French Supermarket Cyberattacks Target Vulnerable Refrigeration Controllers
Hackers exploited known security flaws in internet-connected refrigeration systems to spoil food inventory.
1Widespread Refrigeration Sabotage
Unknown criminals compromised thousands of refrigeration controllers across nearly 700 French supermarkets. By remotely increasing temperatures to 122°F (50°C), the attackers caused significant food spoilage and triggered fires. This incident highlights the severe physical consequences of cyberattacks targeting operational technology, moving beyond traditional data theft into direct operational disruption and inventory destruction.
2Known Vulnerabilities Ignored
Security researchers at Claroty’s Team82 identified these critical flaws in August, warning that attackers could easily defrost food. Despite these public disclosures and earlier advisories from CISA regarding authentication bypass and arbitrary code execution, many systems remained unpatched. The attackers exploited outdated firmware on Danfoss and Copeland controllers that were left exposed online.
3Persistent Internet Exposure
Coalition’s security sensors identified over 2,600 refrigeration controllers with public-facing admin panels between September and October. Even after the French attacks, hundreds of these devices remain connected to the internet. Specifically, 206 Danfoss devices in French networks and 50 in the United States continue to present a critical, unpatched entry point for malicious actors.
4Manufacturer and Agency Responses
Danfoss released firmware update R4.3.1 to mitigate identified flaws, while Copeland acknowledged the vulnerabilities in their discontinued, end-of-life controller generations. Despite these patches, the adoption rate remains dangerously low. CISA has issued multiple advisories throughout 2025, documenting dozens of CVEs that allow attackers to bypass authentication and execute commands on these specific industrial control systems.
5The OT Security Gap
Tiago Henriques of Coalition emphasizes that digital risk extends far beyond standard workstations and email servers. The French incident serves as a primary example of how industrial devices, when connected to the internet without proper security hygiene, become immediate targets. Protecting business continuity requires proactive identification of these exposed access points before attackers exploit them.
6Industry Calls for Action
The Operational Technology Cybersecurity Coalition is urging CISA to issue a Binding Operational Directive. Members including Honeywell and Schneider Electric argue that baseline cybersecurity measures are essential to protect the food and agriculture sector. They believe the French attacks demonstrate an urgent need for federal intervention to prevent similar large-scale infrastructure compromises in the United States.
7Supply Chain Vulnerability
The incident underscores the fragility of modern retail supply chains when dependent on internet-connected refrigeration. Because these controllers often lack modern security updates, they represent a permanent risk if left accessible. Organizations must prioritize segmenting these devices from the public internet to prevent unauthorized access, as the cost of failure includes both inventory loss and physical damage.
8Strategic Security Implications
This event confirms that industrial devices are now primary targets for sophisticated cybercriminals seeking to cause real-world chaos. The gap between vulnerability disclosure and patch implementation remains the most critical failure point for retail operators. Moving forward, companies must treat operational technology security with the same urgency as enterprise IT, focusing on rapid patching and network isolation.