Hackers Hijacked Danfoss Fridge Controls in Hundreds of French Supermarkets and Heated Them to 50 Degrees

Nobody stole any data. Instead, French supermarkets woke up on Monday to warm freezers and aisles of food headed for the bin. Overnight from Sunday October 11, attackers took over refrigeration controls in hundreds of stores and turned cold rooms into heaters.

The trick was the defrost function. It normally runs about two hours a day. The attackers set it to run nonstop, with temperatures reportedly programmed up to 50 C. Witnesses described a wave of heat pouring out of fridges and freezers. BFMTV, which broke the story, says the attack hit older versions of Danfoss control software, prior to version 4.

Hundreds of stores, millions in losses

The retailers' own counts are striking. At least 300 Intermarché and Netto stores were hit, fewer than 100 Coopérative U stores, about thirty Monoprix and "several" E.Leclerc locations. Carrefour Market stores were also affected, according to a trade site, and Metro stores and small independents including butchers were reported too.

Coopérative U chief Dominique Schelcher said attacking equipment that keeps fresh food safe and feeds the French "is extremely serious and unprecedented. It is unacceptable." E.Leclerc said one of its refrigeration suppliers had been hit.

Intermarché had to throw away everything affected to respect the cold chain. It flagged a likely fight ahead: insurance does not cover this kind of incident in stores. In Haguenau, Alsace, an Intermarché reportedly lost about €50,000 of frozen stock and a nearby Super U about €220,000, roughly €270,000 for two shops. A sector source estimates national losses could reach several million euros.

The damage went beyond spoiled food. The Paris prosecutor cited fires breaking out, and the fresh section at the Leclerc in Saint-Brevin-les-Pins was not expected to reopen normally before Tuesday.

The state steps in

The Paris prosecutor opened an investigation on its own initiative into "the large-scale cyberattack affecting the connected refrigerators" of retailers across France, handing it to the national anti-cybercrime office, OFAC. Prime Minister Sébastien Lecornu asked ANSSI, the national cybersecurity agency, to take up the case and is following it personally.

ANSSI says it found a vulnerability in software supplied by a Danish company and contacted the vendor. It is talking to European counterparts "because other countries may be affected" and hunting for other exposed French companies to stop the spread.

Danfoss said it is aware of incidents in France "affecting a limited number of refrigeration management systems." On September 18 it had disclosed a flaw letting attackers read and write internal values and upload and run unsecured programs, one of several serious refrigeration software bugs it reported in recent months. Investigators have not said who is behind the attack or how they got in.

EU agriculture commissioner Christophe Hansen condemned it, warning that "the weaponization of food has become a reality." Tom's Hardware also noted trouble across the border. Since Sunday afternoon, Ahold Delhaize brands Albert Heijn, Etos and Gall & Gall in the Netherlands have had websites, apps and deliveries down, with some shelf labels stuck on last week's prices, and Delhaize in Belgium reported problems. No link to the French attack has been established.

Built for reliability, not attackers

The French case belongs with a growing list of attacks on physical systems, like the hackers who tweaked OT settings at two Colorado water plants and switched off their alarms.

Antoine Hautin, secretary general of security firm Almond, says refrigeration units were long cut off from the internet and are now linked through sensors and remote supervision. "Historically, these systems were designed to prioritize reliability and cost control rather than protection against cyberattacks," he said, because attackers could not reach them remotely. Hitting likely hundreds of units at once, he added, shows "a certain sophistication."

Some offers on this page may be paid placements or contain affiliate links.