Hackers Baked French Supermarket Fridges to 50°C, Igniting Fires and Tons of Waste

Hackers Baked French Supermarket Fridges to 50°C, Igniting Fires and Tons of Waste

Fridges Forced From Freezer to Oven Overnight

Between Sunday night and the early hours of Monday, October 12, hackers rewrote the settings of connected refrigeration units across several French grocery chains. Units were locked into a defrost cycle and climbed to 50 degrees Celsius (122 Fahrenheit) for roughly six hours. Reuters said several hundred stores nationwide were hit, with reported damage including food losses and fires. BFMTV reported that temperatures were altered remotely, destroying stocks of fresh and frozen products.

Paris Prosecutors Open a "Large-Scale" Case

The Paris prosecutor's office confirmed to AFP that it had opened an investigation into "the large-scale cyberattack affecting the refrigerators of several major food retailers across France." The probe is meant to identify the victims and establish the link between the attack and the reported food losses and outbreak of fires. Prime Minister Sebastien Lecornu has instructed France's National Cybersecurity Agency, ANSSI, to look into the incident.

ANSSI Traces the Breach to Danish Software

A person close to Lecornu said ANSSI had identified a vulnerability in software supplied by a Danish company and had already contacted the vendor. The agency is liaising with European counterparts because other countries may be affected, and is working to identify other French firms at risk so they can be alerted and the spread contained.

Outdated Firmware Was the Way In

Danfoss, the Danish refrigeration controls maker, said it was aware of incidents in France affecting a limited number of refrigeration management systems. The affected units were running outdated firmware, the company said, naming its AK-SM800 and AK-SC355 controller systems and describing them as legacy products that no longer receive software or security updates. BFMTV reported that the attackers went after pre-version-4 control software and abused the defrost function, which normally runs for about two hours a day before the attackers removed the limit and left it running indefinitely.

Security Researchers Had Flagged the Flaws in August

Reuters noted that Claroty's Team82 research team published work on the Danfoss AK-SM 800A controller on August 9, detailing issues that could let attackers bypass authentication controls and execute code on a device; Danfoss shipped a fix in firmware R4.3.1. The same research found thousands of such management interfaces exposed directly to the internet. Neither Danfoss nor investigators have said publicly which flaw was actually used.

Carrefour Hit at 80 Stores Out of 6,000

Carrefour said 80 of its 6,000 stores were hacked, while the vast majority were untouched. A retail-sector site named Monoprix outlets among those affected, though the company has not confirmed it; a retail-industry podcaster also said Carrefour Market stores were hit. E.Leclerc and Auchan did not respond to requests for comment, though BFMTV named E.Leclerc as affected, saying hackers managed to remotely trigger forced defrosting in numerous stores.

Hundreds of Shops Emptied Out

Groupement Mousquetaires, owner of Intermarché and Netto, said fridges at around 150 of its stores heated to 50C for six hours and that all affected food had been discarded to avoid sanitary risks; AFP's roundup of retailer statements put at least 300 Intermarché and Netto shops in scope, while Le Monde gave 150 to 200. More than 100 Coopérative U outlets were hit, and CEO Dominique Schelcher called the attack on fresh-keeping equipment and "the food supply of the French people" extremely serious, unprecedented and unacceptable, saying teams were fully mobilised. French outlet ICI published a photo of melted ice cream, mini-pizzas and broccoli piled up at a Super U in Morcenx-la-Nouvelle.

Fires Land in the Official Damage List

The Paris prosecutor explicitly listed fires among the reported damage, and several outlets led on that angle. Tom's Hardware cited descriptions of "a wave of heat" escaping from the units, the direct by-product of equipment running hot for hours. No count of individual fires has appeared in the reporting so far.

Five Other Countries and a Warning From Brussels

Felix Aime, a senior cyber threat intelligence analyst at Sekoia, said Spain, Portugal, Poland, Germany and Belgium had also been affected. EU food and agriculture commissioner Christophe Hansen wrote on X that "food security requires more attention at all levels," adding that the exploitation of food is now a reality. Separately, Dutch and Belgian chains including Albert Heijn and Delhaize were hit by a distinct incident that disrupted web orders, delivery systems and electronic shelf labels.

Early Loss Estimates Near 300,000 Euros

Tom's Hardware put early loss estimates at close to 300,000 euros, with the national figure potentially climbing into the millions. Meat, frozen goods and vegetables were written off entirely; anything whose cold chain could not be proven remained off the shelves.

Next Steps: Investigate, Sweep, Upgrade

The Paris probe will establish victims and the causal chain between the attack and the losses, while ANSSI pushes the Danfoss response, sweeps other French companies for exposure and shares intelligence with European counterparts. Retailers, meanwhile, need their cabinets back: Mousquetaires told the BBC that some fresh and frozen display units were still out of service on Monday afternoon, with staff restocking "as soon as possible." Schelcher said an investigation will be necessary to shed full light on the attack.