enough. In some stores the attack began around midnight, and with nobody on site, the temperature kept climbing until opening time. Staff at several stores told the trade site Je bosse en grande distribution that the alarms either did not reach the on-call technician or did not go off at all.

Which flaw was used has not been confirmed. Researchers at Claroty's Team82 have described serious vulnerabilities in Danfoss's AK-SM 800A system manager, including an authentication bypass, and Danfoss released a fix in firmware R4.3.1. The researchers also found thousands of such management interfaces open to the internet. BFMTV reports that the attackers went after older versions of the Danfoss software, but neither Danfoss nor the investigators have said publicly how they got in.

Which stores were hit

Intermarché and Coopérative U are the only chains that have confirmed figures. Coopérative U's CEO Dominique Schelcher wrote on X that the attack was "extremely serious and unprecedented" and "unacceptable". E.Leclerc stores were named by BFMTV, and Carrefour Market and Monoprix by Je bosse en grande distribution, but those groups had not confirmed it to AFP.

Intermarché said the affected stores must throw away all fresh and frozen products in the units concerned, including meat, dairy and fish. Some stores closed whole sections. No chain has given a total loss. Individual stores have reported losses from 50,000 to 220,000 euros, and Le Figaro puts the national bill at several million euros. Intermarché added that insurance is a "sticking point", since policies do not cover this kind of incident.

The investigation

The Paris prosecutor's office opened the case on its own initiative. Its cybercrime section leads it, with the national anti-cybercrime office OFAC investigating. The prosecutor's office also mentioned fires breaking out, without giving details. The investigators' first tasks are to list all the victims and link them to the food losses. The Commerce Ministry said only that it is in contact with the retailers. No group has claimed the attack.

Why it matters beyond supermarkets

Most attacks on retailers steal data. This one went after physical equipment and caused damage that a backup cannot undo. The weak point is familiar: a device that is managed over the internet, runs old firmware and is reachable from outside. The same applies to boilers, building access systems, cameras and home equipment. A router with forgotten remote access can end up working for strangers in the same way.

• If a device can be managed remotely, check whether its control panel is reachable from the internet, and close it or put it behind a VPN if it is.
• Install firmware updates, and replace default or shared passwords.
• Make sure alarms go to a person who will see them at night, and test them.

For shoppers there is no direct risk: the stores say the spoiled products were destroyed. Some shelves may stay empty for a few days while stock is replaced.