Hackers Heated French Fridges to 50°C — and Lit Fires

By the TechPulse USA Paris and New York desks

Sometime overnight between Sunday and Monday, the fridges in hundreds of French supermarkets started getting warmer. Not a little warmer — they were driven to 50 degrees Celsius, 122 Fahrenheit, and held there for hours, while the food inside them cooked. By dawn, store managers across France were opening their doors to the smell of spoiled meat and dairy, and a country woke up to the strangest cyberattack in its history: somebody hacked the cold.

The Paris prosecutor's office has opened an investigation into what it calls a "large-scale" attack "affecting connected refrigerators in several major food retailers across France." The reported damage, per prosecutors speaking to AFP: "food losses and fires." Yes, fires — when you force a refrigeration unit into an hours-long defrost cycle at oven temperatures, things burn.

The scale is still coming into focus, but it is already enormous. Between 250 and 350 stores were affected, according to French outlet reporting gathered by BleepingComputer. Les Mousquetaires, which owns Intermarché, said around 150 of its stores were hit, with fridges held at 50°C for six hours — and threw all the food away "to avoid any sanitary risks," a spokesperson told CNA. Carrefour told CNA that 80 of its supermarkets were hit, though "the vast majority" of its 6,000 stores were unaffected. Coopérative U — Hyper U, Super U, U Express — confirmed its stores were attacked too. EU agriculture and food commissioner Christophe Hansen publicly named France's largest chain, E.Leclerc, as one of the victims. Monoprix and Auchan did not respond to requests for comment.

Photo: a supermarket freezer aisle (file photo, US store). The French attacks targeted the controllers behind fridges like these, turning them from cold rooms into heaters overnight. Credit: Phillip Pessar, Wikimedia Commons (CC BY 2.0).

How you turn a fridge into an oven: the Danfoss connection

The attackers did not smash anything. They walked in through software — specifically, the control systems made by Danish manufacturer Danfoss, which regulate refrigeration and HVAC equipment across the food-retail sector. According to BFMTV reporting, the intruders targeted outdated versions of Danfoss refrigeration control software, gained remote access, and triggered a forced defrost cycle with a temperature setpoint around 50°C.

Here is the detail that should chill you: a defrost cycle is a normal, protective function of commercial refrigeration. The attackers did not break the machines. They used the machines exactly as designed — just with the temperature set to "oven." That is what makes this attack so insidious, and so hard to defend against. The malicious command looked, to the system, like a legitimate one.

It did not come out of nowhere. In August 2026, security researchers at Claroty's Team82 presented findings at DEF CON 34 showing that Danfoss's AK-SM 800A controller could be compromised to disable cooling while falsifying temperature readings — in other words, the same hardware family could be attacked silently. And back in May 2025, the US Cybersecurity and Infrastructure Security Agency warned of a high-severity authentication-bypass vulnerability, CVE-2025-41450, in the Danfoss AK-SM 8xxA platform. No one has confirmed that this flaw is the door the attackers walked through — but the door was known, documented, and left open.

"Of extreme gravity and unprecedented"

The reaction from Paris has been swift and furious. Prime Minister Sébastien Lecornu instructed France's national cybersecurity agency, ANSSI, to investigate; a person in his office told CNA that ANSSI had identified a vulnerability in software supplied by Danfoss. France is "coordinating with its European counterparts, as other countries may also be affected," while checking whether other French firms are at risk.

Dominique Schelcher, the president of Coopérative U, took to X to describe the attack as being "of extreme gravity and is unprecedented," writing that "targeting equipment essential to the preservation of fresh products and to the food supply of the French people" was unacceptable. In a fuller statement carried by BleepingComputer, he confirmed the attack had been running "since last night," said teams were "fully mobilized, working alongside refrigeration specialists," and promised "an investigation will be conducted to shed full light on this attack."

For its part, Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems," that the affected units "were running outdated firmware," and that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions." Translation: the patches existed, the customers didn't apply them. Expect that argument to be tested hard in the weeks ahead — because when your controller's design allows a remote command to set a 50°C defrost, "update your firmware" is not the whole story.

Photo: a Carrefour hypermarket in Cusset, France (file photo). Carrefour confirmed 80 of its supermarkets were hit; two stores in Haguenau, Alsace, reported €270,000 in damages. Credit: TCY, Wikimedia Commons (CC BY 3.0).

The Dutch shadow: Ahold Delhaize goes dark the same morning

Here is where the story gets darker. On the very same Monday morning, Dutch retail giant Ahold Delhaize — one of the world's largest food retailers — announced it was dealing with a "security issue" in its network and had taken several systems offline to protect them. The damage: websites, apps and customer service down for Albert Heijn, Etos and Gall & Gall in the Netherlands and Delhaize in Belgium; online grocery deliveries suspended; loyalty programmes and electronic shelf labels knocked out, with price tags "often displaying the wrong information." Albert Heijn's stores stayed open, but the company — which published the incident as inside information under EU market-abuse rules, a sign it could move the share price — said it could not say when services would return.

