A coordinated cyberattack has disrupted refrigeration systems across hundreds of supermarkets in France, forcing stores to throw away large quantities of food after connected fridges and freezers were remotely switched into defrost mode. The incident affected several major supermarket chains and demonstrates how cyberattacks against operational technology can cause immediate physical and financial damage rather than simply exposing data.
According to reports, the attackers manipulated refrigeration controllers used by stores to manage temperatures, defrost cycles and alarms. In some affected locations, temperatures reportedly climbed to around 50°C, or 122°F, after systems remained in defrost mode for several hours. The disruption spoiled refrigerated and frozen goods, while some locations also reportedly experienced fires.
Several Major French Supermarket Chains Were Hit
Three of the country's major grocery operators — E. Leclerc, Intermarche and Cooperative U — confirmed that stores had been affected. Authorities in Paris indicated that other grocery chains were also impacted, suggesting the campaign may have reached beyond the initially identified companies.
The scale is particularly concerning because refrigeration systems are critical infrastructure within supermarkets. A brief outage may be manageable, but several hours of uncontrolled temperature increases can render large quantities of food unsafe for sale.
Fresh meat, dairy products, frozen food and other temperature-sensitive goods can quickly become unusable when refrigeration is interrupted. Even if products appear visually normal, supermarkets must follow food safety standards when storage temperatures fall outside approved limits.
Attackers Forced Refrigeration Systems Into Defrost Mode
Rather than physically damaging refrigeration equipment, the attackers appear to have manipulated the software controlling it. The affected systems reportedly entered defrost mode and remained there for hours, allowing temperatures inside fridges and freezers to rise dramatically.
Defrost cycles are a normal part of commercial refrigeration. Ice can build up on cooling components over time, reducing efficiency, so systems periodically warm specific components to melt accumulated frost.
The problem occurs when that process is triggered incorrectly or continues for far longer than intended. A legitimate maintenance feature can therefore become damaging if an attacker gains control over it.
Two Danfoss Controllers Were Reportedly Targeted
The affected infrastructure involved two Danfoss refrigeration control systems: the AK-SM800 and AK-SC355. These controllers are used to centrally manage refrigeration equipment, including temperature monitoring, alarm systems and defrost scheduling.
The affected installations were reportedly running outdated firmware. Danfoss said it was working with impacted customers on mitigation measures, including installing available firmware updates, strengthening network protections and removing direct internet exposure where appropriate.
This detail is especially important because the attack appears to have targeted the management layer controlling multiple refrigeration systems rather than compromising individual fridges one at a time.
Internet Exposure Increased The Risk
Commercial refrigeration controllers are often connected to networks so technicians and operators can manage them remotely. This provides obvious operational benefits. Companies can monitor temperatures across multiple locations, receive alerts when refrigeration equipment fails and remotely adjust system configurations.
However, connecting operational systems to the internet also creates an additional attack surface.
If a controller is directly reachable from the internet and running vulnerable or outdated software, attackers may be able to find it through automated scanning. Once access is obtained, the same remote-management functions designed to help engineers can potentially be abused to manipulate equipment.
The convenience of remote access therefore needs to be balanced with strong security controls.
Food Had To Be Destroyed
The most visible consequence of the attack was food spoilage. Products that exceeded required storage temperatures had to be discarded rather than returned to shelves.
For supermarkets, that can translate into substantial financial losses. A single large store may carry considerable amounts of meat, seafood, dairy products, frozen foods and prepared meals inside refrigerated units. If multiple refrigeration zones are affected simultaneously, losses can accumulate extremely quickly.
The impact also extends beyond the value of the discarded food. Stores may need to close aisles, bring in emergency refrigeration equipment, inspect systems and restock products before normal operations resume.
Some Locations Reportedly Experienced Fires
More concerningly, some reports indicated that fires occurred during the incidents. The precise relationship between the manipulated refrigeration systems and those fires has not been fully established in the supplied information.
Even without that detail, the possibility highlights the difference between conventional IT attacks and compromises involving operational equipment. Manipulating physical systems can potentially create safety hazards that extend beyond lost data or disrupted applications.
Cybersecurity failures in operational technology can therefore affect buildings, machinery, products and people.
Investigation Into The Attack Is Ongoing
Authorities and affected supermarket operators are investigating the incident, but the identity of the attackers remains unclear. The exact vulnerability or sequence of weaknesses used to compromise the refrigeration systems has also not been publicly established.
This means it is too early to say whether the campaign relied on a single software vulnerability, weak credentials, exposed management interfaces or a combination of several weaknesses.
The coordinated nature of the incident nevertheless suggests that attackers were able to identify similar systems across many locations and manipulate them within a relatively short period.
This Is An Operational Technology Attack, Not Just An IT Incident
The attack provides a clear example of the growing cybersecurity risk surrounding operational technology, commonly shortened to OT.
Traditional IT systems manage things such as email, documents, databases and business applications. OT systems control physical processes and equipment, including factory machinery, elevators, heating systems, power infrastructure and commercial refrigeration.
When IT is compromised, organisations may lose information or access to digital services. When OT is compromised, the attacker may be able to influence the physical world.
That difference makes OT security particularly important.
Commercial Refrigeration Has Become Increasingly Connected
Modern supermarket refrigeration systems are far more sophisticated than simple thermostats. Central controllers can manage large numbers of refrigerated cabinets and freezers across a store.
They can automatically record temperatures for food safety compliance, notify technicians about equipment failures and coordinate defrost cycles. Remote connectivity also makes maintenance easier because engineers can sometimes diagnose problems without travelling to each location.
