Thousands of refrigerators were hacked across France. How worried should you be?

A Cyberattack Put France’s Grocery Refrigeration Systems at Risk

Activelifezero.com – Hundreds of French grocery stores faced spoiled food, water pooling beneath freezer units and, in some cases, fire risks after attackers remotely interfered with connected refrigeration equipment. The incident affected roughly 700 food retailers across the country, exposing the practical consequences of weak security in devices that are often treated as ordinary maintenance equipment rather than critical digital systems.

Investigators are examining the large-scale attack, which disrupted refrigerators and freezers used to protect fresh and frozen products. French Economy Minister Roland Lescure described the episode as a warning with implications well beyond supermarkets.

“Wake-up call for everyone”

The attack illustrates how internet-connected industrial equipment can create real-world damage when remote access is poorly secured. Refrigeration controllers allow maintenance providers to monitor temperatures, diagnose faults and make adjustments without visiting a store. That convenience can become a vulnerability when older devices remain exposed online or no longer receive security updates.

What happened inside the stores

Attackers gained remote access to refrigeration controls and activated defrost cycles. Those functions are built into commercial units to remove accumulated ice, but they are intended to operate within strict temperature limits. By changing settings and bypassing protections that would normally keep temperatures from rising too far, the attackers caused refrigeration cabinets to thaw during the night.

Some display units reached about 50 degrees Celsius, or 122 degrees Fahrenheit, for roughly six hours overnight on Monday. The damage went beyond unusable food: water from melting ice and thawed stock created hazards for staff, while a number of units reportedly caught fire.

For retailers, a refrigeration failure can quickly become a costly operational problem. Food safety rules and normal store procedures require temperature-sensitive products to be discarded when safe storage conditions cannot be verified. Fresh produce, chilled goods and frozen inventory may all be lost at once, while stores also need to assess damaged equipment and restore operations.

Who is behind the intrusion?

No individual or group had publicly taken responsibility for the attack, and no public ransom demand had emerged. That absence makes the motive difficult to establish. Ken Munro, a cybersecurity analyst based in the United Kingdom, said the lack of an extortion demand could indicate an effort aimed more at disruption or public anxiety than financial gain.

“Mischief,” or “unsettle the public”

Félix Aimé, principal threat researcher at French cybersecurity company Sekoia, said the purpose remained unclear. He noted that investigators could not exclude the involvement of a single hacker or a hacktivist collective. A campaign intended to disrupt economic activity or infrastructure was another possibility being considered.

“To our knowledge, no public claim of responsibility has been made”

The investigation is being handled by France’s national cyber agency, ANSSI, alongside national prosecutors. The Paris prosecutors’ office said it had opened a case under national jurisdiction into the widespread attack on connected refrigeration systems used by major food retailers. Its work includes identifying victims and linking the intrusions to damage claims involving spoiled food and fires.

Older controllers were a central weakness

ANSSI said the affected systems included controllers operated by Danfoss of Denmark, Copeland in the United States and Dixell, which is owned by Copeland. These devices are used to manage refrigeration equipment and may be reachable over the internet for remote support.

Danfoss acknowledged after the incident that many impacted units were no longer receiving software or security updates, or were running older software. The company urged customers to maintain supported equipment with current firmware. Copeland said it had identified a vulnerability in an older, discontinued generation of controllers and was working with affected customers to reduce the risk.

The incident centered in part on Danfoss AK-SM 800A controllers. Earlier security research had highlighted a weakness involving an authentication mechanism that could be exploited to evade normal login controls. Such a flaw could permit an attacker to alter temperature settings from a distance.

More than 1,700 instances of the relevant Danfoss software had been visible on the internet in France before the attack, creating a large potential pool of targets. Munro said the controllers, or their installation, may have been placed on the public internet in a way that made them accessible to anyone scanning for exposed systems.

Why connected appliances deserve more attention

The case is a reminder that cyberattacks do not need to target computers holding customer records or payment systems to cause serious disruption. Controllers in supermarket refrigeration, heating, ventilation, manufacturing and building management systems increasingly connect digital instructions to physical machinery. When access is compromised, the result can be damaged goods, unsafe conditions and interrupted services.

Security depends on more than installing a connected controller. Operators need to know which devices are internet-facing, whether they remain supported by their manufacturer and who is responsible for updating them. Remote access should be limited to the people and systems that require it, while unusual temperature changes or configuration activity should trigger rapid alerts.

Outsourced maintenance can add another layer of complexity. A retailer may own the store and stock, an installer may manage the equipment, and a specialist provider may operate the remote monitoring platform. If responsibilities for updates, passwords and network exposure are unclear, outdated systems can remain in use long after their protections have weakened.

For consumers, the immediate concern is less about household refrigerators being directly affected and more about how digital vulnerabilities can reach everyday services. The French attack demonstrates that a device designed to keep food cold can become a point of entry for disruption when its software is old, its controls are exposed and nobody is actively maintaining its security.