Danfoss fridges hit 50°C: how a known flaw cooked French supermarket food

Hundreds of French supermarkets lost control of their refrigeration systems this week after attackers manipulated the software that regulates cold-unit temperatures, forcing some fridges and freezers to warm to 50°C (120°F) overnight. The result was millions of euros in spoiled fresh and frozen food, at least some fires, and a national cybersecurity investigation.

The attack targeted remote-management software from Danish engineering firm Danfoss, which lets operators monitor and adjust cold units across store networks. Coopérative U said more than 100 of its supermarkets were hit. Intermarché and its Netto brand had 180 stores affected, and a spokesman said another 100 shops were urgently disconnected from the internet to prevent the same outcome. Les Mousquetaires said about 150 Intermarché stores ran at 50°C for six hours. Carrefour, Monoprix and E.Leclerc were also hit.

Danfoss said the affected units were older models whose security software could not be updated to address a risk it had identified. That detail matters more than the headline number of stores. The vulnerability was not a novel zero-day in a current product; it was a known weakness in legacy equipment that could not receive a patch. Once attackers reached the management layer, they had a direct, remote path to physical processes — in this case, temperature setpoints.

The Paris prosecutor's office opened an investigation and cited food losses and fires as damage. Prime Minister Sébastien Lecornu instructed national cybersecurity agency ANSSI to investigate, and France said it was coordinating with European counterparts because other countries may also be affected. The chief executive of Coopérative U called the attack "extremely serious and unprecedented."

What is clear is the attack class. Internet-connected industrial control systems in retail are not abstract targets; they are the same systems that keep food safe. When those systems run unpatchable software, the supply-chain risk is systemic and crosses borders.