Attackers remotely took over refrigeration systems at hundreds of French supermarkets on the night of October 11, deliberately raising fridge and freezer temperatures to as high as 50 degrees Celsius and spoiling large quantities of food, according to several retail chains affected by the incident.

The intrusion targeted a central controller that manages all refrigeration units in a store, a device manufactured by Danish industrial technology company Danfoss. These controllers are commonly connected to the internet so that third party maintenance firms can monitor and adjust temperatures remotely without needing a technician on site. That same remote access capability appears to have given attackers an entry point into the devices.

French retail group Les Mousquetaires was among the chains confirming the attack, with stores forced to discard perishable stock after refrigeration units were pushed well past safe storage thresholds overnight when the manipulation would go unnoticed until staff arrived the next morning.

Why This Matters

The incident underscores a persistent weakness in operational technology deployed across retail and industrial environments: building and refrigeration management systems are frequently exposed to remote access for legitimate maintenance purposes, but that same access path can be abused if credentials are weak, exposed, or poorly segmented from the wider internet.

Unlike data breaches, this attack caused direct physical and financial damage, spoiled inventory, that retailers cannot simply patch after the fact. It also highlights how OT devices from industrial vendors, often overlooked in traditional IT security programs, can become a single point of failure affecting hundreds of locations simultaneously when centrally managed.

  • Organizations using remotely managed refrigeration or HVAC controllers should audit internet-facing access points and restrict them to authenticated VPN connections where possible.
  • Maintenance vendor accounts with remote access privileges should be reviewed for credential hygiene and least-privilege scoping.
  • Retailers should establish alerting thresholds on refrigeration systems so temperature anomalies trigger immediate notifications rather than being discovered after the fact.

Details on the specific intrusion method, whether through stolen credentials, an exposed management interface, or a software vulnerability, have not yet been disclosed.