The American angle is real too. Ahold Delhaize owns Stop & Shop, Giant, Hannaford and Food Lion in the US — the fourth-largest grocery retailer in the country, with more than 9,400 stores, nearly 400,000 employees and around 60 million customers a week. On Monday, the US chains' websites carried "site temporarily down" notices, and Stop & Shop employees reported trouble accessing schedules and pay stubs. Online orders are about 10 per cent of Albert Heijn's sales, and Dutch news agency ANP reported rival grocers saw an influx of delivery orders — a small, human detail that tells you how much of daily life now runs through these systems.

Is it connected to the French fridge hack? "It was not clear," CNA reported. BleepingComputer was equally careful: "there is no evidence yet that the two are connected." But two countries' grocery infrastructure going down on the same morning is the kind of coincidence that keeps security researchers — and, now, prime ministers — awake. France is already coordinating with European counterparts on the assumption that other countries may be affected. If the Ahold Delhaize outage turns out to be the second front of the same campaign, Europe is looking at the first coordinated cyberattack on its food supply.

Our take: the softest critical target in Europe

Step back and consider what actually happened. Nobody exfiltrated a database. Nobody encrypted a server for ransom. The attackers reached into the operational technology — the OT layer, the unglamorous control systems that run the physical world — and turned a safety feature into a weapon. They did not even need malware worthy of the name; they needed credentials or a known vulnerability and the patience to run a defrost cycle all night.

This is the nightmare scenario that security people have been warning about for a decade, finally arriving in the dairy aisle. Power grids, water plants, hospitals — everyone hardens those. But the refrigeration controller in the back room of a supermarket in Haguenau? That runs outdated firmware because nobody's bonus depends on patching it, and it sits on a network because remote monitoring is cheaper than sending a technician. Multiply that by tens of thousands of stores and you have a distributed attack surface that no single company owns and no government fully maps.

And the money is real. Two stores in Haguenau alone reported €270,000 — about $302,000 — in damages, per BFMTV. Nationwide estimates already run into the millions of euros, and the bills for restocking, sanitising and investigating have barely started. Add the Dutch outage, and Europe's grocery sector is eating a nine-figure week before anyone has named an attacker.

Expect three things next: ANSSI's technical report, which will tell us the actual intrusion vector; a brutal week for Danfoss, whose "outdated firmware" defence will be weighed against a controller design that lets a remote command set a 50°C setpoint; and a serious conversation in Brussels about whether food-retail OT belongs on the critical-infrastructure list. Until then, the lesson is sitting in every French freezer aisle this morning: the internet of things was supposed to make the physical world smart. Last night it made it hot.

Related reading: when AI systems go rogue, the damage rarely stays digital — see our report on Claude Code agents stealing 628,000 Ukrainian records for a Russian broker, and AI agents' attempted hack on Canadian systems.

Sources: CNA (Paris/AFP/Reuters material), BleepingComputer (Bill Toulas), RetailDetail EU, CyPro, France in English, BFMTV reporting via carriers; statements from Dominique Schelcher (Coopérative U), Christophe Hansen (European Commission), Sébastien Lecornu's office, Danfoss, Ahold Delhaize, CISA advisory archive (May 2025, CVE-2025-41450), Claroty Team82 (DEF CON 34).

TechPulse USA is an independent tech and AI news publication. Our Paris desk covers European tech and cybersecurity; our New York desk covers the companies and capital flows shaping the AI era.

 

France fridge-hack FAQ

What happened? Attackers remotely forced Danfoss refrigeration controllers into defrost mode at up to 50°C overnight on October 11-12, spoiling food across hundreds of French supermarket stores.

How many stores? Around 400 per BFMTV's later estimates — roughly 300 Intermarché and Netto outlets plus nearly 100 Coopérative U stores, with Leclerc, Carrefour Market and Monoprix also hit.

What did it cost? Two supermarkets in Alsace lost €270,000 in stock; nationwide losses are expected to reach millions of euros.

Who's investigating? The Paris prosecutor opened a probe into the food losses and fires; France's ANSSI cyber agency identified a vulnerability in Danfoss's software, contacted the Danish vendor, and is coordinating with EU counterparts.

What does Danfoss say? The company says the affected units were running outdated firmware it had "long advised" customers to update.

What about the Ahold Delhaize outage the same morning? There's no evidence of a link — treat the two incidents as separate until proven otherwise.

Related: Wikipedia's demand: who gets sued when AI agents go rogue