In what cybersecurity experts are calling "bizarre and unprecedented" - a phrase that has frankly lost all meaning in the era of internet-connected everything - hackers remotely overrode the digital thermostats controlling hundreds of supermarket cold aisles across France shortly before midnight last Sunday. Temperatures in thousands of freezers, fridges, and chiller cabinets were pushed from as low as -27C (-16.6F) to well over 50C (122F). Over the next four to six hours, the food inside first defrosted, then slowly began to cook. One Normandy supermarket reported freezers pushed to 80C (176F). In some stores, the extreme heat sparked fires, triggering sprinklers and water damage. Nothing says "modern convenience" like a freezer that doubles as a crematorium.
Shop staff arriving early to restock shelves reported catching a blast of hot air, like opening an oven. "It was a catastrophe," said one worker at the large Intermarché supermarket in the south-west suburb of Issy-les-Moulineaux in Paris. "They pushed the freezers here up to 62C. Everything had to be thrown away. It was such a waste." Staff worked until almost midnight on Monday reordering and restocking. "Thankfully, we were able to get things almost back to normal the same day," another worker added, presumably through gritted teeth. "But we had to clear out everything in the freezers."
Initial assumptions of isolated failure quickly gave way to reality: up to 700 stores - including Intermarché, Coopérative U, Carrefour, Leclerc, and Monoprix chains, plus smaller independents - had been hit by a cyber-attack. Dominique Schelcher, president of Coopérative U, said 80 of its 2,000 supermarkets were targeted. "This is a completely unprecedented, unexpected, and extremely serious attack," he told French radio. "In my entire professional career, I've never seen anything like it." The Paris public prosecutor's office immediately opened an investigation into the latest in a series of cyber-attacks that have made France the most hacked country in Europe.
Gérôme Billois, a partner at cybersecurity firm Wavestone, said the hack had the hallmarks of political sabotage. "The two most feasible scenarios are either it was a group of youngsters or activists who wanted to blow up a few freezers to prove what they could do, or it was a destabilising attack, what we call sabotage, by internal or external state actors," he said. "As for the attack's signature, the most likely scenario is still a destabilisation attack - one designed to convey the message to populations that they are not safe, to convey the impression that the government is falling apart, and ultimately to instil fear. Currently there are two international actors known for doing this sort of thing: Iran and Russia."
The hackers had pirated controllers supplied by Danish company Danfoss. Most supermarket cold aisles are connected to the internet for remote maintenance and failure alerts. Initial investigations suggest the hackers disabled alarm systems before tampering with thermostats, or extended the defrost programme by several hours to avoid triggering alarms. Danfoss said it had identified security flaws last year and had "long recommended" customers install updates or replace obsolete unsupported systems. The affected units were "running outdated firmware," it said. France's cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
Marta Rybczyńska, a cybersecurity specialist and researcher, said she had found previous security warnings about old supermarket freezers running out-of-date software and newer models not having firmware updated. "Some of these freezers hadn't been supported by the manufacturers for several years and there were notices saying they should be replaced. Other freezers were newer but the software hadn't been updated," she said. "The hackers found these weaknesses and used them." She added: "Many of the freezers appear to have been running with a default password. The hackers were able to modify or turn off the alerts so the shops only realised when the first person arrived in the morning and saw the damage." Because nothing says "enterprise-grade security" like "password123."
The French attack mirrors a similar incident in the US in August, when connected fridges and freezers at a dozen military commissaries went into unscheduled defrost cycles overnight, causing massive food loss. France is the most heavily pirated country in Europe by volume of records exposed, according to Upguard. In the last three years, hackers have breached France's health system, France Travail (the government-run jobseekers agency), the National Agency for Identity Documents (ANTS), and most major mobile phone companies. This summer, the economy and finance ministry lost the personal and fiscal records of 678,000 taxpayers.
Billois says France has fallen behind on cybersecurity and has still not adopted the EU's Cyber Resilience Act (2024), which introduced mandatory security for internet-connected devices. "It's a text that's not political and that everyone agrees on but is delayed because there's always more urgent legislation or there are quibbles about amendments, and this has been a disaster," he said. In the UK, the cyber security and resilience (network and information systems) bill is wending a similarly tortuous way through parliament - though it fails to directly cover the food industry.
Supermarket boss Schelcher was quick to shift blame onto unnamed refrigeration contractors who maintain the cold aisle equipment. "Our supermarkets are not customers of Danfoss," he told RTL radio. No individual or group has claimed responsibility; Paris prosecutors have instructed detectives from its anti-cybercrime unit, but Billois says finding the hackers will take time. "It's possible they'll be identified eventually, but it could take weeks if not months to be certain because hackers know how to hide their tracks," he said. Rybczyńska added: "Whether it's possible to trace the hackers depends on their level of capability; if it's a handful of youngsters, it's easier because they probably won't have thought to remove traces. If they are professionals it's more complicated and will take longer. If they're in a foreign country, it'll be extremely difficult."
The total cost has yet to be calculated, but Thierry Cotillard, CEO of Intermarché, said losses could run to "tens of millions of euros," which store companies say is unlikely to be covered by insurance. "It's a bizarre story," Billois added. "There's a shared responsibility between the supermarkets, the refrigeration companies who are sub-contractors and who maintain the material, and the software company. We cannot say who is to blame except, of course, the hackers. But in the end it comes down to freezers connected to the internet without being adequately secured. And that must be a wake-up call to everyone." A wake-up call, one might add, that arrived at a balmy 80C.