700 supermarkets hit, millions lost: France warns refrigeration cyberattacks may persist

Remote attackers seized control of refrigeration equipment at supermarkets and independent stores across France early Monday. The systems regulate temperatures in refrigerators and freezers. When that control was lost, food storage became unsafe. The incident matters because a cyberattack on ordinary store equipment caused major waste and disrupted food retailing.

Temperatures reportedly rose to 50 degrees Celsius for around six hours. Retailers discarded fresh and frozen products before beginning to restock. The Intermarché chain reported losses of tens of millions of euros in one day. Around 700 of France's 10,000 supermarkets were affected, according to Finance Minister Roland Lescure.

France's cybersecurity agency said the attacks were likely still underway on Tuesday night. It urged retailers to use secure VPN connections or protected networks, install firmware updates, and change passwords. Investigators have not identified a perpetrator or publicly explained precisely how the attackers gained control.

A connected refrigeration system is refrigeration equipment linked to digital controllers and a network. It can monitor or manage temperatures without someone standing beside every refrigerator. Supermarkets use such systems across stores, warehouses, and other facilities. Connectivity can make operations easier, but it also creates a pathway that must be secured.

The article identifies remote-control modules made by Danfoss and Copeland. Platforms such as Danfoss AK-SM 800A and Copeland XWeb Pro manage refrigeration infrastructure. A controller may communicate through the internet or a protected network. Someone with legitimate access can adjust settings remotely; an attacker who reaches the controller and exploits a weakness may gain similar control.

Claroty found some Danfoss controllers directly accessible through the public internet. The French authority urged stores to reconnect systems only through secure VPNs or protected networks. It also recommended firmware updates and password changes. The precise method used in France remains undisclosed.

The disruption was substantial but did not affect every French supermarket. Finance Minister Roland Lescure said around 700 of the country's 10,000 supermarkets were affected. The attack also reached independent stores, showing that the incident extended beyond one national chain or a single retail group.

The financial damage was immediate. Refrigeration temperatures reportedly climbed to 50 degrees Celsius for around six hours, forcing retailers to discard fresh and frozen products. Intermarché reported losses of tens of millions of euros in a single day. Stores then had to restock goods while dealing with damaged equipment and ongoing security concerns.

The figures describe the known scale, not a final total. France's cybersecurity agency warned that attacks were likely still underway on Tuesday night. Authorities had not identified perpetrators, and the precise method remained undisclosed. The incident also raised wider concerns about connected equipment and food supply chains.

Fresh and frozen food depends on controlled cold temperatures. Refrigerators slow spoilage, while freezers keep products frozen. When attackers changed or disrupted the refrigeration settings, that protection failed. Food exposed to excessive heat can no longer be treated as safely preserved, so retailers discarded it rather than sell it.

In the French incidents, temperatures reportedly reached 50 degrees Celsius for around six hours. That surge affected refrigerators and freezers at supermarkets and independent stores. Retailers disposed of fresh and frozen products, then began restocking. Intermarché said the losses from one day reached tens of millions of euros.

The waste was a direct physical consequence of a digital attack. France's cybersecurity agency said the attacks were likely still underway and urged stores to secure systems before reconnecting them. The event showed how connected refrigeration equipment can affect food supplies, not just computer networks, when its controls are compromised.

Older refrigeration controllers can become more vulnerable when manufacturers stop providing software and security updates. Known weaknesses may remain unfixed, while the equipment continues operating in stores. The risk increases when controllers are directly exposed to the public internet or protected by weak passwords and other inadequate security practices.

Danfoss said many affected systems were older products without ongoing software or security updates. Copeland identified a vulnerability in a discontinued, end-of-life generation of controllers. Claroty had reported vulnerabilities in Danfoss AK-SM 800A and Copeland XWeb Pro platforms, which manage refrigeration infrastructure. Some Danfoss interfaces were visible online.

The vulnerabilities in Claroty's report have since been fixed, but a Shodan scan still found at least 4,500 Danfoss interfaces visible online on Tuesday. It was not independently established how many used vulnerable software. Experts described the incident as a basic cyber-hygiene failure, while investigators have not disclosed the exact attack method.

Supermarkets can reduce risk by limiting who and what can reach refrigeration equipment. France's cybersecurity agency advised retailers to reconnect systems only through secure virtual private networks or protected networks. This helps keep remote access controlled rather than leaving equipment openly reachable from the internet.

The agency also recommended installing firmware updates and changing passwords. Updates can address known security weaknesses, while new passwords reduce the danger of reused or compromised credentials. The article also points to a longer-term measure: replacing or upgrading older products that no longer receive software or security updates.

These protections matter because connected controllers manage physical conditions, not just digital records. Claroty found some Danfoss controllers directly accessible online, and Shodan found at least 4,500 Danfoss interfaces visible on Tuesday. The vulnerabilities in its report have since been fixed, but the French authority said attacks might still be underway.

The supermarket industry's just-in-time model depends on constant digital coordination. Stores receive frequent deliveries instead of holding large supplies for long periods. Information technology helps them order products, manage supplies, and coordinate deliveries. Electricity supports the systems and the wider store operations needed to receive and sell goods.

The Dutch incident showed this dependence clearly. Albert Heijn's online services and home deliveries were disrupted after its parent company, Ahold Delhaize, shut down systems as a precaution. Some supplies to its Dutch stores were also affected. Pieter Zwaan said Dutch supermarkets relied on deliveries several times a day to keep shelves stocked.

Zwaan said ordering and delivering products that frequently is impossible without IT and electricity. The disruption therefore reached beyond computers: it affected shelves, deliveries, and restocking. The Dutch National Cybersecurity Centre reported several incidents in Europe's food sector but said there was no reason to believe they were linked at that time.