Hackers forced ~700 French supermarket fridges into defrost; food spoiled

Hundreds of French grocery stores lost chilled and frozen stock after attackers remotely drove commercial refrigeration controllers into prolonged defrost. CNN, citing local reporting and French authorities, puts the impact near 700 retailers.

What happened

Fridge and freezer aisles often use networked controllers so service firms can adjust temperatures. Attackers reached those controllers, triggered built-in defrost modes and removed limits that normally keep temperatures safe. Cabinets reportedly peaked around 50°C (122°F) for hours overnight; some displays caught fire. Staff later found meltwater and spoiled goods.

French Economy Minister Roland Lescure called the incident a “wake-up call.” Paris prosecutors opened a national case; ANSSI, France’s cyber agency, is investigating. No group has publicly claimed the attack or demanded a ransom, according to researchers quoted by CNN.

Which gear was hit

ANSSI told CNN that controllers from at least Danfoss, Copeland and Dixell (Copeland-owned) were involved. Danfoss said many affected units were on outdated or unsupported software and urged firmware updates. Copeland pointed to a discontinued controller generation and said it was working with customers.

Earlier in 2025, security firm Claroty documented serious flaws in Danfoss AK-SM 800A gear (authentication bypass and remote code execution among them); CISA had also warned about related issues. Researchers noted large numbers of such management interfaces exposed on the public internet in France before the incident.

Retail impact

Chains including Carrefour, Monoprix, Les Mousquetaires and Coopérative U reported hit stores (tens to low hundreds per brand, depending on the retailer). Similar exposure was reported in other European countries, though France dominated headlines.

For shoppers, officials downplayed nationwide food shortages. For operators of any IoT industrial gear — including smart-building HVAC and cold storage — the episode is a blunt reminder that “connected for convenience” without patching is a liability.