French Supermarkets Hit by OT Hack Forcing 122F Freezer Temps

A coordinated cyberattack struck hundreds of French supermarkets early Monday, compromising connected refrigeration systems and causing significant operational disruption. According to reports from AFP, attackers manipulated the controls of fridges and freezers, forcing them into defrost mode for several hours. This action raised internal temperatures to 50 degrees Celsius, or 122 degrees Fahrenheit, leading to widespread food spoilage. In some locations, the temperature spikes also resulted in fires breaking out within the store premises.

The risk

The incident highlights the vulnerability of operational technology (OT) when connected to public networks. Although the affected units were industrial controllers rather than consumer smart appliances, they maintained internet connectivity to manage defrost cycles, temperatures, and alarms remotely. The attackers exploited software vulnerabilities in two specific Danfoss system controllers: the AK-SM800 and the AK-SC355. Danfoss told Cooling Post that these specific systems were running outdated firmware.

Who is exposed

Three major French grocery chains confirmed they were affected by the intrusion. E. Leclerc, Intermarche, and Cooperative U reported that their stores experienced the temperature anomalies. Paris authorities informed AFP that other grocery chains were also hit, suggesting the scope of the attack may be wider than the initial reports indicated. Dominique Schelcher, CEO of Cooperative U, stated on X that an investigation is underway. He described the targeting of essential food preservation equipment as unprecedented and of extreme gravity.

Cost and compliance

The immediate cost involves the disposal of spoiled perishable goods and potential fire damage, though specific financial figures have not been released. Danfoss stated it is working with affected customers to implement mitigation measures. These steps include applying firmware updates where available, strengthening network protections, and removing direct internet exposure for the controllers. The company noted on its product page that new security measures are being implemented to address these risks.

What should you do?

Security teams should audit all operational technology devices for direct internet exposure. Verify that firmware on critical infrastructure controllers is current and patched. Isolate industrial control networks from general corporate networks to prevent lateral movement from compromised endpoints.

What to do and how to stay safe: Danfoss

• Inventory all OT devices and verify their current firmware versions against vendor security advisories.
• Remove unnecessary direct internet access from industrial controllers and place them behind strict firewalls.
• Monitor network logs for unusual traffic patterns or unauthorized configuration changes to refrigeration systems.
• Establish an incident response plan specifically for physical infrastructure failures caused by cyber intrusions.

Step-by-step guide: Mobile Security Architecture: 8 Practices for Device Integrity

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific Danfoss controllers were targeted in the French supermarket attack?

The attackers targeted the AK-SM800 and AK-SC355 system controllers running outdated firmware.

What was the maximum temperature reached in the compromised freezers?

Temperatures were raised to 50 degrees Celsius, which is equivalent to 122 degrees Fahrenheit.

Are there confirmed details about the threat actors responsible?

It is currently unclear who is responsible for the attacks or the exact exploit chain used.