How Hackers Turned French Supermarkets Into an Arms Short of Food

The attack was simple. The implication is enormous.

Hackers didn’t steal data or decrypt files. They turned up the heat.

Over Sunday night into Monday, someone remotely triggered the forced-defrost cycle on refrigeration management systems across at least 400 French supermarkets. Temperatures inside freezers and chillers climbed to 50°C — 122°F. Stock spoiled. Fires broke out in at least several stores. Hundreds of tonnes of fresh and frozen food were lost in a single day.

The retailers affected — Intermarché, Cooperative U, E.Leclerc, Carrefour, Monoprix — described the incident as unprecedented. So did the Paris prosecutor’s office, which confirmed the attack targeted “connected refrigerators in several major food retailers across France.”

What makes this episode worth watching goes well beyond a bad day at the checkout. It is the first large-scale demonstration that IoT-connected cold-chain equipment can be turned into a weapon against food supply itself.

How the door was left open

According to BFM TV, the hackers remotely activated the defrost function on numerous store systems. The control panels that manage refrigeration across entire retail locations are designed to be accessed over the internet — so maintenance contractors can adjust temperatures from anywhere. That convenience is also the attack surface.

France’s National Cybersecurity Agency, ANSSI, identified a vulnerability in software supplied by Danfoss, a Danish industrial firm that builds refrigeration management systems. Danfoss said the affected units were running outdated firmware and that it had “long advised customers” to keep systems updated and replace older equipment.

That explanation lands poorly. Cybersecurity firm Claroty had already published research on August 9 describing vulnerabilities in Danfoss systems that could allow attackers to bypass authentication entirely. The clock was ticking. The question now is whether Danfoss disclosed those flaws before the attack, and whether retailers who ignored update warnings were uniquely exposed — or whether the vulnerability was exploitable regardless.

The French retail federation, the FCD, has called on Danfoss to provide “full transparency.” That demand will reverberate across the continent.

Who is actually affected

The scale is already sobering. At least 300 Intermarché or Netto stores were hit, along with more than 100 Cooperative U outlets. Carrefour reported 80 affected supermarkets. Monoprix said roughly 5 percent of its 490 stores were targeted. E.Leclerc confirmed several locations were involved.

Intermarché CEO Thierry Cotillard told BFM TV the losses would amount to “tens of millions of euros nationwide in a single day.” No industry-wide estimate has been released.

More disturbingly, analysts say France was not the only country struck. Felix Aime, a senior cyberthreat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany, and Belgium were also affected. The attack appears to have followed the same Danfoss vulnerability across borders, exploiting equipment that shares firmware and architecture regardless of geography.

Prime Minister Sébastien Lecornu ordered ANSSI to investigate and confirmed France is coordinating with European counterparts. Authorities are assessing whether other French companies beyond retail are at risk.

Why this changes the conversation around critical infrastructure

Cold-chain logistics sits at the intersection of three domains that policymakers usually treat separately: food security, industrial control systems, and consumer retail. This attack forces them together.

For decades, discussions about attacking critical infrastructure focused on energy grids, water treatment, and transportation networks. Retail refrigeration was never on that list — until now. Yet the consequences are comparable: spoiled food threatens public health, disrupts supply chains, and creates immediate economic damage that ripples outward.

Steven Lachance, a cybersecurity analyst who spoke to Al Jazeera, called the attack “a global wake-up call.” He noted that once a vulnerability is found in internet-connected equipment, attackers can log in remotely and trigger its features. The real concern, he warned, is what comes next.

“It could target energy infrastructure or hospitals,” Lachance said. The logic is straightforward: if a vulnerability in retail refrigeration controllers can be exploited at scale across multiple countries, similar flaws likely exist in other internet-connected industrial systems — many of which guard more sensitive infrastructure.

The maintenance-model problem

The root cause here is structural, not incidental. Modern refrigeration systems in large retailers are managed through centralized control panels that maintenance companies access remotely. These panels are, by design, internet-connected. They run on firmware that may not receive timely updates. They often operate on networks that were never built for external access.

Danfoss said it had warned customers about outdated firmware. But warnings do not equal enforced compliance. Many retailers — particularly smaller operators or those managing legacy equipment — likely continued running outdated systems because the cost and disruption of replacement were prohibitive.

That dynamic repeats across industrial IoT: vendors ship connected devices, some customers never patch them, and the vulnerability becomes a shared risk. The attack on French supermarkets is a symptom of a broader pattern — one that will recur until regulations or market incentives force otherwise.

What happens next

The immediate aftermath is already unfolding. Affected stores are throwing away spoiled stock. Some locations are back in operation. ANSSI is investigating. European authorities are coordinating. Danfoss is under pressure to explain.

But the longer-term trajectory matters more. This attack will accelerate demands for mandatory cybersecurity standards for industrial IoT devices, particularly those connected to critical supply chains. Regulators in the EU — which already has the Cyber Resilience Act in motion — may move faster to enforce firmware-update requirements and extend liability to vendors whose equipment lacks basic authentication controls.

Retailers will face a choice: invest heavily in segmenting and securing their connected equipment, or accept that their cold chain is as vulnerable as any other internet-facing system. The cost of inaction, measured in spoiled food, fires, and reputational damage, is already visible. The cost of future attacks on more critical infrastructure could be far higher.

Food security has always depended on logistics. This attack proves it now depends on cybersecurity, too.