French Supermarket Cyberattack Disrupts Refrigeration Systems at More Than 350 Stores

A cyberattack targeting refrigeration systems at hundreds of French supermarkets has prompted an investigation into unidentified hackers, raising concerns about the security of internet-connected equipment and the risks posed by outdated software. The incident resulted in significant food spoilage, while investigators have yet to identify a motive or receive any public claim of responsibility.

French Authorities Investigate Cyberattack on Supermarket Refrigerators

French investigators were searching Tuesday, October 13, for those responsible for a cyberattack that compromised refrigeration controls at more than 350 supermarkets across France.

The attack affected major grocery chains, including Carrefour, Monoprix, Intermarché and Coopérative U. Hackers reportedly gained control of connected refrigeration equipment and manually altered temperature settings, disrupting food storage operations.

At several Paris supermarkets, employees disposed of large quantities of spoiled meat and frozen products. Boxes of discarded food were seen outside stores as retailers assessed the damage and worked to restore normal operations.

Although the affected locations represent a relatively small percentage of France’s supermarkets, the incident highlights how vulnerabilities in connected infrastructure can create immediate financial and operational consequences.

Hackers Have Not Claimed Responsibility

Investigators have been unable to establish a clear motive for the attack.

According to a source familiar with the investigation, no hacking organization has publicly claimed responsibility, and authorities have not identified any ransom demand.

Cybercriminal groups frequently demand payment after compromising business systems, while politically motivated hackers often publicize their activities.

The absence of either response has complicated efforts to determine whether the incident involved organized cybercriminals, politically motivated attackers or individuals exploiting accessible security weaknesses.

Outdated Refrigeration Software Raises Cybersecurity Concerns

France’s national cybersecurity agency identified affected refrigeration systems using software developed by Danish manufacturer Danfoss, as well as products associated with Copeland and Dixell.

Danfoss said Monday that numerous affected devices were operating with obsolete software or had reached the end of their supported service life.

According to the company, some systems had “reached end of life and no longer receive software or security updates” or were “running outdated firmware.”

Danfoss said it had “advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions”.

The manufacturer declined to provide additional comments Tuesday.

Copeland, which owns Dixell, also acknowledged the “vulnerability” affecting its technology.

“We are currently working with impacted customers to mitigate the risk,” the company said, adding that it intended to strengthen cybersecurity protections.

Previously Identified Security Flaws May Have Increased Exposure

Cybersecurity researchers had previously documented serious weaknesses affecting older refrigeration control software.

On August 9, cybersecurity company Claroty published findings concerning vulnerabilities in the Danfoss AK-SM 800A controller.

Those weaknesses, which have since been patched, could potentially allow attackers to bypass authentication requirements and execute unauthorized code on compromised equipment.

However, investigators have not publicly confirmed whether the attackers exploited those specific vulnerabilities during the French supermarket incident.

Experts Point to Basic Cybersecurity Failures

Cybersecurity specialists said the attack appeared consistent with weaknesses caused by outdated firmware and refrigeration management interfaces exposed to the public internet.

Ken Munro, a partner at British cybersecurity consultancy Pen Test Partners, emphasized the importance of routine security maintenance.

“This is about basic cyber hygiene,” Munro said. “Get it wrong and you get a smelly mess of defrosted food.”

Munro suggested that the apparent simplicity of the intrusion meant the perpetrators could have been relatively inexperienced individuals rather than sophisticated criminal organizations.

He described the possibility as “kids messing around”.

“If this was a nation state, why affect only a subset of French fridges? There are plenty of other nations with fridges on the internet,” he said. “No ransom or demand suggests a lack of appreciation of the potential commercial losses that the fridge owners may experience.”

His assessment underscores the difficulty of attributing cyberattacks when perpetrators leave no clear financial or political demands.

Thousands of Refrigeration Interfaces Remain Accessible Online

The potential security exposure extends beyond the supermarkets directly affected.

Using Shodan, an internet-connected device search platform, Reuters identified at least 4,500 Danfoss interfaces that remained publicly visible Tuesday.

Reuters could not independently determine how many of those systems were operating vulnerable software.

However, French internet security monitoring company Onyphe reported that only a small minority appeared to be running the latest software versions.

Outdated systems were “still widely represented among publicly accessible interfaces”, the company said.

The findings suggest that similar weaknesses may remain present in commercial refrigeration equipment connected to the internet.

Separate Cybersecurity Incident Disrupts Dutch Retailer Ahold Delhaize

Meanwhile, Dutch grocery company Ahold Delhaize was addressing a separate cybersecurity incident that began Sunday evening.

The company announced Tuesday that it was “starting a controlled re-launch of certain systems” following disruptions to its digital operations.

The Netherlands’ National Cyber Security Centre said it did not believe the incident was connected to the attacks against French supermarkets.

Ahold Delhaize operates the Albert Heijn supermarket chain in the Netherlands and major U.S. grocery businesses, including Stop & Shop and Giant Food.

Websites serving customers in both countries remained unavailable late Tuesday afternoon, disrupting online grocery ordering and delivery services.

Cyberattack Highlights Risks to Connected Retail Infrastructure

The French supermarket attack demonstrates how cybersecurity weaknesses in everyday commercial equipment can disrupt essential retail operations and result in substantial product losses.

While investigators continue searching for those responsible, the incident has renewed attention on software maintenance, security updates and the protection of internet-connected industrial systems.

For supermarket operators and other businesses relying on connected equipment, the disruption highlights the operational importance of maintaining supported technology and limiting unnecessary exposure to external networks.