Summary
- French retailers reported refrigeration failures after remote temperature and defrost controls were manipulated.
- Reports identify older Danfoss control software, although the full intrusion pathway has not been established publicly.
- Food losses, store disruption, and control-system access are central to the investigation.
A cyberattack on connected refrigeration systems disrupted hundreds of French supermarket stores overnight on 11–12 October, forcing retailers to withdraw chilled and frozen food while investigators examined unauthorised changes to equipment settings. Intermarché and Coopérative U confirmed that roughly 150–200 and nearly 100 of their stores respectively were affected. Other chains, including Carrefour, Monoprix, and E.Leclerc, were named in reporting, although confirmation differed by retailer.
Attackers targeted controls used to regulate chilled and frozen displays, rather than the retailers’ checkout or customer database systems. French reports described attackers manipulating controls to drive equipment into repeated defrost cycles. Some controller settings were reportedly raised to 50°C, although that figure should not be read as a verified measurement from every affected refrigerator or store.
Intermarché confirmed disruption to fresh and frozen displays associated with an attack reportedly involving a refrigeration service provider. Stores were faced with removing perishable goods, examining equipment, and confirming that storage conditions could be restored before normal trading resumed. Estimates of industry losses ran into millions of euros, but a comprehensive audited figure has not been established.
The investigation involves France’s cybersecurity authorities and the Paris prosecutor’s office. Reporting identified older software or firmware associated with Danish refrigeration supplier Danfoss, although public accounts have not settled every element of the initial access route, the infrastructure used, or the identity of the attackers. The fact that a controller model is implicated does not demonstrate that every installation of that model was vulnerable or compromised.
Temperature controls become an attack surface
Commercial refrigeration equipment is routinely managed through controllers that coordinate compressor operation, defrost intervals, alarms, and temperature monitoring. Remote connectivity supports maintenance across distributed retail estates, but it also creates an avenue through which an unauthorised instruction can affect physical stock rather than only digital records.
A continuous defrost cycle has a different consequence from switching a website offline. Even when the electronic system is restored, food safety rules and uncertainty about exposure time can require products to be discarded. Once chilled stock has warmed beyond safe thresholds, reconnecting a controller cannot reverse the deterioration. Reopening may require inspection, replacement stock, and confidence in temperature records.
Muhammad Yahya Patel, vCISO at Huntress, described supermarket refrigeration as operational technology, alongside building management, heating, ventilation, and cold chain infrastructure. He said that the food retail sector should recognise how its connected equipment can be targeted for disruption. His wider assessment of a developing European sabotage threat is an expert interpretation, not an attribution of this incident to any specific group or campaign.
Investigators face a distribution of responsibility among retailers, equipment suppliers, and external maintenance operators. A chain may own its physical estate while a contractor manages controllers, credentials, software updates, and remote access. Investigators will need to establish which connections were exposed and whether multiple businesses shared a common route into their equipment.
Earlier research by industrial security specialists documented weaknesses in remotely accessible refrigeration controllers, including issues addressed by vendors through updates. That history is relevant to the investigation, but it does not establish which particular weakness enabled this attack. Firmware age, network access, supplier administration, and monitoring records will all affect the assessment.
Restoring a controller can precede recovery of the food operation by many hours. Time and temperature records determine which goods can safely remain on sale, while inspection and restocking can continue after engineers have resumed normal operation. Loss estimates may therefore include stock discarded as a precaution and time spent assessing equipment, rather than only damaged hardware. Evidence about any reported overheating or fires also needs to be established site by site rather than applied to every retailer in the affected networks.
Replacement equipment accounts for only part of the retailers’ potential costs. It includes spoiled goods, interrupted trading, emergency staffing, logistics changes, and potentially contractual or insurance questions. French stores were still assessing losses and recovery as investigators sought to establish how the controllers were reached and altered.
