Hackers seized control of refrigeration systems at at least 500 supermarkets across France, manipulating fridge temperatures and forcing retailers to discard spoiled meat and frozen products, as investigators searched for those responsible for the cyberattack on October 13.
The incident, which affected major supermarket chains including Carrefour, Monoprix, Intermarche and Cooperative U, has exposed vulnerabilities in internet-connected refrigeration equipment and raised concerns about outdated software and inadequate cybersecurity measures. No group has claimed responsibility, and investigators remain puzzled by the absence of a ransom demand or political declaration.
The attack affected a relatively small proportion of France’s supermarket network but demonstrated how vulnerable connected commercial infrastructure can cause immediate economic damage.
Staff at several supermarkets in Paris were forced to throw boxes of perished meat and defrosted frozen goods into large waste containers. Cybersecurity experts told Reuters that the attack appeared relatively straightforward to execute, potentially exploiting known weaknesses in refrigeration systems that had not received necessary security updates.
Outdated software leaves refrigeration systems vulnerable
France’s cybersecurity agency identified refrigeration units using software developed by Danish company Danfoss, alongside equipment running software from Copeland and its subsidiary Dixell, among the systems affected by the breach.
Danfoss said on October 12 that many affected units had reached the end of their service life and no longer received software or security updates, while others were operating with outdated firmware. Rather than addressing its responsibility for protecting customers relying on its systems, the company shifted the focus to customers’ use of ageing equipment, advising them to update supported systems and replace legacy units with newer alternatives. Danfoss declined further comment on October 13.
Copeland acknowledged the vulnerability and said it was working with affected customers to mitigate the risks. The company also pledged to strengthen its cybersecurity measures.
The security weaknesses in older Danfoss firmware had been identified months before the incident. On August 9, cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A controller that could allow intruders to bypass authentication and execute code on compromised devices. Those vulnerabilities have since been patched.
The investigators have not publicly disclosed the precise method used to compromise the refrigeration systems. The absence of a ransom demand or public claim of responsibility has complicated the investigation.
The security exposure extends beyond the affected supermarkets. Using the internet-scanning service Shodan, Media reports identified at least 4,500 Danfoss interfaces that remained accessible online on October 13. French scanning company Onyphe said only a small minority appeared to be using the latest version, while outdated and vulnerable versions remained widely represented among publicly accessible interfaces.
Separate Dutch cyber incident disrupts online services
The French supermarket attack coincided with a separate cybersecurity incident affecting Dutch retail giant Ahold Delhaize, although authorities have found no evidence linking the two events.
On October 13, the company said it had begun a controlled relaunch of certain systems following a cybersecurity issue that started on the evening of October 11. Websites serving customers in the Netherlands and the United States remained offline late on October 13, leaving online ordering and delivery services unavailable.
Ahold Delhaize operates the Albert Heijn supermarket chain in the Netherlands and several major American grocery chains, including Stop & Shop and Giant Food. The Dutch National Cyber Security Centre (NCSC) said it did not believe the incident was connected to the French supermarket hack.
The two incidents highlight the cybersecurity risks confronting retailers as their operations increasingly depend on interconnected digital infrastructure. Refrigeration systems, inventory platforms and online services can become vulnerable points when security updates are neglected, or internet-facing devices are inadequately protected.
French investigators continue to search for the attackers, whose identities, motives and precise methods remain unknown. The discovery of thousands of accessible refrigeration interfaces underscores the need for retailers to maintain updated software, secure connected equipment and replace unsupported systems before vulnerabilities can be exploited.
