Hackers Remotely Access Supermarket Fridges, Raise Temperatures

Key Takeaways

• A cyberattack targeting industrial control systems caused refrigeration units in French supermarkets to dangerously raise temperatures.
• The incident, which occurred between October 11 and 12, affected stores under Intermarché, E.Leclerc, and Système U banners.
• Attackers reportedly manipulated Danfoss-made refrigeration controls, leading to continuous defrost cycles and temperatures as high as 50°C.
• Hundreds of thousands of euros in fresh and frozen food were rendered unsafe and had to be discarded.
• The incident highlights the critical need for robust cybersecurity in operational technology (OT) environments, especially for internet-connected industrial controls.

Cyberattack Turns Supermarket Fridges into Heaters, Causing Widespread Food Spoilage

French supermarket chains are grappling with the aftermath of a significant cybersecurity incident that saw attackers remotely manipulate refrigeration systems, causing chilled display cases and freezers to heat up rather than cool down. This unprecedented breach led to extensive spoilage of temperature-sensitive products across numerous locations.

The incident unfolded overnight between October 11 and October 12, impacting a number of stores associated with major retail groups including Intermarché, E.Leclerc, and Système U, according to initial reports.

Targeted Refrigeration Systems and Impact

It is believed that the cyberattack specifically targeted refrigeration-control systems manufactured by the Danish industrial technology firm Danfoss. These specialized systems are responsible for managing all cooling equipment within supermarkets, encompassing everything from freezers and chilled food displays to compressors and critical temperature alert mechanisms. In the affected stores, reports indicate that the attackers altered settings to initiate continuous defrosting cycles and, in some instances, pushed temperatures to an alarming 50°C.

This malicious manipulation meant that refrigeration units, designed to preserve food at cold temperatures, functioned as heaters for several hours. The consequence was severe: fresh produce, dairy products, meats, frozen goods, and other perishable items likely became unsafe for consumption and sale.

Stores were compelled to conduct thorough inspections of their entire inventory, subsequently discarding any food products that no longer met stringent food-safety standards. Reports indicate that some individual stores could face financial losses amounting to hundreds of thousands of euros, with approximately 150 Intermarché locations reportedly affected by the compromise.

The Vulnerability of Operational Technology

This incident vividly demonstrates how a cyberattack can swiftly escalate from a digital intrusion to a profound physical and financial crisis. Supermarkets rely on uninterrupted refrigeration for their entire operation. Even a brief disruption can result in damaged stock, supply chain interruptions, serious food-safety hazards, and a significant erosion of consumer trust.

Reports indicate that the attackers may have exploited a built-in defrost feature within the refrigeration-management software. While defrosting is a routine process designed to remove ice buildup from cooling equipment, continuous activation or configuration with unsafe parameters prevents the equipment from maintaining the essential low temperatures required for food preservation.

Dominique Schelcher, the chief executive of Coopérative U, officially confirmed that cybercriminal activity had impacted refrigeration production systems across several stores within his group’s network. He stated that teams were actively collaborating with refrigeration specialists to restore full operational capacity and that a comprehensive investigation would be launched to ascertain the precise circumstances of the incident.

Initial reports hint at the potential involvement of older software versions. However, the exact method of intrusion, the identity of the perpetrators, and whether a previously known vulnerability was exploited remain unconfirmed publicly. It is crucial to distinguish that the mere presence of legacy software does not definitively prove it was the specific avenue of compromise.

This event also brings renewed attention to the security challenges inherent in connected refrigeration equipment. Commercial cooling controllers are classified as operational technology (OT). Unlike standard office computing systems, OT directly governs real-world physical equipment, including industrial cooling units, pumps, manufacturing machinery, and building environmental controls.

HackersRadar previously highlighted 23 vulnerabilities discovered in Copeland XWEB Pro refrigeration controllers, which are widely deployed in supermarkets, warehouses, and hospitals. Researchers demonstrated that compromised controllers could falsify temperature readings or silently disable cooling equipment. While that research focused on Copeland products and not the Danfoss systems implicated in the French incident, it powerfully illustrates the tangible real-world consequences of inadequately secured refrigeration controls.

Danfoss refrigeration products have also been the subject of security advisories. CISA advisories have previously detailed flaws affecting Danfoss AK-SM 8xxA controllers, including authentication weaknesses, command-injection risks, and issues related to settings control in older software versions. Danfoss has released updates for the affected software releases, and organizations are urged to ensure their equipment is running supported and patched versions.

What You Should Do

• Review Internet-Connected Controllers: Immediately audit all internet-connected refrigeration controllers, remote-access pathways, vendor accounts, and third-party maintenance connections.
• Secure Remote Access: Ensure that OT systems are not directly exposed to the public internet. Implement secure remote access mechanisms such as Virtual Private Networks (VPNs) with multi-factor authentication (MFA) and strict access controls.
• Network Segmentation: Isolate refrigeration networks from point-of-sale (POS), corporate, and guest Wi-Fi networks to prevent lateral movement in the event of a breach.
• Implement Alerting: Configure immediate alerts for both IT and facilities teams for any unusual activities, including drastic temperature changes, repeated defrost commands, unauthorized configuration edits, or suspicious remote logins.
• Patch and Update: Confirm that all refrigeration control systems are running the latest supported software versions and have all relevant security patches applied.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.