Hackers Set Supermarket Refrigerators to 50 Degrees: Cyberattacks Are Reaching Into the Physical World

What happened?

During the night of Sunday, October 11 into the morning of Monday, October 12, a large-scale cyberattack targeted refrigeration systems at several hundred supermarkets across France. In its initial statement, Les Mousquetaires, the owner of Intermarché, said around 150 of its stores had been affected; the number increased over the course of the day. Coopérative U confirmed that it had been hit, while E.Leclerc told AFP that one of its refrigeration equipment suppliers had been attacked, affecting some of its stores. Carrefour said 80 of its supermarkets were affected, although the vast majority of its 6,000 stores experienced no problems.

Rather than simply shutting the refrigeration systems down, the attackers took an unusual approach: they switched the units into “defrost” mode. Under normal conditions, this function runs for short periods each day to melt ice that builds up on refrigeration equipment. The attackers instead activated it remotely and kept it running continuously. In some systems, temperatures rose as high as 50°C; according to Intermarché, some refrigerators and freezers remained in this state for around six hours.

As a result, cold-chain products such as meat, frozen foods and vegetables were destroyed to avoid posing a health risk. The Paris Prosecutor’s Office opened an investigation into what it described as a “large-scale” attack and said the reported damage included both food losses and fires. The French prime minister tasked the country’s cybersecurity agency, ANSSI, with carrying out a technical investigation; France is also coordinating with European partners because other countries may have been affected.

The affected systems were refrigeration management systems made by Danish company Danfoss. Danfoss told AFP that most of the affected equipment consisted of older products that no longer receive software and security updates; it also told Reuters that the affected units were running outdated software. The company said it has long advised customers to keep their systems up to date and migrate from older systems to newer-generation solutions. According to a source close to the prime minister, ANSSI also identified a vulnerability in Danfoss software. However, it has not yet been disclosed exactly which vulnerability or method the attackers used, and the identity of those behind the attack remains unknown.

On the same day, Ahold Delhaize, the owner of supermarket chains including Albert Heijn and Delhaize in the Netherlands and Belgium, also confirmed that it had experienced a security issue and took some systems offline as a precaution. It is not yet known whether that incident was connected to the attack in France.

Why is a refrigerator connected to the internet?

At first glance, it may sound strange, but a large supermarket’s refrigeration system is very different from the refrigerator in your home. Hundreds of display cases, freezers and cold rooms need to have their temperatures, defrost cycles and energy consumption monitored continuously. Detecting a malfunction immediately can prevent thousands of dollars’ worth of products from spoiling.

That is why modern supermarket refrigeration systems are connected to central control units and can often be managed remotely. A chain’s technical team can monitor refrigeration units across hundreds of stores from a single screen, while service companies can also intervene remotely when faults occur.

That is a major convenience. But when the same remote access falls into the wrong hands, it also means an attacker may be able to reach that very same control interface.

Cyberattacks reaching into the physical world

What makes the attack in France different is that its consequences were physical rather than purely digital. The most visible result was not encrypted files or stolen data, but spoiled real-world products. Some stores also reported physical damage associated with fires.

These kinds of attacks target operational technology — systems that manage physical processes in factories, buildings and infrastructure. Two examples from the past illustrate the same risk from different angles:

• In the 2013 data breach at US retail giant Target, attackers gained access to the company’s network using stolen credentials belonging to an HVAC and refrigeration contractor. The HVAC equipment itself was not the target, but the incident showed how remote access granted to outside vendors can become a stepping stone into other systems.
• The Stuxnet malware became one of the best-known examples of a cyberattack causing physical damage. The malware targeted industrial control systems at Iranian nuclear facilities and altered the way centrifuges operated, damaging physical equipment.

The attack in France therefore cannot be viewed simply as “supermarket computers getting hacked.” It shows how a digital command can, within a matter of hours, lead to spoiled goods and physical damage in the real world.

Old software, new risk

Danfoss’s statement points to one of the best-known weaknesses in operational technology: systems that are not kept up to date.

A computer or smartphone is regularly updated, but a supermarket refrigeration system, a factory production line or a building’s climate-control system may run on the same software for years or even decades. The reasons are understandable: these systems often need to operate continuously, companies may be reluctant to risk something breaking during an update, and the company that installed the system is often not the same organization that operates it. Once a manufacturer stops providing updates for a product, that device can remain in service while becoming increasingly vulnerable to newly discovered flaws. The result is equipment that is connected to the internet but may not have been updated for years.

What does this mean for the devices in our homes?

The chances of your smart refrigerator suddenly heating up to 50°C tomorrow are extremely low; this attack targeted professional refrigeration systems. But the same logic applies to every internet-connected device in the home: smart plugs, security cameras, robot vacuums and smart thermostats.

A few simple habits can make these devices safer:

• Change default passwords. Many devices are installed with standard passwords that are widely known.
• Do not ignore updates. If the device’s app offers automatic updates, enable them.
• Review devices that no longer receive updates. A device whose manufacturer has ended support will remain vulnerable to newly discovered flaws.
• If possible, connect smart devices to a separate network. The guest-network feature available on many routers is an easy way to keep these devices separate from your computers and phones.

What happened in French supermarkets is a reminder that connecting a system to the internet is not only a convenience, but also a responsibility. For generations, the cold chain has been protected against threats such as power cuts, mechanical failures and heat. Now another threat has been added to that list: someone who can reach the refrigerator’s control panel remotely.