On Monday, French judicial authorities opened a probe into a coordinated cyberattack that targeted the refrigeration infrastructure of hundreds of grocery outlets across the nation. Investigators say the intrusion took place during the early hours, when technicians were least likely to notice anomalous activity, and it quickly escalated into a public-health concern as temperatures inside freezers and chillers surged beyond safe limits.
How the breach unfolded inside the stores
The malicious actors accessed the remote management panels of two Danfoss product families – the AK-SC and AK-SM series – and forced a continuous defrost cycle. By setting the thermostat to roughly 50 °C (122 °F) the equipment began melting ice that normally protects perishable goods. In several locations the defrost sequence was prolonged from the standard one hour to as much as eight hours, allowing the temperature to climb even further and, in at least one case, reaching 80 °C (176 °F). Such extreme heat not only destroyed frozen stock but also created a fire hazard that could have ignited nearby combustible materials.
Scale of the disruption and financial fallout
Retail groups disclosed a staggering number of affected sites. Les Mousquetaires, the parent of Intermarché and Netto, reported that around 180 of its stores were hit; BFM-TV later cited a figure closer to 300. Additional chains listed the impact: roughly 100 Cooperative U outlets, 80 Carrefour locations, about 5 % of Monoprix stores, and several E.Leclerc shops. Independent grocers and butchers using the same control hardware may also have suffered losses. Preliminary estimates from the retailers suggest “tens of millions of euros” in waste, with two Alsace outlets alone reporting a combined loss of €270,000. One store in La Haye, Normandy, posted images of melted equipment and described discarding a dumpster-full of frozen food.
Technical weaknesses that enabled the attack
The root cause appears tied to the exposure of the refrigeration controllers on the public internet. French law stipulates that such management interfaces should be limited to trusted IP ranges, yet many installations remained reachable worldwide. Danfoss confirmed that the compromised units were running outdated firmware and that the company had repeatedly advised customers to upgrade to supported versions or replace legacy hardware. No official statement has identified the exact method used to gain access – whether it was a known vulnerability, default credentials, or simply long-standing exposure.
Authorities, industry response, and cross-border concerns
The Paris prosecutor’s office launched a criminal investigation on the same day the attack was discovered, while France’s national cybersecurity agency, ANSSI opened parallel probes at both the national and European levels. ANSSI warned that exposing control panels to the internet “contrary to best practices” could jeopardize critical infrastructure. EU food commissioner Christophe Hansen condemned the operation, emphasizing that food security “requires more attention at all levels”. In addition to French entities, scans have uncovered similar Danfoss controllers exposed in Spain, Portugal, Poland, Germany, Belgium, the United Kingdom, the United States, South Africa and elsewhere, though no other nation has confirmed a coordinated breach.
Wider pattern of attacks on the food supply chain
This incident follows a growing trend of ransomware and intrusion campaigns targeting the cold chain. The Food and Ag-ISAC recorded more than 200 ransomware events in the sector during the first seven months of the year, a 62 % increase over the previous period. Earlier in 2025, United Natural Foods in the United States temporarily shut down systems after a suspected breach, and U.S. military commissaries experienced refrigeration failures in August. While those cases differ in scope, they collectively illustrate how increasing reliance on networked equipment makes the food ecosystem a high-value target.
What the episode means for the future of grocery security
Experts stress that supermarkets, distributors, and even farm equipment now form a tightly interwoven Internet of Things network, meaning a single weak link can cascade across the supply chain. The French incident underscores the urgency of adopting strict segmentation, regular firmware updates, and robust authentication for any device that influences temperature control. As the European Union’s ENISA agency notes, food production and distribution rank among the sectors most frequently affected by ransomware, suggesting that policy makers and industry leaders must treat refrigeration hardware as critical national infrastructure.
For now, French retailers are working to replace compromised controllers, purge spoiled inventory, and reassure consumers that the safety of fresh produce remains a top priority. The investigation remains open, and authorities continue to search for the perpetrators behind what officials describe as an “unprecedented” assault on the nation’s food supply.
