A cyberattack heated French supermarket chillers to 50°C
The overnight attack affected connected refrigeration infrastructure at Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E. Leclerc. The attackers did not target customer or financial records, according to the account, but accessed digital controls used to manage commercial cooling systems. Forced defrost cycles kept some equipment at elevated temperatures for as long as six hours.
Staff removed large quantities of pasteurised milk, cream, butter, yoghurt, soft cheese and other chilled goods, as well as meat, seafood and frozen products. Some equipment reportedly caught fire. Refrigerated aisles were cleared and affected goods were discarded rather than returned to sale.
Dairy products are generally stored within a range of 2°C to 4°C. The breach therefore affected products subject to regulated cold-chain requirements, including cultured goods and fresh dairy. The source said that European Union food-hygiene rules require inventory write-offs when the integrity of the cold chain is compromised, including after short-term temperature excursions.
French authorities and the national cybersecurity agency, ANSSI, identified vulnerabilities in Danfoss refrigeration-management controllers during preliminary investigations, according to the report. The systems included legacy AK-SM 800 units whose manufacturer support ended in 2021, alongside AK-SM 800A units running older firmware. The attackers obtained administrative access through unsecured network gateways and changed temperature safeguards.
Thierry Cotillard, head of Les Mousquetaires, said losses across France could reach tens of millions of euros in one day. The estimate includes destroyed stock, emergency servicing and lost sales. Supermarkets also placed urgent orders with dairy processors and farmer-owned co-operatives, including Lactalis, Sodiaal, Savencia and Danone, to replenish empty cabinets.
The incident has also raised potential disputes between retailers and outside refrigeration-maintenance companies over cybersecurity obligations, liability and business-interruption insurance. Sekoia, a threat-intelligence company, reported attempts to target similar systems in Spain, Portugal, Poland, Germany and Belgium. The report said the affected refrigeration networks rely on internet-connected building-management controllers that allow contractors and remote technicians to monitor cooling cycles, adjust compressor speeds and record temperatures.
