France’s national computer emergency team said Tuesday night that a cyberattack against supermarket refrigeration controls may still be unfolding, urging chains to keep compromised units offline until they are patched and reachable only through hardened networks.
The warning from CERT-FR landed as staff restocked aisles that had been emptied when hackers remotely triggered long defrost cycles, pushing display-case temperatures toward 50 degrees Celsius and spoiling meat, dairy and frozen goods across several major banners.
What authorities say is happening
In a bulletin circulated after the weekend wave, CERT-FR told grocers that attacks were “likely still underway” and that refrigerators with public internet addresses should be disconnected immediately. Stores that must reconnect equipment should do so only through a verified virtual private network or another protected path, install firmware updates and reset weak credentials, the agency said.
The Paris prosecutor’s cybercrime unit is investigating what officials have described as a large-scale intrusion into connected cooling systems. Prosecutors said reported damage included food losses and fires at affected sites, without specifying how many blazes were tied directly to the remote commands.
Scale across French retail
Finance Minister Roland Lescure told parliament Tuesday that about 700 of France’s roughly 10,000 supermarkets had been touched. He said national food supplies were not at risk but acknowledged the strike “touches the heart of our food security” because it targeted cold chains rather than checkout software.
Les Mousquetaires, which operates Intermarché and Netto, said about 150 of its stores were hit and that chilled inventory was discarded as a precaution. Coopérative U president Dominique Schelcher called the incident “extremely serious” in a message to staff, according to retailer statements cited by French media.
Controllers in the crosshairs
Early guidance focused on Danfoss AK-SC and AK-SM refrigeration controllers. CERT-FR later expanded its list to include Dixell and Copeland-branded interfaces after investigators found not every victim ran Danfoss kit. Vendor advisories mirrored the government checklist: change default passwords, tighten remote-access rules and upgrade older XWEB interface builds.
Retailers in the Netherlands also reported website outages and electronic shelf-label glitches over the same period, though French officials have centered their public warnings on temperature-control gear rather than point-of-sale networks.
What happens next
Chains are conducting line-by-line audits of which plants remain exposed while insurers tally spoilage costs that trade press reports already place in the hundreds of thousands of euros, with nationwide exposure potentially reaching several million. CERT-FR said it would keep publishing indicators as engineers map how attackers moved from internet-facing controllers into defrost schedules.
For shoppers, the immediate effect is patchy empty shelves in fresh departments as stores that were cleared for safety rush in replacement stock. For operators, the episode is a live test of whether food retailers can segment industrial control networks from the internet without breaking the remote monitoring they rely on to prevent exactly these kinds of thermal failures.