A cyberattack manipulates refrigeration at hundreds of French supermarkets
Attackers took remote control of refrigeration controllers and forced defrost cycles that spoiled food and sparked fires.
What happened
Between 11 and 12 October, an attacker reached refrigeration controllers at hundreds of French supermarkets remotely and pushed temperatures up to 50 °C, according to OCCRP. Mousquetaires Group told the outlet that 300 of its stores were affected and that losses run into millions of euros; Coopérative U reported 80 sites across its network. The Paris prosecutor’s office opened a cybercrime investigation.
Why it matters
It shows how a digital incident turns straight into spoiled stock, fires and business interruption. The way in was internet-connected controllers — Danfoss and other manufacturers, per CERT-FR’s advisory — with their management interfaces exposed.
What we recommend
Inventory the connected systems that are not computers — refrigeration, HVAC, access control —; take them off the internet or put them behind a VPN; change default credentials; and give suppliers temporary, logged remote access with two-factor authentication on a separate network. A factory reset is not enough while the device stays unpatched.
Related service: Cybersecurity
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.