Cyber-attack on supermarket refrigeration units in France: tonnes of food wasted
Hackers took control of cooling systems in hundreds of French supermarkets, causing food destruction and damage worth millions of euros.
Hackers disabled refrigeration units in hundreds of French supermarkets — tonnes of food destroyed
At least 480 supermarkets in France suffered a cyber-attack during the night of Sunday 11 October to Monday 12 October, targeting their cooling systems. Empty shelves, tonnes of food consigned to the bin and damaged freezer units were the toll — whilst the total financial cost remains impossible to calculate.
According to Ethnos, citing the French newspaper Le Parisien, the perpetrators gained control of a remote management interface for professional refrigeration units belonging to Danish company Danfoss. Through this, they remotely raised the internal temperature of the devices and continuously activated the defrost function at maximum intensity — aiming for the temperature to reach as high as 50 degrees Celsius.
Which retail chains were affected
Danfoss equipment is used in stores of the chains Intermarche, Monoprix, Netto, Super U and Carrefour. Specifically, at least 300 stores of the Les Mousquetaires group — which owns Intermarche and some Netto outlets — were affected, as well as approximately 100 stores of the U cooperative, 80 Carrefour stores and two Auchan stores.
At the Intermarche store in Issy-les-Moulineaux, in the Hauts-de-Seine region, products worth approximately 50,000 euros were discarded — including all the ice cream and charcuterie. Yoghurts, however, were not affected. Some stores were expected to return to normal operation as early as Tuesday 13 October, although Intermarche noted that "everything will depend on supply capabilities and deliveries".
A spokesperson for the chain stated that "our teams were informed and were on the ground in all stores from 04:30 or 05:00 in the morning to empty the refrigeration units that had been affected". Some cooling displays suffered permanent damage and may not be able to be returned to service.
How the hackers operated
The attackers identified the exposed devices through the Shodan search engine, which records internet-connected equipment. The refrigeration units are not integrated into the stores' internal networks, but do have 3G cards for remote temperature monitoring — a requirement imposed by European food safety legislation.
"They exploited a vulnerability in a central system that controls either a series of devices in a supermarket or a single device," explains Kévin Telié, cybersecurity specialist at Synacktiv, which specialises in information system security checks through simulated attacks. After gaining access to the control panel with just a few clicks, the perpetrators activated the defrost function suddenly and with particular intensity.
Known vulnerabilities — and update negligence
The Danfoss software used, known as AK-SM 800A, is used globally and has presented vulnerabilities recorded since 2023 — which the manufacturer itself has characterised as "critical", amongst other reasons due to the risk of third-party takeover of the system. Cybersecurity researchers had informed Danfoss of these gaps several months before the attack.
Security updates were available, but had not been installed. Responsibility lay with external partners managing the refrigeration systems. Danfoss describes the affected devices as "old, at the end of their lifespan, which no longer receive software or security updates" and states that "for some time it has been recommending its customers to switch to more modern solutions".
Similar incidents elsewhere
The attack in France is not an isolated case. Last spring, similar incidents were recorded in Israel, where the operation of a refrigeration chain at a food plant was disrupted. Over the summer, unexplained activations of defrost functions in refrigeration units at United States military bases were reported, both within American territory and in Germany.
Risk to domestic refrigerators?
The Synacktiv specialist clarifies that domestic refrigerators connected to the internet via a home network are not exposed to the same vulnerability, as they do not have a corresponding public remote control interface. "It is not possible to breach them remotely, unless you have modified your router settings and opened" outward access, the specialist points out.
Source: Ethnos