French Supermarkets Suffer Spoiled Stock After Freezer Temperatures Rise

Malicious actors manipulated internet-connected refrigeration systems in French supermarkets, causing freezers to overheat and spoil stock. According to The Cyber Express, attackers targeted ageing connected devices that remained online despite lacking manufacturer support. The campaign did not employ new exploits but instead abused existing controls on legacy hardware. This resulted in significant physical damage, including melted equipment and store fires, alongside substantial financial losses from perished goods.

How it unfolded

• Attackers gained remote control of internet-connected refrigeration units in French supermarkets overnight.
• They triggered a forced defrost option, causing units to heat rather than cool while stores were closed.
• Temperatures inside fridges and freezers rose to 50 degrees Celsius, leading to food spoilage and fires.

Who is affected

Major French retail chains confirmed the impact of the incident on Monday. According to The Cyber Express, retailers including E.Leclerc, Intermarché and Carrefour were among those affected. The Cyber Express reported that hundreds of supermarkets experienced the issue. Tonnes of food perished across the affected locations. In some instances, the excessive heat generated by the malfunctioning units sparked fires within the stores. The disruption also impacted grocery deliveries, extending the operational impact beyond immediate stock loss.

The fix

The attack targeted ageing connected devices that were still online years after their manufacturer stopped supporting them. The Cyber Express noted that the attack did not use a new exploit. Because the vulnerability relied on the continued operation of unsupported legacy hardware, no specific software patch or update was mentioned in the reporting. The incident highlights the risks of maintaining outdated industrial control systems in active retail environments without adequate network isolation or replacement strategies.

What analysts watch for

Teams usually examine network traffic for unusual commands sent to industrial control systems. Analysts check whether legacy devices are communicating with unexpected external endpoints. They review system logs for triggered maintenance functions, such as forced defrost cycles, occurring outside scheduled windows. Investigators also assess whether outdated hardware remains connected to the corporate network without segmentation. This helps identify if attackers are exploiting known functionalities of unsupported devices rather than seeking new software vulnerabilities.

What to do and how to stay safe: E.Leclerc

• Inventory all internet-connected refrigeration and HVAC units to identify unsupported legacy models.
• Segment industrial control system networks from general corporate networks to limit remote access.
• Monitor device logs for unexpected maintenance commands or temperature anomalies during closed hours.
• Consult vendors on decommissioning plans for hardware that no longer receives security updates.

Step-by-step guide: Incident Response Plans: Real Benefits and Hidden Costs

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the attackers use a new vulnerability to compromise the freezers?

No, The Cyber Express reported that the attack did not use a new exploit.

What temperature did the freezers reach during the attack?

Attackers pushed fridge and freezer temperatures as high as 50 degrees Celsius.

Which retailers confirmed they were affected by this incident?

E.Leclerc, Intermarché and Carrefour were among the retailers that confirmed the impact.