A spate of cyberattacks targeting supermarket refrigerators across France overnight has caused fires and led to the spoiling of mountains of food.
“I can confirm that a cyberattack has been affecting the refrigeration systems of several stores in our CooperativeU network since last night,” Dominique Schelcher, the company’s CEO, said in a post to X.
“Our teams are fully mobilised, in contact with refrigeration technicians, to restore the situation as quickly as possible. An investigation will be conducted to shed full light on this attack. Targeting equipment essential to preserving fresh produce and supplying food to the French population is extremely serious and unprecedented. It is unacceptable.”
CooperativeU was just one of several supermarket chains responding to the incident, including E Leclerc, Monoprix, and Auchan. The operator of supermarket chain Intermarché said around 150 of its stores had been impacted, with its refrigerators operating at 50C for six hours, according to Reuters.
All the food stored in the impacted fridges was disposed of to avoid health risks, said a company spokesperson.
A spokesperson for the French Prime Minister, Sébastien Lecornu, said the country was “coordinating with its European counterparts, as other countries may also be affected”.
Dutch supermarket operator Ahold Delhaize reported its systems were also under attack and that several systems had been taken offline.
The incident is thought to be linked to a software vulnerability in internet-facing systems designed by Danish firm Danfoss, although cyber security expert Kevin Beaumont has a far simpler idea of what led to the meltdowns.
“Regarding the Danfoss fridge thing doing the rounds in the media – there’s several thousand of them that are directly internet-facing,” Beaumont said in a social media post.
“The username is admin and the password changes every day automatically to… the current date.
“Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.”
As to the threat actor, Beaumont is wary of attributing the incident to state-sponsored activity, or the result of a rogue AI agent.
“I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots,” Beaumont said.
“Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
“Also there’s loads of speculation about if it’s Russia, China, Iran – it’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.”
As of the time of writing, Danfoss’ global website is down.
Oded Vanunu, Head of Vulnerability Research at Check Point Software Technologies, said the incident is hardly a surprising one.
“A supermarket refrigerator is no longer just an electrical appliance. It is a computerised system connected to a network, enabling remote monitoring and control,” Vanunu told Cyber Daily.
“While this connectivity allows refrigeration systems to be managed efficiently, it also exposes them to cyber security risks, particularly when operational equipment runs for years on outdated software, without regular security updates, and with management interfaces accessible from the internet.”
Vanunu added that the attackers, in this case, did not need to use sophisticated techniques to achieve their goals.
“Refrigeration systems have legitimate operational functions, such as defrost cycles, and when an unauthorised party gains access to the system, those same functions can be exploited to disrupt operations,” Vanunu said.
“Unlike attacks aimed at stealing data or encrypting files, the impact here is on the physical operation of the equipment itself, with direct consequences such as food inventory losses and potential safety hazards.”
There are inherent risks in linking any essential device to the internet, Vanunu said, but there are ways to reduce that exposure.
“The first step is to identify which controllers and management interfaces are directly exposed to the internet and eliminate any unnecessary exposure. It is also important to keep systems updated, replace default passwords, restrict remote access, and enable multi-factor authentication wherever supported,” Vanunu said.
“Separating operational control networks from other networks and monitoring unusual changes in system behaviour are also essential measures.
“These recommendations apply not only to refrigeration systems, but also to HVAC, building management systems, and other operational infrastructure.”
Robin Long, Rapid7’s Regional CTO Asia Pacific, told Cyber Daily the attack was a reminder that operational technology is just as much a part of the attack surface as any other system, “whether or not IT owns it”.
“The attack demonstrates the importance of first, understanding your inventory of internet-facing assets, including OT and IoT, and reviewing it regularly. Secondly, ensuring that you keep firmware and software patches current, and plan for the end of life of legacy equipment,” Long said.
“Finally, where patching isn’t immediately possible, consider applying compensating controls such as removing direct internet exposure, placing remote access behind a VPN or zero-trust gateway with MFA, segmenting networks, and monitoring for anomalous activity.
“It is also important to extend this scrutiny to vendors and maintenance providers with remote access.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
