- La Dépêche reports that Danfoss refrigeration controls at Intermarché, Leclerc and Coopérative U stores were attacked on October 12, with defrosting forced on continuously at 50°C.
- The damage came from changing one legitimate setting, not from visible destruction. Reported losses are early estimates, and the entry method is not stated.
- Leaders should ask who can change building-system settings remotely, what limits reject unsafe values, and whether an independent alarm exists.
A freezer has one job: stay cold. The most useful thing an attacker can do to it may be to ask it to do another of its jobs, all day long. That is what La Dépêche reports happened to supermarket refrigeration in France on Monday, October 12.
A maintenance routine turned against the stock
Refrigeration units have an automatic defrost function. It clears ice so the equipment keeps working. La Dépêche says it is normally programmed to run for two hours a day.
According to the report, the attack set it to a forced, continuous cycle with the temperature fixed at 50 degrees Celsius. When staff opened fridges and freezers on Monday morning, a source told the paper that "a wave of heat" escaped.
This shows how physical harm can arrive without anything looking broken. Nothing in the report describes encrypted files or stolen data. The harm came from one legitimate setting, changed to an extreme value. A control system obeys whoever it believes is allowed to instruct it.
What is confirmed and what is not
Dominique Schelcher, president of Coopérative U, confirmed the attack on X. He wrote that a cyberattack had hit the cold-production installations of several stores in his network since the night before. He called it extremely serious, "inédit" (without precedent) and unacceptable, and promised an investigation.
La Dépêche reports that the affected controls are made by Danfoss and used by Intermarché, Leclerc and Coopérative U. The paper uses the conditional tense: the systems "would have been" hacked. The sources provided contain no statement from Danfoss.
They also do not say how the attackers reached the controllers. They do not say whether a product flaw, stolen credentials or a contractor's access was involved. Until that is known, no one should assume a cause.
The cost, and who carries it
La Dépêche puts the loss at several hundred thousand euros so far for the two chains. In Alsace alone, one Intermarché and one Leclerc store report 270,000 euros in losses between them. About 150 Intermarché stores are said to be affected.
The paper adds that the total could reach several million euros nationally. Metro stores and independent shops, butchers among them, use the same refrigeration control system. Tom's Hardware, summarising the same report, says early losses approach 300,000 euros. These are early estimates, not audited figures.
For a small butcher, a night of spoiled stock is not a rounding error. A shared control system also means shared exposure. One weakness, if there is one, would be present in many unrelated businesses.
A separate incident in the Netherlands
Tom's Hardware also cites NOS, which reports that Albert Heijn, Etos and Gall & Gall had websites taken down on Sunday, affecting deliveries. NOS says electronic shelf labels were also compromised, disrupting in-store pricing.
Tom's Hardware describes this as a separate report. The sources do not link it to the French refrigeration attack, so the two should not be treated as one event.
Questions to put to your team
Most retail security reviews focus on payment systems and customer data. This incident points at the equipment behind the shop floor. Five questions are worth asking this week.
First, which building systems can be changed remotely: refrigeration, heating, shelf labels? Who holds that access, including outside contractors? Second, does each controller reject settings outside a safe range, such as a defrost cycle far longer than two hours? Third, does a separate temperature sensor raise an alarm that the controller cannot silence? Fourth, can staff switch to manual control and check stock at night? Fifth, does insurance cover spoiled stock caused by a cyber event?
Security teams guard data. A freezer guards dinner. Each needs a named owner. The attacker did not need to break the equipment, only to persuade it to do its job too well.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: La Dépêche.
