More than 500 stores were reportedly hit, with millions of euros potentially lost in spoiled products
Hackers remotely overheated refrigerators at hundreds of supermarkets across France, destroying tons of fresh and frozen food, according to local media reports and industry executives. The massive cyberattack has left retailers facing millions of euros in losses, with some stores forced to close temporarily.
According to Le Monde, the attack struck overnight into Monday, affecting around 300 Intermarche and Netto stores, 100 Cooperative U outlets, 80 Carrefour supermarkets, 30 Monoprix locations, and several E.Leclerc stores, bringing the estimated total to more than 500.
Apart from supermarkets, the cyberattack affected wholesaler Metro, members of the French meat industry association Culture Viande, and independent butchers may also have been hit.
According to BFM-TV, hackers targeted refrigeration controllers supplied by Danish manufacturer Danfoss, which allow technicians to adjust temperatures remotely. The culprits activated automatic defrosting systems, forcing refrigeration units to heat up in some cases to 50C instead of keeping food cold.
🚨🇫🇷 HACKER seize CONTROL of SUPERMARKET refrigerators in France, HITTING 500 stores.
Intermarché, Super U and Carrefour are affected, with the cold chain broken and tons of food destroyed.
This is no accident, it’s an artificial strike on the food supply chain! https://t.co/Slh8opyH1P
As a result, supermarket employees arrived for work to discover overheated refrigeration units and shelves of food that could no longer be sold. In some cases, hackers extended the defrost cycle from one hour to eight hours so that alarms would go off later, allowing them to maximize the damage.
The exact scale of losses is unclear, but an Intermarche in Haguenau, eastern France, lost around €50,000 ($56,000) worth of frozen food. An E.Leclerc store in nearby Wasselonne had to discard fresh and frozen products valued at €220,000.
Cooperative U CEO Dominique Schelcher described the attack as unprecedented and unacceptable. Intermarche chief Thierry Cotillard estimated that nationwide losses could reach tens of millions of euros.
The attackers remain unidentified, and no ransom demand has been reported. The intrusion method also remains unclear, although Intermarche spokesperson told BleepingComputer that the attack affected a service provider that manages refrigeration equipment.
Cybersecurity researcher Kevin Beaumont suggested that thousands of Danfoss controllers are directly accessible over the internet, with the username set to ‘admin’ and the password automatically changing every day to the current date.
Danfoss said the most affected systems were obsolete products, including the AK-SM 800 and AK-SC 355 models, which no longer receive security updates. France’s cybersecurity agency, ANSSI, has urged operators to disconnect vulnerable management interfaces from the internet or restrict access to trusted connections.
Danfoss equipment has already been implicated in major cyberattacks. The company reported that 16 Russian supermarkets using AK-SM 800 controllers were targeted in 2022, around the time of the escalation of the Ukraine conflict. That year, 40 Israeli stores were hacked. The company cited inadequate firewall or VPN protection.
