Photo via hindustantimes.com
Hackers heat French supermarket fridges to 50°C, sparking fires
An overnight cyberattack forced refrigeration at hundreds of stores across multiple chains to defrost, destroying millions in food and prompting national investigation.
What happened
Hackers remotely defrosted refrigeration systems at hundreds of French supermarkets overnight on October 11-12, forcing temperatures in display cases and freezers to reach 50 degrees Celsius for approximately six hours. The attack targeted Danfoss refrigeration controllers at multiple major retail chains including Intermarché (around 150-300 stores), Coopérative U (nearly 100 stores), Carrefour (80 stores), and smaller numbers at Monoprix and E. Leclerc. Stores were forced to discard all fresh and frozen inventory, with fires reported at some locations. Intermarché CEO Thierry Cotillard estimated losses at tens of millions of euros nationwide in a single day.
The attackers remotely triggered the systems' built-in defrost cycles, which normally run periodically to prevent ice buildup but were held continuously at elevated temperature. ANSSI, France's National Cybersecurity Agency, has identified a vulnerability in Danfoss software, though the specific flaw used remains unclear. Research published in August 2026 by Claroty's Team82 revealed multiple vulnerabilities in Danfoss AK-SM 800A controllers, including a hidden authentication bypass using a daily-generated password. Danfoss later released firmware patches, but affected units were running outdated versions no longer receiving security updates.
Prime Minister Sébastien Lecornu instructed ANSSI to investigate and France is coordinating with European counterparts. A Sekoia Threat Detection analyst reported the attack also affected stores in Spain, Portugal, Poland, Germany, and Belgium, though effects outside France varied. Separate incidents in the Netherlands disrupted Albert Heijn, Etos, and Gall & Gall websites and electronic shelf labels, with unclear connection to the French attack.
The Paris prosecutor's office opened a formal investigation into the "large-scale cyberattack." Neither attackers nor attack vector have been identified. The incident underscores the vulnerability of internet-connected refrigeration infrastructure managing critical food supply across Europe.
Chanakya's Move
The attacker's gambit appears to be either operational disruption of European food supply (testing a vulnerability for future campaigns) or economic sabotage targeting retail margins. By hitting multiple competitors simultaneously with the same vector, the attacker demonstrated either sophisticated supply-chain knowledge or access to a shared Danfoss management platform. The choice to trigger defrost rather than shut down systems entirely—forcing visible destruction rather than mere outage—suggests intent to maximize economic damage and public attention. France's rapid investigation focus on Danfoss suggests suspicion of either a shared vulnerability or compromised vendor access. The geographic spread (Spain, Poland, Germany, Belgium) indicates this was not a single-chain incident but a coordinated strike on infrastructure. Counter-move: retailers and governments will likely mandate immediate firmware upgrades and network segmentation of refrigeration controllers, reducing attacker access but creating short-term operational friction. Attribution remains critical—if state-sponsored, this escalates critical infrastructure targeting into new territory.