Hackers attacked hundreds of supermarkets in France, hacking refrigeration systems and ...

A massive cyberattack targeted hundreds of French supermarkets overnight on October 11 to 12, remotely hijacking refrigeration systems to trigger intense defrost cycles, spoiling vast quantities of food and sparking fires.

The unprecedented incident has triggered a national criminal investigation. The Paris Prosecutor’s Office confirmed to OCCRP Tuesday that its cybercrime section has initiated an investigation, entrusted to the Anti-Cybercrime Office (OFAC). The probe aims to "identify the victims and establish a link between the incident and the damage reported by them, specifically regarding food spoilage and the outbreak of fires."

Hackers gained remote control of the store refrigeration systems by exploiting internet-connected controllers. The attack methodology mirrors vulnerabilities the operational technology security firm Claroty warned the industry two months prior. In a prescient August report titled " Freeze the Controller, Defrost the Food ," the firm’s Team82 research division warned the possibility that hackers could access Danfoss refrigeration systems to bypass security and manipulate temperatures.

Now, hackers have executed exactly that kind of breach, accessing the controllers and remotely manipulating temperature settings to reach 50 degrees Celsius (122 degrees Fahrenheit).

At the DEF CON hacker convention in August, Team82 researchers had demonstrated exactly how attackers could use a hidden "code-of-the-day" authentication mechanism and a command-injection vulnerability to take over Danfoss AK-SM 800A platforms. While Danfoss had issued a firmware update in August 2025 to address the flaws, Claroty noted that public internet-scanning tools recently identified 2,765 exposed Danfoss controllers still online.

The scope of the vulnerabilities extends beyond a single manufacturer. A security bulletin updated Tuesday by CERT-FR—France’s national center for cybersecurity incident response— confirmed compromises of Danfoss AK-SM and AK-SC series controllers, as well as Copeland XWEB and Dixell XWEB monitoring systems. These devices function as the digital nerve centers for commercial refrigeration, allowing operators to remotely monitor temperatures, trigger alarms, and manage energy consumption.

CERT-FR warned that attack campaigns are likely still ongoing and strongly advised against exposing these management interfaces to the public internet. A simple factory reset, the agency noted, is insufficient for unpatched equipment, which will "certainly be compromised again."

The physical and financial toll across France was immediate, forcing stores to discard food stocks and calling the country’s food security into question. The Mousquetaires Group, a French multinational retail conglomerate, told OCCRP that 300 of its stores in France were compromised. The group stated that the impact ranged from equipment malfunctions to complete system inoperability, resulting in millions of euros in losses.

"It will take us a week to return to normal operations for customers, but two to three weeks to fully restore our systems," the Mousquetaires Group’s press office told OCCRP. "Everyone in the industry was aware of the risk of hacking, but this situation is deeply concerning because it appears to involve outside interference; it is essentially an attempt to destabilize operations."

Other impacted retail chains include Carrefour, Monoprix, and E.Leclerc.

Dominique Schelcher, CEO of the supermarket chain Coopérative U, provided a detailed update on X on Tuesday, confirming that 80 of his network’s nearly 2,000 stores were targeted. While staff interventions prevented a break in the cold chain in the vast majority of cases, affected products in other locations were immediately withdrawn and destroyed to ensure food safety.

Defending the use of internet-connected refrigerators, Schelcher explained the technology is essential for round-the-clock remote temperature monitoring and rapid response to anomalies.

"Attacking equipment essential to the conservation of fresh products means attacking the food supply chain of the French people," Schelcher wrote. "It is unprecedented, extremely serious, and unacceptable."

Moving forward, Claroty warned that artificial intelligence is reducing the time needed to scan systems for vulnerabilities, allowing attackers to carry out disruptive hacks at scale across commercial enterprises dependent on refrigeration.

Specializes in crime news, high-profile cases, and the work of law enforcement agencies.