Hackers remotely heated French supermarket freezers to 50C, spoiling millions in food

Today’s Focus

Hundreds of French supermarkets were hit by a cyberattack over the weekend that remotely raised the temperature inside their refrigerators and freezers, spoiling fresh and frozen inventory estimated to be worth millions of euros, according to BBC and Reuters reporting.

Intermarché said its fridges climbed to 50C (120F) for about six hours overnight into Monday, and the chain discarded all affected food to avoid health risks, Reuters reported. At least 300 Intermarché and Netto locations were affected, AFP said, along with more than 100 stores operated by Coopérative U.

Coopérative U chief executive Dominique Schelcher described the intrusion on X as “extremely serious and unprecedented,” saying the attack began Sunday night and that his teams were working to restore systems, according to The Guardian.

French broadcaster BFMTV reported that E. Leclerc, France’s largest supermarket chain, also saw hackers remotely trigger forced defrosting in numerous outlets, though Leclerc did not immediately confirm. BFMTV published an image of an ice cream freezer reading 26.5C, and said two stores in Alsace alone reported combined losses of €270,000.

The Paris prosecutor’s office told AFP it had opened an investigation into what it called a “large-scale cyber-attack affecting the refrigerators of several major food retail chains across France.” The Guardian reported that prosecutors also noted outbreaks of fire linked to the incident.

European Food Commissioner Christophe Hansen condemned the attack on X and said food security “requires more attention,” the BBC reported. No group has publicly claimed responsibility, and investigators have not identified a suspect or motive as of Monday.

The Debate

Supporters argue

There is no political constituency defending the attack itself. The debate centers on what Europe should do in response, and here advocates of stricter cybersecurity rules say the incident vindicates their push for tougher mandates on connected industrial equipment.

Commissioner Hansen argued on X that food security must be elevated as a strategic priority alongside energy and defense, framing the attack as evidence that supply-chain resilience cannot be left to individual retailers, according to the BBC.

Coopérative U’s Schelcher called the targeting of equipment “essential to the preservation of fresh products and to the food supply of the French people” unacceptable, in comments quoted by The Guardian, and said a full investigation was needed. Industry groups aligned with the European Commission’s NIS2 directive, which expanded cybersecurity obligations for operators of essential services, have long argued that food distribution belongs in the same regulated tier as power grids and hospitals.

Supporters of that approach point to the Paris prosecutor’s rapid opening of a criminal probe as a sign the state now treats refrigeration-system intrusions as critical-infrastructure crimes, not ordinary business losses.

Critics argue

Critics of broader mandates, including French retail trade associations and some center-right lawmakers, caution against using a single incident to justify sweeping new rules on small and midsize operators who already face thin margins.

They note that Intermarché and Coopérative U are cooperatives of independent grocers, and that layering further compliance costs on individual store owners may not meaningfully improve security if the vulnerability sat with a third-party refrigeration software vendor, a point raised in BFMTV’s coverage of the industry response.

Civil-liberties advocates and digital-rights groups such as La Quadrature du Net have also warned in past debates over French cybersecurity law that expansive incident-reporting regimes can centralize sensitive data and expand state surveillance powers without clear evidence of better outcomes.

Some industry voices, quoted by The Guardian, have questioned the “unprecedented” framing, noting that ransomware and sabotage attacks on European retailers and logistics firms have grown steadily since 2021. They argue the policy conversation should focus narrowly on securing operational technology supply chains rather than on new blanket obligations.

What the experts say

Independent cybersecurity researchers have warned for years that internet-connected building management systems, including commercial refrigeration, are a soft target. A 2023 study by the European Union Agency for Cybersecurity (ENISA) found that the food and beverage sector reported the fastest-growing share of operational-technology incidents among critical sectors it tracks, with ransomware the dominant attack type.

Lior Frenkel, head of the Israeli OT-security firm Waterfall and a frequent contributor to industry reports, has written that refrigeration controllers often ship with default credentials and remote-management interfaces exposed to the public internet. The nonprofit Shadowserver Foundation has catalogued thousands of such devices reachable online across Europe in its scanning reports.

The Carnegie Endowment for International Peace noted in a 2024 analysis by scholar Jon Bateman that attacks on food logistics, including the 2021 JBS meatpacking ransomware incident that disrupted roughly a fifth of U.S. beef processing, show how narrow technical intrusions can cascade into national supply shocks. France’s national cybersecurity agency, ANSSI, has repeatedly flagged connected industrial systems as under-protected in its annual threat reports.

By the Numbers

50C (120F): peak temperature Intermarché said its refrigeration units reached for about six hours overnight into Monday, according to Reuters.

300+: Intermarché and Netto stores affected by the attack, according to AFP.

100+: Coopérative U supermarkets targeted, according to the chain’s chief executive as quoted by the BBC.

150-200: Intermarché shops the retailer told The Guardian were hit, a figure overlapping with AFP’s broader count that includes Netto branches.

€270,000: combined losses reported by two supermarkets in the Alsace region, according to BFMTV.

26.5C: temperature displayed on an ice cream freezer photographed by BFMTV during the incident.

1 in 5: share of U.S. beef processing disrupted by the 2021 JBS ransomware attack, per Carnegie Endowment analysis, offered as a comparison point for food-sector cyber risk.