Hackers remotely hijacked refrigeration control systems at hundreds of French supermarkets, forcing defrost cycles that pushed temperatures to 50°C, destroying fresh and frozen stock and sparking fires at several locations. The attack struck Sunday night and rolled through Monday, hitting at least 300 Intermarché/Netto stores, 100+ Coopérative U outlets, 80 Carrefour locations, roughly 5 percent of Monoprix's 490 stores, and an unspecified number of E Leclerc branches. Intermarché CEO Thierry Cotillard estimated nationwide losses at "tens of millions of euros in a single day." The attack vector was brutally simple. Supermarket cold aisles run on centralized control panels accessible over the internet so maintenance companies can adjust settings remotely. France's cybersecurity agency ANSSI identified a vulnerability in software supplied by Danish company Danfoss, which confirmed the affected units were running outdated firmware. Danfoss said it had "long advised customers" to update — which is corporate for "we told you so and you didn't listen." Cybersecurity firm Claroty had published research on August 9 describing authentication-bypass vulnerabilities in Danfoss systems. The attack came days later. The structural problem is not one Danish firmware vendor. It is the architecture of modern retail infrastructure: internet-connected operational technology (OT) with no air gap between the public internet and equipment that keeps food safe. Every store's entire refrigeration fleet is controlled from a single panel reachable from anywhere. That is a feature for convenience and a catastrophe for resilience. There is no fallback — when the system is compromised, the only option is to throw away everything fresh and frozen. Prime Minister Sébastien Lecornu ordered ANSSI to investigate. France is coordinating with European counterparts because the attack is not contained to French borders: Spain, Portugal, Poland, Germany, and Belgium have also been affected, according to Sekoia analyst Félix Aimé. The attack pattern resembles disruptions at about a dozen US military commissaries in late August where refrigeration failures caused food losses. Whether the same actor is responsible remains an open question, but the playbook is converging. The retail federation FCD demanded "full transparency" from Danfoss, and some stores were already operational again by Monday. But the deeper question is why critical food-supply infrastructure was running on internet-exposed systems with known unpatched vulnerabilities. Danfoss disclosed, Claroty published, and attackers exploited — all within days. The patch-to-exploit window has collapsed, and the retail sector's operational technology was not built for that tempo. This is not a data breach. No customer records were stolen. The attack targeted the physical world through the digital one — spoiling food, causing fires, disrupting supply for millions of French consumers. It is a template for infrastructure attacks that bypass IT entirely and go straight for operational technology. The lesson is transferable to water systems, power grids, HVAC in hospitals, and any sector where convenience-driven internet connectivity has outrun security investment. The cost falls entirely on consumers and retail workers. Retailers absorb inventory losses, pass costs forward through pricing or insurance, and employees deal with the chaos. The attackers — unidentified as of reporting — extracted nothing of monetary value from the stores themselves. The attack was either a demonstration, a geopolitical signal, or a precursor to a ransom demand not yet public. Whatever the motive, the vulnerability is structural and the fix is not a firmware update — it is a rethinking of how food-supply OT connects to the public internet.
