Hackers spoiled tonnes of food at 700 French supermarkets by hijacking internet-connected freezers

Supermarket workers arriving for early shifts this week found pools of water beneath freezers and ruined produce throughout their stores. Hackers had remotely seized control of refrigeration systems at around 700 food retailers across France, switched on forced defrost cycles, and removed the temperature limits that normally prevent units from overheating — sending display cabinets to 50 degrees Celsius (122°F) for roughly six hours. In some stores, the heat was enough to start fires or melt equipment.

The attack was initially associated with Danish manufacturer Danfoss, but France's national cybersecurity agency ANSSI has since confirmed that controllers from at least three companies were compromised: Danfoss, US-based Copeland, and Dixell — which Copeland owns. Prosecutors in Paris have launched a national-jurisdiction inquiry into what they described as a 'large-scale cyberattack affecting the connected refrigerators of several major food retailers across France,' with investigators tasked with drawing connections between the attacks and reported harm such as food spoilage and fires.

Large-scale cyberattack affecting the connected refrigerators of several major food retailers across France.— Paris prosecutors' office, statement

The chains hit include some of France's largest grocery groups. At least 300 Intermarché and Netto stores were affected, along with around 80 Carrefour supermarkets, more than 100 Coopérative U stores, roughly 150 shops belonging to retail group Les Mousquetaires, and approximately 5 percent of Monoprix's 490 locations. E.Leclerc was also among those targeted. Retailers warned that losses could run into the millions of euros.

The technical entry point was a feature built into the refrigeration systems themselves: controllers that allow maintenance firms to adjust temperatures remotely over the internet. According to Félix Aimé, principal threat researcher at French cybersecurity firm Sekoia, more than 1,700 instances of the affected Danfoss software were publicly accessible on the internet in France alone before the attack took place. In August, the cybersecurity company Claroty had already published a report identifying a vulnerability in the Danfoss AK-SM 800A controllers — a mechanism that 'could be abused' to 'bypass normal authentication' and allow an attacker to remotely change temperature settings.

It wasn't hard to work out how to take control of the fridges.— Ken Munro, partner, Pen Test Partners

Munro, a UK-based cybersecurity analyst, told CNN that the Danish firm or the fridge installers may have erroneously placed the controllers on the public internet 'for anyone to see,' and that unit management at these retailers was likely 'outsourced to a third party who gave little to no thought to maintaining the security of these fridges.' Shortly after the attack, Danfoss acknowledged that many of the affected units were either no longer receiving software or security updates or were running outdated software, and the company urged customers to keep supported systems current. In a separate statement, Copeland said it had identified a vulnerability in a discontinued, end-of-life generation of controllers and was working alongside affected customers to reduce the risk.

Crucially, investigators say the perpetrators do not appear to have deployed any malicious code on the fridge controllers — a detail that may complicate efforts to identify who carried out the attack. No group or individual has claimed responsibility, and no ransom demand has been made publicly.

The hackers' motivation is unknown at this stage. To our knowledge, no public claim of responsibility has been made.— Félix Aimé, principal threat researcher, Sekoia

Aimé, who previously worked at ANSSI, told CNN that the possibility of a lone hacker or hacktivist group cannot be ruled out, and that 'an operation intended to destabilize certain economic activities, or infrastructure could also be considered.' Munro suggested the primary aim may have been to cause 'mischief' or 'unsettle the public,' given the absence of a ransom demand.

The damage does not appear confined to France. Aimé told Reuters that the attacks had also touched Spain, Portugal, Poland, Germany, and Belgium, while French officials indicated they were in contact with their counterparts in other European countries. Alerts covering the affected Danfoss and Dixell/Copeland systems have been issued by ANSSI and CERT-FR, which advised businesses operating the relevant freezer models to cut those units off from the internet immediately — or at minimum restrict access — and to carry out software updates.

There was no business need for the fridge controllers to be accessible on the public internet. What I do recommend is that the boards of businesses ask probing questions of their suppliers. Who outsourced the management of these fridges and who had contractual oversight for their security? It doesn't take much for one blind spot in a business to lead to tonnes of trashed food.— Ken Munro, partner, Pen Test Partners

In an address to lawmakers on Tuesday, France's Economy Minister Roland Lescure called the incident a 'wake-up call for everyone.' The attack comes weeks after President Emmanuel Macron ordered that the country's critical infrastructure be protected from what he described as Russian 'hybrid attacks,' though no link to any state actor has been established in this case.

The French attack is the latest in a series of cyberattacks on food retailers. In April 2025, British retailer Marks and Spencer suffered a ransomware attack that cost it approximately 300 million pounds ($397 million), according to Al Jazeera. In June 2025, US food distributor United Natural Foods — which supplies Whole Foods — disclosed a cyberattack that forced it to take systems offline. A cyberattack reported by Ahold Delhaize USA in November 2024 disrupted operations across more than 2,000 stores, among them Hannaford, Food Lion, and Stop and Shop.

This should come as a global wake-up call … Throughout society, we have connected infrastructure that is live on the internet, and that can be hacked. It's a new reality, and we absolutely need national and international measures to prevent those attacks; otherwise, it's just going to keep happening.— Steven Lachance, tech and cybersecurity analyst

Why it matters — The attack shows that internet-connected industrial equipment — running on unpatched, end-of-life software and exposed directly to the public internet — can be weaponised at scale to destroy food supplies and cause physical damage, with no malware required and no attacker yet identified.

Sources differ on Number of Coopérative U stores affected: More than 100 (aljazeera.com) vs About 80 (cnn.com)

Reported by cybernews.com, aljazeera.com, cnn.com, infosecurity-magazine.com