Hackers heat up supermarket fridges, spoiling food across France
Attackers tampered with Danfoss refrigeration controllers, spoiling food at French supermarket chains.
Attackers tampered with Danfoss commercial refrigeration controllers used by Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, and Monoprix, forcing stores across France to discard refrigerated and frozen food. Le Monde reported defrost cycles were extended from one to eight hours; some equipment reportedly reached about 50°C, with damaged gear and fires also reported. Danfoss said most affected units were unsupported legacy AK-SM800 and AK-SC355 systems. Les Mousquetaires estimates several million euros in losses, and the Paris prosecutor’s office has opened an investigation. No attacker has been identified, and no link has been established to a separate Ahold Delhaize network incident.
- Overnight Oct. 11–12 attack hit stores using Danfoss refrigeration controllers.
- Attackers stretched defrost cycles from one hour to eight hours, delaying alarms.
- Affected legacy models include AK-SM800 and AK-SC355, which no longer get updates.
- Les Mousquetaires estimates losses of several million euros; fires are under investigation.
- CERT-FR advises isolating controllers, factory resets, patches, and credential replacement.
Full article609 words · extracted from malwarebytes.com · click to collapse
A cyberattack has forced hundreds of supermarkets across France to throw away refrigerated and frozen food after attackers interfered with the systems that keep it cold.
The attack caused significant financial losses and food waste. Some installations reportedly reached temperatures of around 50°C (122°F), with damaged equipment and reports of fires adding to the disruption.
The attack, which struck overnight from October 11 to 12, affected stores belonging to Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, and Monoprix. These stores do not share a single parent company, but they all use refrigeration-control equipment supplied by Danish manufacturer Danfoss.
These commercial refrigeration-management systems let operators manage the equipment that keeps supermarket food refrigerated or frozen. Le Monde reported that the attackers extended defrost cycles from one hour to eight hours, delaying alarms and giving staff less opportunity to intervene before stock was ruined.
Danfoss told AFP that most affected equipment consisted of legacy products that no longer receive software or security updates. It identified AK-SM800 and AK-SC355 systems among those affected and said it had long advised customers to move away from obsolete models and keep supported equipment updated.
Les Mousquetaires, the group behind Intermarché and Netto, has estimated its losses at several million euros. The damage goes beyond spoiled food. The Paris prosecutor’s office has opened an investigation to establish the connection between the attack and reported stock losses and fires.
For customers, the disruption can mean closed departments, temporarily closed stores, and gaps on shelves while replacement stock arrives. Some affected stores have already resumed operations, but restoring refrigeration does not immediately replace everything that had to be discarded.
The technical recovery involves more than resetting temperatures. France’s national cybersecurity incident response center, CERT-FR, recommends disconnecting or filtering access to affected controllers. Where compromise is suspected, it advises operators to:
- Restrict network access to necessary service providers
- Perform a factory reset
- Apply all available security patches
- Replace passwords and other authentication secrets
- Review existing accounts
- Reconfigure the equipment
The attackers have not been publicly identified, and French media have reported no claim of responsibility.
At around the same time, Ahold Delhaize, the retailer behind Albert Heijn and Delhaize, announced a security issue within its network. The company said it had taken some systems offline to protect them while assessing and mitigating the problem, and that stores remained open. Online grocery orders and deliveries were also disrupted
But a similar timeline is not evidence of a shared attack: no connection between Ahold Delhaize’s network incident and the French refrigeration attack has been established.
What consumers can do
- Check before you travel. Look for updates from your local supermarket about opening hours and the availability of refrigerated and frozen goods.
- Follow product-specific advice from the retailer. If it issues a warning or recall, follow its advice about returning or discarding affected food.
- Be cautious with unexpected refund or “order recovery” messages. As a general precaution, check directly through the retailer’s official website or app before providing payment or login details.
For now, the confirmed damage centers on refrigeration, spoiled stock, and disrupted store operations. But the attack demonstrates how tampering with connected equipment can turn a cybersecurity incident into spoiled food, empty shelves, and physical damage—problems that restoring a backup alone can’t fix.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.
About the author
Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.