On the morning of Monday 12 October, freezers in hundreds of supermarkets across France were running at 50 degrees Celsius. A Paris resident watched staff at an Intermarché throw cartloads of defrosted food away, melted ice cream running down the street.
It was not a power cut or a failed compressor. Someone had reached into the refrigeration controllers over the internet and told the freezers to heat up and stay hot. By the chains’ own figures, around 400 stores were hit, out of roughly 15,000 supermarkets in France.
What makes this worth your attention is how ordinary the ingredients were. A machine with a computer inside it, a remote management feature nobody wants to give up, and software that stopped being updated years before. That combination is everywhere, and some of it sits in your home. Here is what happened, and what it means for you.
What happened
Overnight into Monday 12 October, hackers got into refrigeration controllers made by Danfoss, a Danish engineering company, as the BBC reported. Each controller runs the cold aisles for a whole store, and it is built to be managed over the internet, which is how maintenance crews adjust temperatures without driving to every shop.
Normally a supermarket freezer defrosts for a short burst overnight and the temperature rises a little. This time the units were told to heat up and stay hot. Intermarché said its fridges reached 50 degrees Celsius for six hours. Managers arriving for the morning shift were hit by a wave of hot air from the freezers, and a few stores reported small fires. A French broadcaster photographed a freezer in an ice cream aisle sitting at 26.5 degrees. Deliveries and the electronic price labels on shelves were affected too, the French outlet La Dépêche reported, and Tom’s Hardware covered it.
The scale, from figures the chains gave reporters:
- Intermarché and its Netto brand: 180 stores affected, with another 100 disconnected from the internet as a precaution.
- Coopérative U: more than 100 stores.
- Carrefour: 80 stores, out of about 6,000 across the country.
- Monoprix: 5 per cent of its 400-plus stores.
That adds up to roughly 400 of France’s 15,000 or so supermarkets, the BBC reported. Food that could not be kept cold was thrown out, because nobody can promise it is safe once the temperature climbs. Two stores in the Alsace region lost 270,000 euros between them, and the nationwide bill is expected to run into the millions.
French prosecutors opened a cybercrime investigation, and the Prime Minister’s office asked France’s national cyber security agency, ANSSI, to look into the attack. The Reuters report carried by iTnews says France is coordinating with other European countries, and Felix Aime, a threat analyst at the security firm Sekoia, said systems in Spain, Portugal, Poland, Germany and Belgium were affected too.
What it means for the apps and devices you use
The lesson here is not really about supermarkets. It is about a pattern that runs through everyday life now. An ordinary machine gets a computer inside, that computer goes on the internet, and the software on it stops being updated long before the machine wears out.
Once a controller can be reached from anywhere, anyone who finds a flaw in its software can reach it too. Danfoss said the affected units were running outdated firmware, and that it had identified the risk before. Security researchers at Claroty published details of vulnerabilities in this controller model on 9 August, and Danfoss had shipped fixes for supported units. The trouble is that “supported” does not last forever. Old units get dropped by their maker, and their security holes stay open.
There is a version of this worth checking at home this week. The router, the smart TV, the doorbell, the baby monitor, anything that has quietly been on your wi-fi for years. If the maker no longer updates it, it carries the same kind of risk as the supermarket controllers, just smaller. And if you run a small website, the pattern will be familiar. An old plugin or theme that nobody updates is one of the most common ways a site gets taken over. Same rule, different machine.
The detail, for anyone curious
The controller at the centre of this is the Danfoss AK-SM 800A, a box that runs the cold aisles for an entire store and is built to be managed remotely. Claroty’s researchers, who work as Team82, found a hidden maintenance login they called a “code of the day”, which the device generates from its own date and accepts in place of the normal password. They also found a way to run their own commands on the device. Danfoss fixed the flaws in a firmware release called R4.3.1 and published a security advisory. The units caught in this attack were older models that could not be updated.
There is one more finding worth knowing if you run connected equipment. A scan found 2,765 of these panels reachable from the open internet. Claroty’s advice was plain. Update to R4.3.1 or later, and keep management interfaces off the open internet.
The Paris prosecutor’s office called the attack “large-scale”, and European Food Commissioner Christophe Hansen wrote on X that “the weaponisation of food has become a reality”. It is not the first incident of its kind either. Reuters reported that about a dozen US military commissaries lost food in late August after their fridges were disrupted in a similar way.
What to watch
Three things will show where this goes.
- The ANSSI investigation. French authorities are working with other countries, and the open question is who was behind the attack. Nobody has been named so far.
- Whether more retailers come forward, in France and beyond. The list of affected countries is expected to grow.
- What happens to the old controllers. They cannot simply be patched, so their owners have to replace them or keep running a known risk.
Final Words
A fridge that talks to the internet is a computer that happens to keep food cold. That is what makes it convenient to manage, and it is what made it a target. The attack in France took hold through old software on machines nobody could fix any more, and the cure is the least glamorous one on offer. Replace what is past its update life, and keep the rest current. The supermarket chains have a lot of that work ahead of them. Your version is smaller, and it still counts.
