Attackers Reportedly Hack Supermarket Fridges and Raise Temperatures to 50°C

French supermarket chains are dealing with a major cybersecurity incident after attackers reportedly changed refrigeration settings remotely, causing some chilled cabinets and freezers to heat up instead of cool down.

The incident began overnight between October 11 and October 12 and affected stores linked to Intermarché, E.Leclerc, and Système U, according to early reports.

The cyberattack is believed to have targeted refrigeration-control systems made by Danish industrial technology company Danfoss. These systems manage cooling equipment inside supermarkets, including freezers, chilled food displays, compressors, and temperature alerts. In the affected stores, attackers reportedly changed the settings to trigger continuous defrosting and set temperatures as high as 50°C.

This meant refrigeration units designed to keep food cold reportedly operated like heaters for several hours. Fresh food, dairy items, meat, frozen products, and other temperature-sensitive goods may have become unsafe for sale.

Stores were forced to inspect their stock and discard food that could no longer meet food-safety requirements. BFMTV reported that some locations could face losses reaching hundreds of thousands of euros, while around 150 Intermarché stores were reportedly affected.

Supermarket Fridges Hacked

The incident shows how a cyber incident can quickly become a physical and financial problem. Supermarkets depend on refrigeration around the clock. Even a short disruption can damage stock, interrupt deliveries, create food-safety concerns, and reduce customer trust.

Reports indicate that the attackers may have abused a defrost feature built into the refrigeration-management software. Defrosting is a normal process that removes ice from cooling equipment. However, if it is enabled continuously or configured with unsafe values, the equipment cannot maintain the low temperatures needed to preserve food.

Dominique Schelcher, chief executive of Coopérative U, confirmed that cybercriminal activity had affected refrigeration production systems in several stores in the group’s network. He said teams were working with refrigeration specialists to restore operations and that an investigation would be needed to establish how the incident occurred.

Early reporting suggests older software versions may be involved. However, the exact intrusion method, the responsible group, and whether a known vulnerability was exploited have not been publicly confirmed. That distinction is important. A report that legacy software is present does not prove that a specific security flaw enabled the compromise.

The event also places fresh attention on security issues affecting connected refrigeration equipment. Commercial cooling controllers are part of operational technology, or OT. Unlike ordinary office computers, OT systems directly control real-world equipment, including cooling units, pumps, manufacturing machines, and building controls.

Cybersecurity News previously reported on 23 vulnerabilities in Copeland XWEB Pro refrigeration controllers used by supermarkets, warehouses, and hospitals. Researchers showed that compromised controllers could change temperature readings or silently stop cooling equipment. That research involved Copeland products, not the Danfoss systems named in the French incident, but it demonstrates the real-world impact of insecure refrigeration controls.

Danfoss refrigeration products have also been subject to security advisories. CISA advisories discussed flaws affecting Danfoss AK-SM 8xxA controllers, including authentication weaknesses, command-injection risks, and settings-control issues in older versions. Danfoss released updates for affected software releases, and organizations should confirm that their equipment is running supported versions.

Retailers using remotely managed refrigeration should urgently review every internet-connected controller, remote-access path, vendor account, and third-party maintenance connection. Systems should not be directly exposed to the public internet, and remote access should use a VPN, multi-factor authentication, and strict account controls.

Security teams should also separate refrigeration networks from point-of-sale, corporate, and guest Wi-Fi networks. Temperature changes, repeated defrost commands, configuration edits, and unusual remote logins should create immediate alerts for both IT and facilities teams.

The supermarket incident is still developing, but its lesson is already clear. When attackers gain control of systems that manage physical equipment, the impact can go far beyond stolen data. In this case, a change in software settings reportedly turned supermarket fridges into a costly food-waste event across France.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC