Supermarket refrigeration systems hacked across France, causing spoilage and fires

A coordinated cyberattack on refrigeration controllers at roughly 700 supermarkets in France caused defrosters to run long enough for internal temperatures to reach up to 50 °C (122 °F). The temperature rise spoiled large quantities of perishable goods and, in some locations, triggered electrical fires.

Investigators identified the compromised devices as internet-connected controllers supplied by Danfoss, Dixell and its parent company Copeland. All three models were found to have critical vulnerabilities that allowed remote login with administrator privileges. In some cases, daily passwords were generated from publicly available firmware and were identical across many stores, enabling attackers to access devices that had not been updated.

Security experts said the breach could have been prevented with standard measures such as removing the controllers from the public internet, using VPNs and IP allowlists, securing third-party equipment, changing default credentials and applying current firmware patches. Researchers at Pen Test Partners emphasized that “cyber hygiene would have prevented the access.”

Copeland acknowledged a vulnerability in a discontinued line of controllers and said it is working with customers to mitigate future risks. Danfoss did not immediately respond to inquiries.

The identity and motive of the attackers remain unknown, with possibilities ranging from vandalism to state-sponsored disruption. The incident underscores the tension between cost-saving decisions and security investments, as many businesses may only act after a major breach demonstrates the financial impact.