Supermarket Cyberattack: How Hackers Heated Fridges to 50°C and Exposed Europe’s Food Supply Vulnerabilities

The incident began in the early hours of Monday.

Refrigeration display cases and storage units across hundreds of French supermarkets received remote commands to raise temperatures. Forced defrost cycles ran continuously for roughly six hours, melting frozen stock, spoiling meat, and sending display temperatures upward. In several locations, compressor motors overheated and caused localized fires.

By Tuesday, store personnel were clearing spoiled produce while corporate management assessed financial losses.

The Paris prosecutor’s office opened a national criminal investigation into what it described as a "large-scale cyberattack affecting the connected refrigerators of several major food retailers across France." Prime Minister Sébastien Lecornu instructed state agencies to coordinate a national technical response, while Economy Minister Roland Lescure called the disruption a "wake-up call for everyone" across the distribution sector.

Several major retail groups reported impacts, including Carrefour, Monoprix, Coopérative U, Auchan, E Leclerc, and Les Mousquetaires.

For its Intermarché chain alone, Les Mousquetaires reported losses reaching “tens of millions of euros” in a single day across roughly 150 affected stores, with nationwide estimates suggesting between 350 and 700 outlets were compromised. Simultaneously, Dutch operator Ahold Delhaize isolated its IT network during a “cybersecurity incident” affecting its Albert Heijn chain in the Netherlands and Belgium, disrupting online ordering, home delivery, and digital price tags.

Dutch cybersecurity authorities stated there was no technical evidence linking the events in France with the disruption in the Netherlands. Europol confirmed it was consulting with national investigators across member states.

Unlike conventional cyberattacks targeting corporate databases, the intrusion did not involve data exfiltration or financial extortion.

The perpetrators bypassed traditional targets to manipulate physical cooling equipment, demonstrating how industrial machinery can be utilized for operational disruption.

Out of Order

Food retailers across Europe have spent decades centralising supply chain management to optimize operational efficiency.

Equipment ranging from display cases to HVAC systems is routinely connected to remote management portals, allowing external facilities management contractors to adjust temperatures or run diagnostics without visiting individual stores.

Security measures across peripheral hardware, however, often lagged behind network connectivity.

The French intrusions compromised digital controllers manufactured by Danish firm Danfoss and US-based Copeland, which owns the Dixell brand.

The actors utilized built-in maintenance protocols—specifically defrost functions designed to clear ice build-up—and removed operational temperature limits without deploying custom zero-day exploits.

Security researchers had previously documented these risks.

In August, security research firm Claroty published details of an authentication-bypass flaw in Danfoss AK-SM 800A controllers, noting mechanisms that "could be abused" to "bypass normal authentication" and remotely alter temperature settings.

Months later, thousands of these interfaces remained indexed on public search engines.

Installers and third-party maintenance providers had connected the hardware directly to the open web without firewalls, enterprise VPNs, or current firmware updates.

This situation reflects a broader structural issue in commercial cybersecurity.

Corporate budgets are frequently allocated toward protecting customer payment data and enterprise software, while peripheral hardware is managed by third-party contractors operating legacy controllers on end-of-life software.

As Ken Munro, a partner at British security firm Pen Test Partners, observed: "This is about basic cyber hygiene. Get it wrong and you get a smelly mess of defrosted food." Munro added that there was "no business need for the fridge controllers to be accessible on the public internet," noting that "it doesn’t take much for one blind spot in a business to lead to tonnes of trashed food."

Rather than experiencing a standard data breach, retailers faced physical spoilage, operational downtime, and equipment damage.

No Ransom, No Claim

Investigators noted that the absence of a clear motive or ransom demand remains a central puzzle.

Most commercial cyber intrusions follow established patterns: criminal syndicates encrypt sensitive networks to demand cryptocurrency payments, or state actors conduct long-term intelligence collection. In this instance, no ransom was requested, no extortion portal was established, and no group claimed responsibility.

Security analysis identified thousands of similar controllers operating openly online across Spain, Portugal, Poland, Germany, and Belgium.

Because the exploit required limited technical complexity, the range of potential actors remains broad, spanning state-sponsored entities testing infrastructure resilience to actors seeking disruption.

Félix Aimé, principal threat researcher at French cybersecurity firm Sekoia, remarked that "an operation intended to destabilize certain economic activities, or infrastructure could also be considered," while noting that perpetrators did not appear to have used malicious code on the controllers.

The event aligns with broader concerns regarding hybrid threats across Europe.

In September, French President Emmanuel Macron cautioned political leaders that the "Russian hybrid threat facing Europeans and France" had intensified in recent weeks, requiring strengthened protection plans for critical infrastructure.

While defense planning frequently focuses on power grids, subsea cables, or water treatment facilities, the incident in France indicates that private commercial networks can serve as vectors for public disruption.

Thin Margins, Thinner Buffers

Physical food supply networks operate on lean logistical models.

Research by the Clingendael Institute and Erasmus University indicates that modern European grocery networks rely on just-in-time logistics, with stores and distribution hubs holding approximately six days of food supply.

When central refrigeration systems fail simultaneously across multiple locations, local inventory buffers cannot absorb the loss, creating immediate logistical bottlenecks.

Official reaction reflected the severity of the operational risk.

Dominique Schelcher, chief executive of Coopérative U, emphasized: "Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented." European Agriculture Commissioner Christophe Hansen echoed those assessments on social media, writing that food security requires greater attention at all levels because "the weaponisation of food has become a reality."

For retailers, financial impacts extend beyond discarded inventory to include emergency sanitization, equipment repairs, liability claims, and lost trade. Equipment manufacturers face increased scrutiny regarding the continued operation of legacy, unpatchable hardware in commercial environments without mandatory security upgrades.

In response, Danfoss acknowledged that many affected units had "reached end of life and no longer receive software or security updates" or were "running outdated firmware," stressing that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."

Copeland similarly identified the vulnerability in a "discontinued, end-of-life generation of controllers," confirming it was working with affected customers to mitigate ongoing risks.

Regulatory authorities have historically treated commercial store equipment as private property outside the scope of national security policy.

That distinction is under review.

State agencies such as ANSSI are expected to pursue broader mandates to enforce security baselines on commercial IoT networks, requiring private operators to manage peripheral hardware with standards comparable to critical infrastructure.