What Shoppers and U.S. Supermarkets Need to Know

• Hackers remotely manipulated commercial refrigeration systems across France, pushing temperatures as high as 122°F and destroying fresh and frozen food.
• No attacker has claimed responsibility and, unusually, investigators have seen no public ransom demand — raising questions about whether disruption itself was the objective.
• French cyber authorities warn vulnerable refrigeration controllers remain exposed online, meaning the same type of attack could be repeated in France — or attempted against American food retailers.

FRANCE - Hackers did not steal credit-card numbers, lock corporate computers or demand millions in Bitcoin. They went after something far more basic: the machines keeping food cold.

Beginning overnight October 11-12, attackers seized remote control of refrigeration systems at supermarkets across France and deliberately altered their settings. Temperatures in some refrigerators and freezers were driven to 50°C — 122°F — for roughly six hours, ruining meat, dairy products, frozen food and other perishables. Fires were reported at some locations.

France's Finance Minister Roland Lescure said roughly 700 of the country's approximately 10,000 supermarkets were affected, although separately verified chain-by-chain reporting initially placed the minimum number at about 350. Carrefour confirmed 80 stores were hit, while Intermarché, Monoprix, Coopérative U and other retailers also suffered disruptions.

And investigators still don't know who did it.

No hacking organization has publicly taken responsibility. More strikingly, there has been no publicly disclosed ransom demand. A French investigator told USA Herald that absence has puzzled investigators because ransomware gangs usually try to monetize an intrusion and hacktivist groups typically rush to claim credit.

That makes this attack different.

The hackers crossed the line between attacking information and manipulating physical equipment. A few commands sent across the internet translated into overheated refrigeration equipment, spoiled food, store closures and dumpsters filled with inventory.

Staff at affected stores removed enormous quantities of food rather than risk selling unsafe products. One Paris Intermarché manager said an early-morning alert helped save much of his fresh inventory, but his frozen food was already lost after temperatures approached 104°F. Other employees were photographed hauling boxes of spoiled meat and frozen products into dumpsters. Stores closed affected refrigerated aisles while technicians restored systems and staff began restocking.

There is still no verified nationwide tonnage of destroyed food. Reports describe tons being discarded, but France has not published a comprehensive figure. Nor is there a final industry-wide damage calculation. Intermarché CEO Thierry Cotillard estimated losses at tens of millions of euros nationwide in a single day.

The technical failure is particularly troubling because researchers had already warned about weaknesses in commercial refrigeration controllers.

France's CERT-FR says compromises involved remote refrigeration controllers from Danfoss, Copeland and Dixell and warned that exposing management interfaces directly to the public internet violates basic security practices. CERT-FR

Cybersecurity researchers at Claroty's Team82 had previously demonstrated serious weaknesses in Danfoss AK-SM 800A controllers, including authentication problems and vulnerabilities capable of permitting remote code execution. Researchers found numerous controllers directly reachable from the public internet. Danfoss subsequently issued security updates. Claroty

Danfoss says many affected systems were either running outdated firmware or were older products that no longer received security updates.

The attack may not be finished. France's cybersecurity authority warned Tuesday night that malicious activity was "likely still underway" and told operators to update firmware, change passwords and reconnect refrigeration equipment only through secured networks or VPN connections. AP News

And thousands of potential targets remain visible. Reuters found at least 4,500 Danfoss interfaces accessible through internet-scanning service Shodan after the attack. Investigators could not determine how many remained vulnerable.

That matters to the United States.

The French attack resembled refrigeration disruptions at roughly a dozen U.S. military commissaries in August, although no public evidence establishes that the incidents involved the same attackers.

American supermarkets should treat France as a warning. Internet-facing refrigeration controllers should be removed from direct public access; unsupported equipment should be replaced; firmware must be patched; vendor access should require VPNs and strong authentication; and refrigeration operational technology should be segmented from ordinary corporate networks. CISA likewise recommends isolating operational technology, restricting remote-management tools and tightly controlling outside access. CISA

The lesson from France is simple. Cybersecurity at a supermarket no longer stops at the checkout register.

Sometimes the target is the freezer.

Official French cyber alert: CERT-FR refrigeration-system security alert

Technical vulnerability research: Claroty Team82 analysis of refrigeration controllers

Danfoss security information: Danfoss AK-SM 800A security and firmware updates

About the Author

Samuel López is a reporter and news correspondent for USA Herald who has contributed to the publication since 2022. López brings more than two decades of experience in the legal sector analyzing state and federal litigation, insurance disputes, regulatory issues and complex matters involving corporate risk. That background informs his reporting on cybersecurity incidents like the French supermarket attack, where technology failures can quickly create questions involving business interruption, insurance coverage, product loss, public safety and corporate responsibility.

Get the Stories Behind the Headlines

If this report gave you information you weren't seeing elsewhere, get USA Herald's investigative reporting, legal analysis, national-security coverage and emerging-risk stories delivered directly to you. Subscribe to the USA Herald newsletter

👉 Follow USA Herald on X: @RealUSAHerald