Cyberattack Hits Supermarket Refrigerators Across France, Spoils Food and Triggers Fires

A cyberattack targeting supermarket refrigeration systems across France caused fires and spoiled large quantities of food after hackers reportedly raised refrigerator temperatures to 50°C for six hours.

Several major supermarket chains, including CooperativeU, E Leclerc, Monoprix and Auchan, were affected by the overnight incident. Intermarché reported that around 150 of its stores had been impacted, according to Reuters as per reports.

All food stored in the affected refrigerators was discarded to prevent health risks, a company spokesperson said.

Supermarket Chains Rush to Restore Refrigeration Systems

CooperativeU chief executive Dominique Schelcher confirmed the attack in a post on X, saying the company's refrigeration systems had been affected since the previous night.

“Our teams are fully mobilised, in contact with refrigeration technicians, to restore the situation as quickly as possible,” Schelcher reportedly said.

He described the incident as serious and unprecedented, adding that an investigation would be conducted to establish the full circumstances of the attack.

The disruption also extended beyond France. Dutch supermarket operator Ahold Delhaize reported that its systems were under attack and that several systems had been taken offline.

A spokesperson for French Prime Minister Sébastien Lecornu said the government was coordinating with European counterparts because other countries could also be affected.

Weak Password Security May Have Enabled the Attack

The incident is believed to be linked to a software vulnerability in internet-connected systems developed by Danish company Danfoss. However, cybersecurity expert Kevin Beaumont suggested that weak security controls could have made the refrigeration systems easy targets.

Beaumont reportedly said several thousand Danfoss systems were directly accessible through the internet. According to his social media post, the systems used the username “admin” and a password that automatically changed each day to match the current date.

Beaumont reportedly rejected speculation that the incident represented an unprecedented cyberattack or was the work of artificial intelligence agents. He instead blamed inadequate security controls and negligent product development, while cautioning against attributing the incident to countries such as Russia, China or Iran without evidence.

Experts Warn of Risks to Internet-Connected Equipment

Oded Vanunu, head of vulnerability research at Check Point Software Technologies, reportedly said the incident demonstrated how connected equipment could become a cybersecurity risk.

“A supermarket refrigerator is no longer just an electrical appliance. It is a computerised system connected to a network, enabling remote monitoring and control,” Vanunu reportedly told Cyber Daily.

He said refrigeration systems often operate for years on outdated software without regular security updates, while management interfaces may remain accessible through the internet.

According to Vanunu, attackers do not necessarily need sophisticated techniques to disrupt such equipment. Refrigeration systems have legitimate operational functions, including defrost cycles, that can be misused if an unauthorised person gains access.

Unlike attacks focused on stealing information or encrypting files, this incident affected the physical operation of equipment, resulting in food losses and potential safety hazards.

How Businesses Can Secure Refrigeration Systems

Vanunu recommended identifying refrigeration controllers and management interfaces exposed to the internet and removing unnecessary access. He also called for regular software updates, stronger passwords, restricted remote access and multi-factor authentication wherever supported.

Robin Long, regional chief technology officer for Asia Pacific at Rapid7, reportedly said the incident highlighted the need for businesses to include operational technology (OT) and internet-connected devices in their cybersecurity planning.

He also warned that companies should examine the security arrangements of vendors and maintenance providers who have remote access to their systems.

Where immediate patching is not possible, businesses should consider removing direct internet access, securing remote connections through virtual private networks or zero-trust gateways with multi-factor authentication, and monitoring suspicious activity.