- Hackers breached remotely managed Danfoss refrigeration controllers across hundreds of supermarkets in France.
- Cooling units were forced into a continuous defrost cycle reaching 50°C, destroying food supplies and triggering equipment fires.
- Prominent retailers including Intermarché, Leclerc, and Coopérative U were affected, facing damages projected to reach millions of euros.
Industrial IoT Under Siege: What Happened
During the night of October 11, an unprecedented cyber incident disabled critical refrigeration systems across hundreds of supermarkets in France. Threat actors leveraged remote access to cooling plant controllers manufactured by Danish automation specialist Danfoss. The attackers modified system routines, switching the standard automated defrost feature—typically running for just two hours daily—into an uninterrupted, forced heating cycle set to a blistering 50 degrees Celsius.
As store managers arrived the following morning, they were met with waves of heat radiating from display cases and walk-in freezers. The excessive thermal load not only caused widespread spoilage of perishable goods across the country, but also triggered equipment fires in several locations. The Paris prosecutor’s office has initiated an inquiry into the intrusion targeting networked cold-chain infrastructure across major French retail brands.
Impact Across French and European Retailers
The operational disruption severely hit leading French retail groups, such as Les Mousquetaires (Intermarché), E.Leclerc, and Coopérative U. Dominique Schelcher, president of Coopérative U, confirmed the cyberattack on Monday, condemning the sabotage of essential cold storage assets vital to national food security as exceptionally serious and unacceptable.
| Operational Metric | Standard Operation | During Cyberattack |
|---|---|---|
| Internal Cabinet Temperature | Refrigerated / Deep Freeze | Forced defrost up to 50 °C |
| Defrosting Duration | Max 2 hours per day | Continuous, non-stop operation |
| Estimated Financial Losses | Nominal operating costs | From €300,000 to millions of euros nationwide |
| Vulnerability Vector | Maintenance firm remote tunnels | Exploited Danfoss controller firmware/network |
While preliminary financial assessments place direct damages at around €300,000 for select retail clusters, the total bill encompassing inventory write-offs, hardware replacement, and business interruption is expected to mount into several million euros nationwide.
Simultaneous Disruptions Across the Netherlands and Belgium
The French incident coincided with technical disruptions elsewhere in Western Europe. According to Dutch broadcaster NOS, supermarket operators in the Netherlands and Belgium, including Albert Heijn, Etos, Gall & Gall, and Delhaize, experienced major IT anomalies on Sunday afternoon. In those stores, online ordering portals were suspended, customer loyalty systems failed, and electronic shelf labels stopped updating product pricing. Investigators are currently assessing whether the infrastructure disruptions across both regions stem from a coordinated campaign.
This attack underscores that internet-connected building management and operational technology (OT) systems represent critical single points of failure. Allowing third-party maintenance firms remote access without strict network isolation and physical fail-safes exposes vital facilities to physical damage. Retailers and industrial operators must implement hardware-level thermal limits and zero-trust segmentation for all cloud-connected controllers.
The jump from refrigeration to forced 50°C heating shows how dangerous IoT exploits can be. Did the hackers breach individual maintenance tunnels or Danfoss’s central management platform? I wonder if these systems lack basic hardware-level thermal cutoffs to prevent fires.