Investigation Launched into Hacker Breach of France’s Supermarket Refrigeration Systems

Late last Sunday, shortly before midnight, digital thermostats managing supermarket cold aisles across France began to malfunction. In a remarkable and unprecedented cyber-attack, hackers took control of temperature settings in thousands of freezers and refrigerators, elevating their temperatures from as low as -27°C (-16.6°F) to over 50°C (122°F).

As the hours progressed, perishable items thawed and began to cook. Staff arriving early for their shifts were met with blasts of hot air reminiscent of opening an oven door. One store in Normandy reported freezers reaching an alarming 80°C (176°F), while in some locations, the dramatic temperature changes sparked fires, activating sprinklers and causing additional water damage.

“It was catastrophic,” recounted an employee at a large Intermarché supermarket situated in the southwestern suburb of Issy-les-Moulineaux. “They pushed the freezers up to 62°C. Everything had to be discarded; such a waste.”

Following the incident, store employees worked nearly until midnight on Monday to restore operations, with one noting, “Thankfully, we managed to get things almost back to normal the same day, but we cleared everything in the freezers.”

Initially perceived as an isolated incident, it soon became evident that up to 700 supermarkets—including Intermarché, Coopérative U, Carrefour, Leclerc, and Monoprix—had succumbed to this cyber-attack. Dominique Schelcher, president of Coopérative U, reported that 80 of their 2,000 stores had been affected, calling the attack “completely unprecedented, unexpected, and extremely serious.”

The Paris public prosecutor’s office has launched an investigation in response to what has been highlighted as part of a broader trend in cyber-attacks impacting the country, which has become the most hacked in Europe.

Gérôme Billois, a partner at the cybersecurity firm Wavestone, suggested the attack could signify political sabotage. “The two most plausible scenarios are either young pranksters testing their abilities or a destabilizing operation orchestrated by state actors from within or outside the country,” he stated.

Billois elaborated on the implications of such an attack, stating, “The intended message may aim to incite fear and convey instability to the populace.” He noted that known actors associated with similar tactics are Iran and Russia.

The hackers exploited the controllers from Danfoss, which oversee the refrigeration systems. Most supermarket cold aisles are internet-connected for remote diagnostics and alerts; early investigations indicated that the attackers had disabled alarm systems, allowing them to manipulate the thermostats or extend defrost cycles without triggering warnings.

Danfoss acknowledged that they alerted customers to security vulnerabilities last year, advocating for updates or replacement of obsolete systems. The investigation revealed that many affected refrigeration units were operating on outdated firmware.

Marta Rybczyńska, a cybersecurity researcher, found prior warnings regarding vulnerabilities in older supermarket freezers and noted that many newer systems lacked necessary software updates. “The hackers exploited these weaknesses,” she explained.

She added, “Many of the freezers had default passwords, allowing hackers to disable alerts without triggering alarms. Shops discovered the damage only when staff arrived to commence their shifts the next morning.”

This incident echoes a similar event in the United States, where in August, connected fridges and freezers at military commissaries experienced sudden defrosts overnight, resulting in extensive food losses.

According to cybersecurity firm Upguard, France is the most heavily targeted country in Europe, with widespread data breaches occurring within its health system, jobseekers agency, and several telecommunication companies over recent years. Earlier this summer, the economy and finance ministry suffered a breach leading to the exposure of personal records for 678,000 taxpayers.

Billois cautioned that France has lagged in enhancing cybersecurity measures, particularly in light of the European Union’s Cyber Resilience Act, which aims to implement mandatory security protocols for internet-connected devices. “It’s non-political consensus legislation only delayed by other pressing matters,” he remarked. A similar bill in the UK also struggles to address cyber threats relevant to the food industry.

In the wake of the incident, supermarket leader Schelcher shifted accountability towards unnamed refrigeration contractors who manage the cold storage equipment. Currently, no individuals or groups have claimed responsibility for the attack, and investigators from the Paris anti-cybercrime unit are working on the case, though Billois indicated that identifying the perpetrators could be a lengthy process.

“It may take weeks or even months to ascertain their identity. Hackers are skilled at obscuring their traces,” he explained. The total financial repercussions of the attack have yet to be quantified; however, Thierry Cotillard, CEO of Intermarché, indicated that losses could amount to “tens of millions of euros,” which may not be covered by insurance policies.

“This bizarre scenario highlights a shared responsibility among the supermarkets, refrigeration contractors, and software providers. The ultimate blame lies with the hackers, but it underscores the need for secure systems,” Billois concluded.