Hundreds of French supermarkets were hit by a cyber attack that forced fridges and freezers to heat up overnight, spoiling fresh and frozen food estimated to be worth millions of euros. Hackers took control of software that regulates the temperature of refrigeration units, and some units were pushed to around 50C (120F), according to one affected chain.
This explainer sets out what has been reported, which companies were affected, and what the equipment supplier has said. The full scale of the attack is still unclear.
What happened
Hackers gained control of the software that regulates the temperature of refrigeration units. Normally, supermarket freezers go through a short defrosting period overnight, when temperatures rise slightly. The hackers instead ordered the units to heat up and stay hot.
The BBC reported that more than 100 stores of Coopérative U were targeted, and the chain’s chief executive called the attack “extremely serious and unprecedented”. Some 180 stores from Intermarché and its Netto brand were affected. A spokesman said another 100 shops were urgently disconnected from the internet to prevent the same thing happening to them.
Which retailers were affected
Other major French food retailers were also hit, including Carrefour, Monoprix and E.Leclerc. Figures from individual chains suggest about 400 stores were affected out of roughly 15,000 in France, according to the BBC’s estimate.
Carrefour said fridges in 80 of its 6,000 stores were hacked. Monoprix said 5% of its more than 400 stores had been hit, and food was removed from sale where its condition could not be guaranteed. Mousquetaires, which owns Intermarché and Netto, said some fresh and frozen display units were still out of service on Monday afternoon, and staff were restocking shelves as quickly as possible.
What the supplier has said
The attack targeted software from Danish engineering firm Danfoss, which lets retailers manage their cold units remotely. Danfoss said the affected cold units were older models whose security software could not be updated to protect against a risk the company had identified.
Danfoss said it had “long advised” businesses to keep supported systems up to date. It said it remains committed to helping customers maintain secure and reliable systems.
Why older equipment is a risk
The case shows how connected equipment can become a target. Refrigeration and other building systems are often managed remotely for convenience, but if the devices cannot be patched, an attacker who gains access can change how they operate. Keeping software supported and updated, limiting remote access, and having a manual fallback for temperature control are standard measures against this kind of risk.
What is confirmed and what is not
- Confirmed by the chains: stores were hit, food was removed from sale in some cases, and some units were disconnected from the internet.
- Confirmed by Danfoss: the affected units were older models whose security software could not be updated.
- Not confirmed: the total number of stores affected, the total value of the lost food, and who carried out the attack.
Frequently asked questions
What did the hackers do?
They took control of software that regulates refrigeration temperatures and ordered some fridges and freezers to heat up and stay hot overnight.
Which shops were affected?
Coopérative U, Intermarché, Netto, Carrefour, Monoprix and E.Leclerc were among the chains reported to have been hit.
Is the food safe to eat?
Some chains removed food from sale where its condition could not be guaranteed. Shoppers should follow store and food safety guidance rather than assume that all products are unaffected.
What caused the attack to succeed?
Danfoss said the affected cold units were older models whose security software could not be updated to guard against a risk it had identified.
Who makes the software that was attacked?
The software came from Danish engineering firm Danfoss. It lets retailers manage their cold units remotely, and Danfoss said the affected units were older models that could not be updated.
Sources
- BBC News: Fridges in French supermarkets hit by cyber attack
- Danfoss: Refrigeration and air conditioning
- CISA: Cybersecurity advisories
- UK National Cyber Security Centre: News
- BBC News: homepage headline listing
