The Supermarket Fridge Hack Spread to a Second Night — and a Second System

PARIS

The supermarket fridge hack spread through a connected refrigeration system overnight — and it started with the cold rooms getting warm. Overnight from Sunday to Monday, October 12, hackers remotely forced connected fridges and freezers at several hundred French supermarkets up to 50 degrees Celsius — 122 degrees Fahrenheit — for about six hours, according to Reuters. Food spoiled. Fires broke out. And by Tuesday night, according to Le Monde as cited in a detailed explainer from The Raisina Hills, a second wave had hit businesses using a different manufacturer's refrigeration equipment, in a pattern investigators say resembles the first.

The first night, chain by chain

Reuters reported that the first wave centered on Intermarché stores. The chain's owner, Les Mousquetaires, said about 150 Intermarché stores were hit and that all food in the affected units had to be discarded — not discounted, not salvaged, discarded, because once a cold chain breaks for hours at those temperatures, nobody can responsibly sell what was inside. Carrefour said 80 of its stores were affected, Reuters reported, and Coopérative U was also hit.

The official count is larger than any single chain's. The Raisina Hills explainer, citing a LinkedIn alert from ANSSI director general Vincent Strubel, put the total at about 500 supermarkets, including roughly 300 Intermarché and Netto stores and about 100 Coopérative U stores. A figure of about 700 stores, attributed to Finance Minister Roland Lescure, has circulated in international coverage. Those numbers are not necessarily contradictory — chains report their own stores, the cybersecurity agency counts systems, and ministers speak in round totals while an investigation is still moving — but readers should know they come from different mouths, and we are attributing each one rather than blending them into a single false precision.

The human cost, in one town's ledger

Statistics about spoiled food can glide past a reader. This one should not. According to the Raisina Hills explainer, two Intermarché stores in Haguenau, in eastern France, told France Inter they had lost 270,000 euros worth of goods between them. That is fridges and freezers full of meat, dairy, frozen food and prepared meals, hauled out and thrown away by staff who arrived in the morning to discover that the machines they trust had spent the night cooking their inventory instead of chilling it.

The Paris prosecutor's office described the incident as a large-scale attack, according to Reuters, and said fires occurred at affected stores — a reminder that a refrigeration unit forced to heat is not just a data problem. It is an electrical appliance running in a way it was never meant to run, in a building full of packaging and stock. Prime Minister Sébastien Lecornu tasked ANSSI, France's cybersecurity agency, with investigating, Reuters reported, and France is coordinating with European counterparts.

How the attackers got in

ANSSI's alert, as summarized by The Raisina Hills and Informed Clearly, named the first wave's target: Danfoss AK-SM and AK-SC refrigeration controllers. These are the connected control systems that let engineers monitor and adjust a store's refrigeration remotely — genuinely useful technology for a chain with hundreds of sites, and, in this case, the doorway. When a controller that manages cold is reachable and compromised, the attacker does not need to touch a single store. They can change temperatures across an estate of shops from a keyboard, which is precisely what investigators say happened.

That is the uncomfortable lesson sitting inside this story for every business, not just French grocers. The systems that run physical things — cold rooms, heating, pumps, lifts — are increasingly connected to the internet for perfectly sensible maintenance reasons. Each connection is also a potential entrance. The fridge hack is vivid because the result is so tangible: warm freezers, empty shelves, skips full of ruined food. But the underlying pattern, an overlooked connected controller becoming the weakest point in a large operation, is one security professionals have warned about for years.

The second wave — and why tonight's angle is different

The development that makes this an evening story rather than a repeat of Monday's is what happened next. Le Monde reported, according to The Raisina Hills explainer, that overnight from Monday to Tuesday, businesses equipped with Dixell refrigeration equipment were targeted and temperatures rose dangerously, in a pattern resembling the previous night's attacks. If the first night suggested a single manufacturer's systems had been exploited, a second night involving a second manufacturer's equipment widens the question investigators have to answer: is this one campaign moving across platforms, or a vulnerability pattern shared by how these systems are installed and exposed?

France 3 Régions reported, via the same explainer, that a Leclerc store in the Tarn, in southern France, lost its cold chain on Tuesday morning and had to empty and discard all of its goods. The store was fitted with Dixell equipment. Dixell had not confirmed that it was targeted, according to the explainer — an important caveat, and we are keeping it attached to the claim rather than dropping it for a cleaner headline. Attribution is not decoration in a story like this; it is the difference between what is established and what is still being established.

Reuters also reported that the picture extends beyond France. Dutch operator Ahold Delhaize reported a security issue and took systems offline, according to Reuters — which is not the same as confirmation that its stores were hit the same way, and the coverage has been careful about that distinction. Sekoia analyst Félix Aimé told Reuters that Spain, Portugal, Poland, Germany and Belgium were also affected. If that assessment holds, the fridge hack is a European incident with a French center of gravity, not a purely French one.

What stores and shoppers face next

For the chains, the immediate work is unglamorous and expensive: checking every connected controller, cutting off remote access where it is not needed, replacing or updating vulnerable systems, and proving to insurers, regulators and customers that the cold chain can be trusted again. For shoppers, the visible effect is emptier fresh and frozen aisles in affected towns while stores restock — annoying on a weeknight, serious for families shopping on tight budgets, and a genuine problem in smaller communities where the supermarket that threw its food away may be the only one for miles.

There is also a food-waste dimension that deserves a sentence of its own. Hundreds of stores discarding their full fresh and frozen stock in the same week is an enormous quantity of food destroyed — food that farmers produced, drivers delivered and staff shelved — because a temperature setting was changed by someone who was never in the building. Few cyberattacks produce a photograph as plain as an emptied freezer aisle. This one does, and it explains why the French government is treating a supermarket incident with the seriousness usually reserved for attacks on utilities.

ANSSI's investigation, coordinated with European counterparts, will have to establish who did this and exactly how — questions that, as of tonight, remain open in the reporting. No responsible account we relied on names a culprit, and neither will we. What is established, across Reuters and the French reporting cited by The Raisina Hills, is the sequence: a first wave through Danfoss controllers on Sunday night, hundreds of stores and fires and six-figure losses in single towns, then a second wave reported against Dixell-equipped businesses on Monday night. Our news desk will follow ANSSI's findings as they are published.

Supermarkets run on trust in invisible systems. You trust that the freezer is cold because it has always been cold. This week in France, that trust turned out to rest on connected controllers that someone else could reach. The food is gone, the bill is real, and the investigation is now the story.