Hackers remotely overrode temperature controls on thousands of supermarket freezers across France, pushing them from as low as minus 27 degrees Celsius to over 50 degrees Celsius in what one executive called an "unprecedented" attack. The sabotage defrosted and cooked food inside chiller cabinets at up to 700 stores, including outlets of Intermarché, Carrefour, Leclerc, Coopérative U and Monoprix chains, over four to six hours starting shortly before midnight on a Sunday. Staff discovered tons of spoiled food the next morning. One Intermarché worker in southwest Paris reported freezers pushed to 62 degrees Celsius, forcing complete disposal of stock and restocking that lasted until nearly midnight Monday. Some stores experienced fires and water damage from the extreme heat.
The Paris public prosecutor opened an investigation. The hackers compromised controllers supplied by Danish company Danfoss by disabling alarm systems before tampering with thermostats or extending defrost cycles to avoid triggering alerts. France's cyber-attack alert centre ANSSI confirmed that refrigeration units from two additional manufacturers were also targeted.
Gérôme Billois, a partner at cybersecurity firm Wavestone, said the attack bore hallmarks of state sabotage. "The two most feasible scenarios are either a group of youngsters or activists who wanted to blow up a few freezers to prove what they could do, or it was a destabilising attack by internal or external state actors," Billois told the source. He identified Iran and Russia as "two international actors known for doing this sort of thing."
Danfoss stated it had identified security flaws last year and "long recommended" customers install updates or replace outdated systems. The affected units ran "outdated firmware". Cybersecurity researcher Marta Rybczyńska found many freezers operated on default passwords and had not been manufacturer-supported for years, creating vulnerabilities hackers exploited.
The incident mirrors a US military commissary breach in August involving similar refrigeration attacks. France ranks as Europe's most hacked country by volume of exposed records, having suffered breaches at its health system, France Travail employment agency, and tax authorities in recent years. Billois said France has not adopted the EU's Cyber Resilience Act (2024) mandating security standards for internet-connected devices, leaving gaps in industrial infrastructure protection.