Somebody turned the frozen-food aisle into an oven, and the French supermarket cyberattack is why. Overnight on October 11 into 12, hackers reached into the refrigeration systems of hundreds of French grocery stores and cranked the temperatures as high as 50°C, or 122°F, according to Reuters.
The result: spoiled food, and in some places, small fires. This was not a data breach. It was not a payment glitch either. Someone literally turned the freezers into ovens.
What we know about the French supermarket cyberattack
The Paris prosecutor’s office called it a “large-scale” attack affecting connected refrigerators at several major food retailers across France. The damage includes “food losses and fires.” Prosecutors opened the probe on their own initiative.
Meanwhile, Prime Minister Sébastien Lecornu has told the national cybersecurity agency, ANSSI, to investigate. The attack hit refrigeration controls only. The hackers did not touch payment terminals, and so far no one has reported any data theft.
The store counts are messy, so treat them with care. Les Mousquetaires, which owns Intermarché, said hackers hit about 150 of its stores and heated the fridges for six hours. As a result, the company threw away all the food. Carrefour said the attack affected 80 of its supermarkets, and Monoprix said it hit 5% of its roughly 490 French stores, per the South China Morning Post.
AFP, citing the retailers, reported higher numbers: at least 300 Intermarché and Netto stores, plus more than 100 Coopérative U outlets and several E. Leclerc locations. Nobody has reconciled those counts yet (the fridges, at least, have stopped negotiating).
Behind the supermarket hack: old software with no updates
Here’s the thing that should make every store manager, and every homeowner with a smart gadget, sit up. A person close to the prime minister’s office told reporters that ANSSI found “a vulnerability in software supplied by a Danish company.” Sources name Danfoss. That is not an official final finding, so keep it in that box for now.
Danfoss says most of the affected units are older products, notably its AK-SM800 and AK-SC355 systems. Those have reached end of life, so they get no software or security updates. The company also told Reuters it is “aware of incidents in France affecting a limited number of refrigeration management systems,” as Gizmodo reported.
That context matters. On September 18, Danfoss described a flaw that could let attackers read and write internal values and even download and run code. The company says it has long urged customers to keep systems updated and migrate off legacy gear.
Apparently, not everyone got the memo.
It is also a reminder that forgotten hardware is an easy target. The NSA recently made a similar point in its warning about rebooting home Wi-Fi routers.
Who pays for the grocery store cyberattack?
Dominique Schelcher, CEO of Coopérative U, called the attack “extremely serious and without precedent” and said it was “unacceptable.” Intermarché CEO Thierry Cotillard said losses will likely run into the tens of millions of euros. Intermarché also warned that insurance may not cover this type of incident.
So who eats the bill? Right now, nobody has a clean answer. Some fresh aisles may stay closed or only partly stocked for several days, according to the trade site Je Bosse en Grande Distribution, which put per-store losses at up to several hundred thousand euros.
What nobody knows about the refrigeration cyberattack yet
No one has claimed responsibility, and no one has confirmed a motive. Reports differ on the method, too: one outlet says hackers triggered forced defrosting, while Reuters says they simply raised temperatures. Officials have not yet detailed the cause or number of the fires.
Whether this spread beyond France is also unconfirmed. One security analyst at Sekoia suggested Spain, Portugal, Poland, Germany and Belgium may be affected. French authorities, however, say only that other countries “may” be at risk. I found no reporting on any US exposure.
France is coordinating with European counterparts, and the retail association has demanded “full transparency” from the software supplier. EU agriculture commissioner Christophe Hansen condemned the attack and said food security needs more attention, per CBS News. Elsewhere in tech, a rare wave of overlapping AI outages showed how fragile connected systems can be.
The scary part isn’t the lost groceries. It’s how little it took: forgotten, unpatched hardware sitting quietly in the back of a store.
So the next question is obvious: how many other “end of life” boxes are still humming away, waiting for someone to find them?
