Hackers force French supermarket fridges to defrost

Overnight from Sunday 11 to Monday 12 October, intruders reached the computers that run refrigeration in French supermarkets. Staff arrived to fresh and frozen food they could no longer sell (Euronews). Intermarché and its sister chain Netto alone counted at least 300 stores hit (AFP via TV5Monde), but nobody has yet explained publicly how the attackers got in.

How a fridge gets told to warm up

A large supermarket runs dozens of chilled cabinets and freezers, all coordinated by one supervisory computer. Danfoss, the Danish maker of the affected controllers, describes its AK-SM "system managers" as the place where technicians change settings, schedules and alarms, including remotely through a web browser (Danfoss). Picture a central thermostat panel for the whole shop, one a maintenance engineer can open from afar.

One routine that panel manages is defrost. The cooling coils, the cold metal pipes inside each cabinet, slowly ice over. The system briefly warms them to melt the frost, much like defrosting a home freezer, except automatic and short.

Retailers said the intruders forced that cycle across their equipment, with settings reported as high as 50°C (BFMTV). That figure is an instruction entered into a controller. It tells the heating what to aim for at the coil, which is different from the temperature a pack of chicken on the shelf actually reached.

Duration matters more for food. Les Mousquetaires, Intermarché's parent group, told Reuters that equipment in an early batch of about 150 stores stayed hot for around six hours (Reuters via Boursorama). Once cooling stops for that long, a shop can no longer vouch for what sat in the cabinet, so the stock goes in the bin. Group chairman Thierry Cotillard put the losses at tens of millions of euros in a single day (BFMTV), an early estimate, not an audited bill.

Hundreds of stores, no firm total

The count kept growing on Monday. AFP's later dispatch put Coopérative U at more than 100 affected stores (AFP). Carrefour told Reuters that 80 of its stores were hit, and Monoprix about 5% of its roughly 490 (Reuters).

E.Leclerc confirmed disruption in several stores through an attack on a refrigeration supplier, and Metro said an outside provider had been attacked. Neither gave a number (Le Monde). With some chains silent on figures and others revising theirs through the day, no reliable national total exists yet.

The doorway nobody has named

France's cyber-emergency team, CERT-FR, reported numerous compromises of Danfoss AK-SM and AK-SC controllers. It warned that leaving their management screens open on the public internet goes against good practice (CERT-FR).

Danfoss said most affected units were older models that no longer receive security updates. Among the newer units hit, the built-in software, known as firmware, was out of date (Cooling Post). The company told the Danish agency Ritzau that its own IT systems were not affected (Ritzau via DKNyt).

Security researchers had studied this equipment before. Claroty's team showed how flaws in one Danfoss controller model could let an attacker tamper with refrigeration, and its scan found 2,765 such management screens reachable online (Claroty Team82). No public source shows those particular flaws were used in France.

The Paris prosecutor has opened an inquiry to count victims and establish whether the spoiled food and reported fires stem from the attack (France 24/AFP). According to a source close to the prime minister, the national cyber agency ANSSI found a vulnerability in the Danish supplier's software and is searching for other exposed French firms (Franceinfo).

Hundreds of stores confirm the damage on their own shelves. The route in is still unproven, and the prosecutor and ANSSI are the ones who owe it. Until they publish it, any shop running these controllers has reason to check whether its own panel can be reached from the outside.

---

Note to editor (not for publication): Your main blocker is still open. I had no investigation record for this rewrite, only the draft and its links. The defrost mechanism, the 50°C setting, the six-hour duration, discarded stock, the loss estimate, controller models, prior research and the investigators' findings are still sourced only from the draft's links. I kept them, attributed to those outlets and with the precision fixes you asked for. They need to be brought into the reporting record before this runs. I cut "rare case," the lock analogy, Belgium and the 2022 attacks.