French Supermarkets Lose Millions When Hackers Turn Fridges Into Ovens

Between Sunday night and Monday morning, hackers didn't break into French supermarkets. They broke into their refrigeration systems, heated them to 50 degrees Celsius for six hours, and watched inventory spoil in real time. Around 150 to 200 Intermarché stores across France woke up to refrigeration units running at temperatures suitable for baking bread, not preserving milk. Coopérative U lost nearly 100 outlets to the same attack. Carrefour reported 80 of its 6,000 stores compromised. Spain, Portugal, Poland, Germany, and Belgium all registered hits. The Paris prosecutor is now investigating what amounts to the most expensive supply chain sabotage France has seen in a single day.

This wasn't ransomware theatre where criminals threaten to publish spreadsheets. This was infrastructure destruction dressed in negligence. The compromised refrigeration units, managed by Danish systems provider Danfoss, were running outdated firmware. Danfoss said so publicly—it had "long advised customers" to update. The company's words carry the particular exhaustion of an engineer who watched warnings go unread for months, only to receive them back as apologies.

Thierry Cotillard, CEO of Intermarché, described the attack as "unprecedented" to BFM TV and estimated losses at "tens of millions of euros nationwide in a single day." Dominique Schelcher of Coopérative U called it "unprecedented," "unacceptable," and "of utmost gravity"—three words that suggest he had rehearsed none of them before speaking to press. When a grocery chain CEO runs out of adjectives before he runs out of damage, the math is already written.

The attack mechanics reveal something worse than a typical breach. Hackers didn't exfiltrate data or install persistence. They remotely triggered forced defrosting across numerous store locations simultaneously. Refrigeration systems don't fail quietly. They fail with fires. Perishable inventory doesn't degrade slowly. It spoils in hours. Affected stores were told to throw away everything—fresh products, frozen goods, the full margin profile of a Monday morning.

What makes this incident genuinely distinct from ransomware attacks that dominate the security narrative is that it leaves almost no forensic trail of value. Ransomware gangs want proof of exfiltration because proof generates payment. Sabotage attackers simply need thermal damage and time. By the time security teams noticed the temperature readings, the inventory was already a write-down. No negotiation. No data dump threat. Just loss.

The vulnerability here is architectural and depressingly common. Connected refrigeration systems represent the unsexy frontier of industrial control security—unsexy enough that updates don't get prioritized, warnings don't get actioned, and audits don't get scheduled. Every supply chain has dozens of these systems. Most are running firmware versions that were current when the iPhone was novel.

Danfoss will release statements. Affected retailers will file insurance claims. IT teams will finally update systems that should have been updated months ago. The prosecutor will investigate. And somewhere in Poland or Germany, where the same attack vector succeeded, another retailer is discovering their walk-in coolers read 50 degrees on a Monday morning. The only part that actually is unprecedented is that this time, someone finally noticed.