Supermarket Refrigeration Systems Hacked, Causing Widespread Food Spoilage
Attackers compromised Danfoss refrigeration control systems in French supermarkets, raising temperatures to 50°C and leading to significant food spoilage.
French supermarket chains are grappling with a significant cybersecurity incident after attackers remotely manipulated refrigeration control systems, causing chilled cabinets and freezers to heat up instead of cool down. The attack, which reportedly began overnight between October 11 and October 12, affected stores belonging to major retailers such as Intermarché, E.Leclerc, and Système U. Early reports indicate that the compromised systems were manufactured by the Danish industrial technology company Danfoss, which are critical for maintaining the cold chain in supermarkets.
In the affected locations, cybercriminals allegedly altered the settings of the Danfoss refrigeration units to initiate continuous defrost cycles and set temperatures as high as 50°C. This effectively turned cooling equipment into heating units for several hours, rendering a wide range of temperature-sensitive products, including fresh produce, dairy, meat, and frozen goods, unsafe for sale. Stores were compelled to conduct extensive stock inspections and discard potentially compromised food items, leading to substantial financial losses, with some locations anticipating losses in the hundreds of thousands of euros.
The incident underscores the tangible physical and financial consequences that can arise from cyberattacks targeting operational technology (OT). Supermarkets rely heavily on uninterrupted refrigeration to preserve inventory and ensure food safety. Even brief disruptions can result in significant stock damage, disrupt supply chains, raise public health concerns, and erode customer trust. The attack may have exploited a built-in defrost feature within the refrigeration management software, a normal function that, when maliciously manipulated, can prevent the maintenance of necessary low temperatures.
Dominique Schelcher, CEO of Coopérative U, confirmed the cybercriminal activity impacting refrigeration systems across several of the group's stores. He stated that teams were working with refrigeration specialists to restore normal operations and that a thorough investigation would be launched to determine the attack's origin and methodology. Initial indications suggest that older software versions of the Danfoss systems might be involved, though the precise intrusion vector, the identity of the threat actors, and whether a known vulnerability was exploited remain unconfirmed.
This event brings renewed attention to the security risks associated with connected refrigeration equipment. These commercial cooling controllers are classified as OT systems, which directly manage physical machinery. While the specific Danfoss systems were targeted in France, previous research has highlighted similar risks in other refrigeration control systems. For instance, vulnerabilities were previously identified in Copeland XWEB Pro controllers, demonstrating how compromised units could silently disable cooling or falsify temperature readings.
Danfoss itself has previously faced security advisories concerning its controllers, including flaws related to authentication, command injection, and settings control in older software versions. The company has released updates for affected software, and users are strongly advised to ensure their equipment is running supported and patched versions. Retailers employing remotely managed refrigeration systems are urged to conduct a comprehensive review of all internet-connected controllers, remote access pathways, vendor accounts, and third-party maintenance connections.
To mitigate such risks, best practices include preventing direct exposure of OT systems to the public internet, utilizing VPNs with multi-factor authentication for remote access, and implementing strict account controls. Network segmentation is also crucial, separating refrigeration control networks from point-of-sale, corporate, and guest Wi-Fi networks. Furthermore, IT and facilities teams should establish immediate alerts for unusual activities such as unexpected temperature changes, repeated defrost commands, unauthorized configuration edits, and suspicious remote login attempts.
While the full scope and impact of the supermarket refrigeration attack are still being assessed, its implications are clear: cyberattacks on systems controlling physical infrastructure can lead to severe real-world damage. In this instance, a software manipulation reportedly transformed essential cooling systems into a costly source of widespread food waste across numerous French retail locations.
The cyber-attack impacting French supermarket chains, including Cooperative U, has been further detailed, with reports suggesting the attackers targeted outdated versions of refrigeration control software from Danish provider Danfoss. Hackers allegedly triggered forced defrost cycles, causing temperatures to rise as high as 50°C and leading to significant food spoilage. Two supermarkets alone reported losses of €270,000 worth of merchandise, and an estimated 150 Intermarché stores may be affected.