Thursday 15 October 2026
Afternoon Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Mass hack of refrigeration systems at 700 French supermarkets causes spoilage and fires

Vulnerable internet-connected controllers exploited in widespread attack, raising questions about IoT security

By LineZotpaper
Published
Read Time2 min
A coordinated cyber attack on refrigeration systems at an estimated 700 supermarkets across France has caused widespread food spoilage and, in some cases, electrical fires, French authorities have reported. The incident, which occurred earlier this week, involved the exploitation of known security flaws in internet-connected controllers used to remotely manage store-wide refrigeration and freezer systems.

French authorities say the hack targeted entire fleets of refrigerators and freezers, with attackers remotely activating defrosters for extended periods. This caused temperatures inside the units to reach as high as 50 degrees Celsius (122 degrees Fahrenheit), spoiling untold quantities of perishable goods. In some instances, the electrical systems caught fire.

Security advisories and public research from cybersecurity agencies indicate that all three models of controllers involved in the attack—manufactured by Danfoss of Denmark and Dixell and its US-based parent company Copeland—contain critical vulnerabilities. These flaws allow attackers to log in remotely with administrative privileges. According to reports, Danfoss controllers, for example, used a daily-changing password that was generated by publicly available firmware based on the date. An attacker analyzing the code could replicate the password for any device that had not received a recent update. The daily passwords were identical across all models, meaning a single exploit could compromise hundreds or thousands of stores.

The attack highlights ongoing risks posed by insecure internet of things (IoT) devices in critical commercial infrastructure. The vulnerabilities had been documented in multiple advisories prior to the incident, raising questions about why affected systems had not been patched. The identity and motive of the attackers remain unknown.

While the full financial impact is still being assessed, the incident is expected to cost affected supermarkets millions of euros in lost stock, cleanup, and system repairs. French authorities are investigating the attack, and regulators may consider new requirements for securing connected industrial equipment.

§

Analysis

Why This Matters

  • The hack directly disrupted food supply chains and public safety, with fires reported at some locations.
  • The attack exploited vulnerabilities that had been publicly known, underscoring persistent weaknesses in IoT security.
  • The scale of the incident — 700 stores across an entire country — shows how unpatched systems can be weaponised for mass disruption.

Background

Internet-connected controllers for commercial refrigeration have become standard in large supermarket chains, allowing technicians to monitor and adjust temperatures remotely. However, many such industrial control systems were designed years ago with limited security, and manufacturers have been slow to issue patches. The vulnerabilities exploited in this attack had been flagged in advisories from cybersecurity agencies, yet many systems remained unpatched. This incident is the latest in a series of attacks on critical infrastructure that demonstrate the consequences of poor cyber hygiene.

Key Perspectives

French authorities: Confirmed the attack and its severity, focusing on public safety and the economic damage from spoilage and fires. Cybersecurity researchers: Point out that all three controller models had known, easily exploitable flaws and that basic security measures — such as unique credentials or regular patching — would likely have prevented the attack. Supermarket operators: Face significant operational disruption, financial losses from spoiled stock, and reputational damage. Many will now be reconsidering the security of their connected equipment.

What to Watch

  • Whether the affected vendors issue emergency patches and how quickly stores apply them.
  • The outcome of the French investigation, including possible attribution of the attackers.
  • Potential regulatory actions by French or European authorities to mandate stronger security for IoT devices in critical commercial settings.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe