French investigators are trying to identify the hackers who remotely interfered with refrigeration systems at hundreds of supermarkets, forcing stores to discard spoiled food and exposing a basic security weakness in internet-connected equipment.
At least 350 supermarkets were affected, including stores operated by Carrefour, Monoprix, Intermarché and Coopérative U. The attackers manually changed refrigeration temperatures, but investigators have so far found no ransom demand, political message or public claim of responsibility.
That absence has made the motive unusually difficult to understand.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Hackers remotely altered supermarket fridge temperatures
The attack targeted control systems used to manage supermarket refrigerators and freezers.
These systems allow store operators and maintenance companies to monitor temperatures remotely. That makes repairs and everyday management easier, but it also means poorly secured equipment can potentially be reached through the internet.
Some affected supermarkets were forced to throw away meat, frozen products and other perishable food after temperatures were altered.
Reports from France also described fires and equipment damage at some locations after refrigeration systems were pushed outside their normal operating conditions.
The affected equipment relied on technology supplied by Danish engineering company Danfoss.
Danfoss said many of the systems affected were older products that had reached the end of their supported life or were still running outdated software.
That detail has become central to the investigation.
Security weaknesses in some Danfoss refrigeration controllers had already been identified before the attack. Cybersecurity researchers had published details of flaws affecting one controller model earlier this year, although fixes had subsequently been made available.
Investigators have not publicly confirmed the precise method used by the attackers.
What outdated firmware means for connected equipment
Firmware is the basic software built into equipment such as routers, cameras, industrial controllers and smart appliances.
Think of it as the operating instructions running inside the machine. Manufacturers release updates when they discover security problems, much like a smartphone receives security patches.
Problems begin when businesses keep using equipment after updates stop.
An old refrigerator controller may continue cooling food perfectly well. From a cybersecurity perspective, however, it can become similar to using an old computer that has not received a security update for years.
Security researchers said thousands of Danfoss control interfaces remained visible on the public internet after the French attack.
Internet-scanning tools can discover such systems in much the same way that a search engine discovers websites. If one of those devices is using old software, weak credentials or an exposed management panel, an attacker may not need sophisticated hacking techniques to reach it.
That is why experts examining the incident have described it partly as a failure of basic cyber hygiene rather than evidence of an advanced state-backed operation.
No ransom demand leaves investigators searching for motive
Most disruptive cyberattacks provide investigators with at least some indication of motive.
Ransomware gangs usually demand money. Hacktivist groups often announce attacks to promote a political cause. State-backed attackers normally pursue espionage or strategic objectives.
None of those patterns has clearly emerged in France.
No hacking group had publicly claimed responsibility as investigators searched for the people behind the attack. There was also no known demand for payment.
That has left open the possibility that the attackers may have been experimenting, causing disruption for amusement or exploiting exposed systems without understanding the financial damage their actions could create.
The incident also demonstrates how a cyberattack does not need to steal customer information to cause serious losses.
Changing a temperature setting may sound trivial. Across hundreds of supermarkets, the same action can destroy tonnes of food, damage equipment and interrupt normal store operations.
Retail cyberattacks are moving beyond stolen data
Supermarkets have faced several major cyber incidents in recent years, although the methods have differed.
In 2024, Ahold Delhaize suffered a cyberattack that disrupted operations at parts of its US supermarket business. United Natural Foods, a major American food distributor, was also forced to shut down systems following a cyberattack in 2025, disrupting deliveries to customers.
Those incidents focused largely on business IT systems.
The French case is different because attackers allegedly interfered directly with physical equipment.
This type of risk is growing as more commercial machinery becomes connected to the internet. Building controls, factory equipment, security cameras, heating systems and medical devices can all be remotely managed.
The convenience is valuable. But every connected device also creates another possible route into an organisation.
For retailers, that means cybersecurity can no longer stop at laptops, payment systems and customer databases.
Equipment responsible for keeping food cold may now need the same attention as any other computer connected to a network.
What this means for you:
Businesses using internet-connected equipment should check whether devices still receive security updates and whether remote management panels are exposed online. Replacing unsupported equipment can be as important as installing antivirus software on office computers.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
