HOC Shorts
A massive cyber attack targeted industrial refrigeration controllers across nearly 700 European supermarkets—primarily in France.
- The Method: Attackers exploited unpatched legacy Danfoss energy management controllers exposed to the internet, triggering automatic defrost cycles that raised temperatures up to 50°C (122°F).
- The Impact: Tons of spoiled food, store closures, millions in losses, and isolated fires from overheated compressors.
- The Takeaway: A stark warning about the risks of exposed Operational Technology (OT) and neglected IoT devices governing physical infrastructure.
Digital Sabotage on the Supermarket Aisle: How Hackers Melted France’s Cold Chain
PARIS —In what experts are calling an unprecedented cyberattack, hackers targeted refrigeration systems at hundreds of supermarkets across Europe. The attack caused cooling units to overheat, spoiling large quantities of food, disrupting store operations, and even triggering fires in some locations.
According to reports from The Guardian and local authorities, the attack struck roughly 700 supermarkets overnight, targeting major French retailers including Intermarché, Coopérative U, Carrefour, and E. Leclerc.
Rather than disabling the cooling units or demanding a traditional ransomware payout, the hackers manipulated internal industrial controllers to trigger aggressive automatic defrost cycles. Refrigerator and freezer temperatures plummeted upwards—climbing in some instances to as high as 50°C (122°F) and, in extreme cases, causing overheating that sparked physical fires inside store storage bays.
The Anatomy of the Attack: Legacy IoT at Fault
Investigators quickly traced the intrusion back to remote energy management controllers used to govern commercial cooling circuits.
As detailed in coverage by Gulf News, the targeted infrastructure relied heavily on industrial refrigeration control systems manufactured by Danish climate solutions giant Danfoss. Hackers specifically targeted older operational technology models—such as the legacy AK-SM800 series—running outdated firmware directly connected to public internet endpoints without sufficient firewalling or access controls.
By exploiting unpatched command-injection and authentication bypass vulnerabilities, attackers chained together exploits that allowed them to take administrative control of cooling schedules simultaneously across entire chains.
Tossing Tonnes of Produce: The Economic Impact
The physical fallout was immediate. Supermarket employees arriving for morning shifts were greeted by melted displays, spoiled meat and dairy products, and dense fog rolling out of ruined freezer aisles.
| Supermarket Chain | Outlets Affected | Primary Operational Impact |
| Intermarché & Netto | ~300 stores | Complete disposal of chilled/frozen inventory; manual reset needed. |
| Coopérative U | ~100 stores | Mass stock disposal; temporary store closures. |
| Carrefour | 80+ stores | Selective department shutdowns; cooling hardware reset. |
French Finance Minister Roland Lescure confirmed to Parliament that authorities are currently investigating the incident while European cybersecurity agency ENISA assesses whether neighboring countries face similar risks across shared supply networks.
A Warning Shot for Operational Technology (OT)
This incident highlights a growing danger in cybersecurity: cyber-physical risks. While corporate networks receive regular software updates, industrial machinery—such as HVAC units, water pumps, and refrigeration systems—is frequently left running on obsolete code for over a decade.
As French President Emmanuel Macron previously alerted national agencies regarding hybrid threats to critical infrastructure, this attack serves as a stark reminder: when industrial IoT controllers are left exposed to the web, a few lines of malicious code can transform ordinary appliances into destructive physical hazards.
