Cyberattack on Supermarket Refrigerators in France Highlights Vulnerability of Food Systems
Cyberattacks don't just steal your passwords. They spoil your food.
Cyber attacks don't just steal your passwords. They spoil your food
The Paris prosecutor's office on Monday opened an investigation into a nighttime cyberattack on the refrigeration systems of hundreds of French supermarkets. Hackers raised the temperature of refrigerators and freezers, causing fires and food spoilage.
In a statement to Time, French retailer Les Mousquetaires, which operates supermarket chains Intermarche and Netto, said the damage from the attack could reach several million euros.
Dominique Schlecher, CEO of French supermarket chain Cooperative U, wrote in X: "Targeting essential equipment to keep produce fresh and provide food for the French people is very expensive and unprecedented.
France's National Cyber Security Agency (ANSSI) confirmed to TIME that it is investigating the attack "both at the national level, to accompany potential victims, and at the European level to coordinate with our counterparts."
The incident has raised concerns about the threat of cyberattacks on food security as food supply chains increasingly rely on networked systems.
EU Commissioner for Food and Agriculture Christoph Hansen condemned the attack, noting in a post on X: "Food security needs more attention at all levels, as food exploitation has become a reality."
Hackers target connected refrigerators and spoil food in hundreds of stores
BFM-TV, which first reported the attack, said hackers "remotely managed to initiate forced defrosting of refrigeration systems in many stores." The French broadcaster said the cyber attack involved continuous defrosting cycles and setting the temperature to 50 degrees Celsius (122 degrees Fahrenheit). Hackers also extended the defrost cycle in some freezers and cold rooms from one hour to eight hours to delay the alerts, French newspaper Le Monde reported.
Supermarkets usually use central control panels to manage multiple refrigeration units. Many of these control panels are connected to the Internet so that maintenance companies can access them remotely. But the French government said on Monday that exposing a management interface on the Internet was "against best practices" and that remote management should be limited to trusted IP addresses if necessary.
Monday's attack affected two series of refrigeration management products from Danish company Danfoss, AK-SC and AK-SM, according to an ANSSI alert.
Danfoss told Ambassador Arjan that it was "aware of incidents in France affecting a limited number of refrigeration management systems." The company said the affected units were "running older firmware" and "has long advised customers to keep supported systems updated with the latest firmware and migrate older systems to current-generation solutions."
Investigators have not yet publicly identified how the attackers gained access to Danfoss' systems.
About 180 Intermarche, or the Netto brand of parent company Les Mousquetaires, told Ambassador Arjan that supermarkets were targeted, although BFM-TV reported a higher number of 300. Retailers said at least 100 Cooperative U stores, 80 Carrefour stores, 30 Monoprix stores and several E.Leclerc stores were also affected. Independent grocers and butchers that use a similar refrigeration system may also be affected.
Thierry Cotillard, CEO of Intermarche, told BFM-TV that the "unprecedented" attack resulted in damages amounting to "tens of millions of euros across the country in one day".
Two supermarkets in Alsace, Intermarche and Super U, reported losses of €270,000, according to BFM-TV. An Intermarche in The Hague, Normandy, posted on Facebook that temperatures reached 80 degrees Celsius (176 degrees Fahrenheit), causing some equipment to melt. Supermarket owners described throwing away almost a dumpster's worth of frozen food.
Ambassador Arjan has contacted Danfoss and major French retailers for comments.
The growing cyber threat to food and agriculture
No other country has yet confirmed related violations.
This attack is also not the first time that cyber incidents have disrupted food systems.
In late August, at least six U.S. Army commissaries reported refrigeration outages that resulted in refrigerated and frozen products spoiling. Military investigators are investigating the outages, but have not commented on the nature of the investigation.
In June 2025, US food distributor United Natural Foods also temporarily took certain systems offline during a suspected breach, which affected order fulfillment and distribution.
Also on Monday, Dutch retailer Ahold Delhaize took several systems offline as a precaution amid "a security issue in its network". The retailer operates the largest Dutch supermarket chain, Albert Heijn, as well as several US grocery brands, including Stop & Shop, Hannaford, and Food Lion. In a statement on Monday, Dutch retail brands Albert Heijn, Etos, and Gall & Gall said they were dealing with a cyber security incident. There is no established link between these incidents and the French cyber attack.
Analysts have warned that food systems are increasingly vulnerable to cyber-attacks as farms, processors, distributors and supermarkets rely on networked equipment throughout their supply chains. Food and Ag-ISAC, a nonprofit industry group based in Washington, D.C., tracked 227 ransomware incidents in the food and agriculture sector from January to July, a 62 percent increase over the same period last year.
The European Union's cybersecurity agency ENISA also noted that food production, processing and distribution are among the sectors most affected by ransomware claims in the EU's latest. Threat assessment
Before Monday's attack in France, cybersecurity firm Claroty published a report in August showing how flaws in Danfoss' AK-SM 800A controller could allow an intruder to bypass a login and gain control of software used to control a supermarket refrigerator. Danfoss firmware updates included fixes for these flaws.