A cyberattack on supermarket refrigeration systems in France has shown how seemingly mundane connected equipment can become a physical infrastructure risk, after attackers remotely changed cooling settings across hundreds of stores and forced retailers to discard food.
The attack affected major French chains including Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc, with compromised refrigeration controllers causing temperatures in some units to rise as high as 50°C. Fires were also reported alongside widespread food spoilage.
Intermarché said around 150 stores were affected, while Coopérative U chief Dominique Schelcher later said 80 of the group’s roughly 2,000 stores were hit. He estimated losses of several tens of thousands of euros at smaller stores and as much as €200,000 at larger hypermarkets.
Attackers targeted the systems controlling the cold chain
The incident appears to have centered on refrigeration controllers made by Danish industrial technology company Danfoss.
France’s national cyber incident response team, CERT-FR, said it was aware of numerous compromises involving Danfoss AK-SM and AK-SC systems. Its October 12 alert warned that exposing the equipment’s management interface directly to the internet is contrary to good security practice.
BleepingComputer reported that attackers took control of refrigeration systems running older versions of Danfoss control software and triggered automatic defrost functions, increasing temperatures instead of maintaining normal cooling. Estimates cited by the publication put the number of affected stores across chains at roughly 250 to 350.
The differing totals reflect reports from multiple retailers as companies continued assessing the incident.
Recovery requires more than changing a password
CERT-FR’s response guidance illustrates how complicated recovery can become when cyberattacks reach operational technology.
The agency recommends that affected organizations disconnect or filter access to AK-SM and AK-SC systems. Where compromise is suspected, operators are advised to factory-reset equipment, apply available security updates, rotate credentials, inspect existing accounts and reconfigure the device.
That is significantly different from restoring a hacked website. Refrigeration equipment must keep functioning while investigators secure the systems controlling it.
French authorities, including the Paris prosecutor’s office and national cybersecurity agency ANSSI, are investigating the attack. Reuters reported that total industry losses could reach tens of millions of euros.
Everyday infrastructure is becoming cyber-physical infrastructure
The attack is a reminder that digital transformation has quietly connected equipment far beyond laptops and servers.
Supermarket refrigeration, building management, warehouses, factories and energy systems increasingly depend on remotely manageable controllers. That improves maintenance and efficiency, but it also creates pathways through which a cyberattack can produce physical consequences.
Here, the output of the attack was not simply inaccessible data. It was spoiled food, damaged equipment, closed aisles and potentially hundreds of thousands of euros in losses at individual stores.
For engineers and infrastructure operators, the lesson is increasingly difficult to ignore: anything connected to the internet eventually becomes part of the cybersecurity perimeter—even a supermarket freezer.