These capabilities improve efficiency, but every connected function introduces another potential security consideration.
A controller connected across dozens or hundreds of stores can become especially valuable to attackers because compromising one type of system may provide opportunities across many locations.
Outdated Firmware Creates Additional Exposure
The incident also reinforces the importance of keeping operational equipment updated. Refrigeration systems may remain installed for many years, far longer than typical smartphones or laptops.
Businesses may hesitate to update industrial controllers because downtime can disrupt operations. In some cases, organisations may also worry that new firmware could cause compatibility problems with older hardware.
As a result, OT equipment can remain on outdated software for extended periods.
That creates an attractive target because publicly known vulnerabilities may remain exploitable long after patches have been released.
OT Devices Can Be Difficult To Patch
Updating operational systems is not always as straightforward as installing a monthly Windows patch.
A supermarket may operate continuously, and refrigeration equipment cannot simply be switched off for hours without consequences. Updates may require careful scheduling, testing and coordination with vendors or maintenance contractors.
Some older controllers may also have limited support or depend on legacy software.
This means security teams need a clear inventory of connected operational equipment and a plan for managing vulnerabilities without disrupting essential business operations.
Network Segmentation Becomes Critical
One of the most important protections for operational equipment is network segmentation. Refrigeration controllers generally should not have unrestricted communication with the rest of a company's IT environment.
Separating operational systems into dedicated networks can limit how far an attacker can move after gaining access to one device.
Remote administration should also be restricted through secure gateways, VPNs or other controlled access mechanisms rather than exposing management interfaces directly to the public internet.
Even when a device contains a vulnerability, reducing its exposure can make exploitation considerably more difficult.
Direct Internet Access Should Be Reviewed
The response to the incident included recommendations to remove direct internet exposure where appropriate.
This is a particularly important point for any organisation operating connected industrial or building-management equipment. Many devices do not need to be directly reachable from anywhere on the internet.
Remote management can instead be provided through controlled access systems that require authentication and limit which users or systems can reach the device.
Every unnecessary public-facing interface effectively gives attackers another door to test.
Strong Credentials And MFA Matter Too
Operational technology sometimes relies on older authentication practices, including shared administrator accounts or passwords that rarely change.
Where supported, organisations should use unique credentials and multi-factor authentication for remote-management platforms. Default passwords should never remain active after equipment is installed.
Access should also be limited according to role. A technician who only needs to monitor temperature data should not automatically receive permission to change critical refrigeration settings.
These controls can reduce the damage caused by compromised credentials.
Monitoring Should Include Physical Behaviour
Traditional cybersecurity monitoring looks for suspicious logins, malware or unusual network traffic. OT environments need another layer of monitoring: unexpected physical behaviour.
If hundreds of refrigeration units suddenly enter defrost mode simultaneously, that should generate an immediate operational alert even if the command technically came from an authorised management system.
Similarly, unusual changes to temperature thresholds, control schedules or alarm settings should be treated as potentially suspicious.
Combining cyber monitoring with equipment telemetry can help identify attacks that otherwise appear to be legitimate administrative actions.
The Attack Highlights Risks Across The Food Supply Chain
The supermarket incident is concerning because refrigeration is a fundamental part of modern food distribution. Cold-chain systems keep food at safe temperatures from production facilities through warehouses and transportation to retail stores.
Disrupting refrigeration at scale could potentially affect more than one supermarket chain.
If similar attacks targeted distribution centres or logistics providers, the impact could spread further through the supply chain and reduce product availability across wider regions.
Food infrastructure therefore deserves the same cybersecurity attention increasingly being applied to energy, transport and healthcare systems.
The Same Problem Extends Far Beyond Supermarkets
The underlying issue is not specific to refrigerators. More industrial equipment is being connected to networks for monitoring, automation and remote management.
Power grids, water systems, manufacturing plants, building controls and even highly sensitive infrastructure increasingly depend on software-driven operational technology.
Once a physical system becomes digitally accessible, it can potentially become a cybersecurity target.
The simple principle is becoming increasingly important: if something is connected, someone may eventually try to attack it.
Consumer IoT Has Similar Weaknesses
The same security challenges can also affect consumer smart devices. Smart refrigerators, cameras, thermostats, doorbells and other connected appliances depend on firmware, cloud services and network connectivity.
A software flaw or failed update can make these devices unreliable, while a security vulnerability can expose them to outside attackers.
Industrial equipment generally creates much greater consequences because it operates at larger scale, but the underlying problem is similar: adding connectivity introduces new opportunities for both legitimate management and malicious access.
Organisations Need To Treat OT As Part Of Cybersecurity
For years, some businesses treated operational equipment as separate from conventional IT security. That distinction is becoming increasingly difficult to maintain.
Refrigeration controllers, industrial systems and building-management devices may now communicate using standard IP networks and interact with cloud platforms. Security teams therefore need visibility into these environments.
Organisations should know:
Without this visibility, outdated devices can quietly remain exposed for years.
Final Thoughts
The cyberattack against French supermarket refrigeration systems demonstrates how digital attacks can quickly produce physical consequences. By reportedly forcing connected fridges and freezers into extended defrost cycles, attackers caused temperatures to rise, spoiled large quantities of food and disrupted operations across hundreds of stores.
The incident is also a warning for any organisation operating internet-connected operational technology. Remote monitoring and centralised management provide enormous benefits, but those advantages disappear quickly if outdated firmware, exposed interfaces or weak access controls give attackers control of critical equipment.
Cybersecurity is no longer only about protecting computers and data. Increasingly, it is also about protecting the physical systems that keep businesses, cities and essential services running.
Comments 0