French Supermarket Freezers Hacked to 80C, Spoiling Food and Sparking Fires

Key points

• Attackers remotely manipulated Danfoss and other controllers, overriding temperature settings and disabling alarms for up to six hours.
• The incident affected major chains including Intermarché, Carrefour, and Leclerc, as well as independent stores across France and parts of Europe.
• Some freezers reached 80C, causing food to cook and triggering sprinkler systems that led to water damage and fires.
• Security flaws included outdated firmware, default passwords, and lack of network segmentation, allowing attackers to bypass standard alerts.
• French prosecutors have opened an investigation, but attribution remains uncertain due to the attackers' ability to hide their digital footprint.

Background

This incident follows a similar August 2026 attack on US military commissaries and aligns with a broader trend of cybercriminals targeting physical building automation systems. France has been the most targeted country in Europe for cyberattacks in recent years, with breaches affecting its health system, job agencies, and finance ministry. The attack underscores the risks of connecting legacy industrial equipment to the internet for compliance without adequate security measures.

How outlets are covering it

The Guardian emphasizes the 'unprecedented' nature of the attack and the potential for state-sponsored sabotage by actors like Iran or Russia, aiming to instill fear. Ars Technica focuses on the technical failures, noting that basic cybersecurity practices like VPNs and IP allowlists would have prevented the breach, and highlights that similar vulnerabilities exist in controllers from Copeland and Dixell. The Register frames the incident as part of a growing trend of ransomware groups targeting operational technology (OT) systems to cause physical damage and extort victims, noting that AI is making it easier for attackers to exploit obscure industrial protocols. While The Guardian and The Register suggest potential state or sophisticated criminal motives, Ars Technica and security experts like Matt Hayden argue that the attack was likely opportunistic, targeting unpatched systems with no sensitive data, rather than a high-level nation-state operation.

Why it matters

The attack exposes critical vulnerabilities in the food supply chain, where internet-connected devices for regulatory compliance create significant security risks. It highlights the need for stricter cybersecurity standards for industrial and operational technology, as current regulations like the EU’s Cyber Resilience Act are not yet fully implemented. The incident serves as a wake-up call for businesses to secure connected devices, as the potential for physical disruption and financial loss is substantial.

What to watch

French authorities are investigating the attack, but identifying the perpetrators may take weeks or months. Supermarket chains are likely to face increased scrutiny and pressure to upgrade their security infrastructure. The incident may accelerate the adoption of cybersecurity regulations for connected devices and prompt a broader review of industrial security practices across Europe.