Cyberattack on French supermarkets remotely overheats fridges, causing fires and mass spoilage
An unprecedented physical cyberattack targeting commercial cooling controllers across France forced refrigeration and freezer systems in hundreds of supermarkets to heat up to 50°C (122°F) overnight. The incident resulted in widespread food spoilage, electrical fires at several locations, and tens of millions of euros in financial damage, highlighting the risks facing connected physical infrastructure.
The Paris prosecutor's office and France’s National Cybersecurity Agency (ANSSI) launched a formal investigation into the attack, which affected major retail chains nationwide, including Intermarché, Carrefour, Monoprix, and Coopérative U.
Exploiting Industrial Control Systems and Defrost Functions
The attack targeted centralized building management software and industrial Internet of Things (IoT) controllers retail stores use to regulate cooling cycles. Investigators determined that threat actors manipulated remote administrative interfaces to force commercial refrigeration units into continuous, high-temperature defrost modes for approximately six hours.
Authorities traced the initial attack vector to exposed industrial control systems, including Danfoss AK-SC and AK-SM series controllers running outdated firmware with unpatched authentication-bypass vulnerabilities.
By keeping cooling compressors and heating elements in continuous forced-defrost mode, the threat actors caused severe electrical overloads, sparking fires at multiple retail outlets.
Intermarché confirmed that roughly 150 of its locations were impacted, forcing stores to discard all chilled and frozen inventory to comply with food safety regulations. Carrefour reported disruptions across 80 supermarkets, while Monoprix reported impact across 5% of its network.
Economic Impact and Supply Chain Vulnerabilities
While no ransomware strain or specific threat actor group has publicly claimed responsibility, retail industry leaders warned that the operational fallout represents significant commercial losses. Intermarché CEO Thierry Cotillard estimated that industry-wide damages across France reached tens of millions of euros in a single day due to destroyed inventory, damaged hardware, and emergency maintenance.
The French retail association, Fédération du Commerce et de la Distribution (FCD), called for total transparency from industrial hardware vendors while working with ANSSI to isolate store networks. CERT-FR subsequently issued an emergency security alert covering multiple controller families, including Danfoss and Copeland devices, warning that scanning and exploitation campaigns targeting internet-exposed cooling equipment remain active across Europe.
Heightened Focus on Operational Technology Security
The incident marks a rare operational technology (OT) cyberattack where digital exploitation directly caused physical destruction and physical fire hazards in commercial environments.
As European regulators enforce strict resilience standards under the Digital Operational Resilience Act (DORA) and NIS2 directive, the attack highlights the necessity of air-gapping industrial control networks, eliminating default passwords, and enforcing timely firmware updates across enterprise facilities.
