When Hackers Reach the Thermostat: The French Supermarket Attack and the Coming War on Physical Infrastructure
On the night of October 11, attackers remotely reset the refrigeration controllers in hundreds of French supermarkets, pushing freezers to 50 degrees Celsius for roughly six hours. Food spoiled, fires broke out, and losses ran into the tens of millions of euros. Nobody stole a password or encrypted a file. The attackers changed a temperature setting. This is the first large-scale cyberattack on a nation's food cold chain, carried out through one manufacturer's aging controllers, the same class of equipment that keeps vaccines, meat, and medicine cold across Africa. The lesson is not about France. It is about every operator who has never asked who can reach the thermostat.
What Happened
Between Sunday night and Monday morning, the central control panels that manage refrigeration in French supermarkets began receiving commands that no store had issued. According to BFM-TV, which first reported the attack, the intruders triggered a forced defrost cycle and set temperatures to 50 degrees Celsius. Le Monde reported that in some cold rooms the attackers also stretched the defrost cycle from one hour to eight to delay the alarms. Staff arrived to find melted ice cream, spoiled meat, and, in some stores, smoke.
The scale is the largest ever recorded for a cyber-physical attack on retail:
Intermarché and Netto, owned by Les Mousquetaires, reported between 150 and 300 stores affected depending on the source. Chief executive Thierry Cotillard told BFM-TV the losses reached tens of millions of euros in a single day.
Coopérative U confirmed fewer than 100 stores. CEO Dominique Schelcher called the attack unprecedented and said it targeted equipment essential to the French people's food supply.
Carrefour reported about 80 outlets, Monoprix about 30, and E.Leclerc several stores.
The Paris prosecutor's office opened an investigation into what it called a large-scale attack that led to food losses and fires. Prime Minister Sébastien Lecornu directed France's national cybersecurity agency, ANSSI, to investigate and to coordinate with European counterparts. Reuters reported that stores in Spain, Portugal, Poland, Germany, and Belgium were also affected, although no other government has confirmed a breach.
"Nobody stole a password or encrypted a file. The attackers changed a temperature setting."
One Vendor, Hundreds of Victims
Every affected store shares one feature. ANSSI's alert identified the compromised equipment as two product series made by the Danish manufacturer Danfoss, the AK-SC and AK-SM refrigeration controllers. Danfoss said it was aware of incidents affecting a limited number of systems, that the affected units were running outdated firmware, and that it had long advised customers to update or replace them. Investigators have not said how the attackers got in, and no group or state has claimed responsibility.
Readers should separate three facts that are being blurred in coverage:
Danfoss was not the direct target. Supermarkets buy from refrigeration contractors who install the controllers and often manage them over the internet so a technician can adjust a freezer from anywhere. ANSSI noted that exposing those interfaces to the internet is contrary to good practice.
The weakness was known. In August 2025, the security firm Claroty disclosed flaws in the Danfoss AK-SM 800A controller that could let an intruder bypass the login, and found thousands of controller interfaces reachable from the public web. Danfoss patched the flaws. No one has said whether they were used in this attack.
This is distinct from two other incidents. Intermarché confirmed a leak of 287,605 customer records from its online ordering service in August 2026. On October 12, the Dutch retailer Ahold Delhaize, parent of Stop & Shop, Hannaford, Food Lion, and Giant in the United States, took its websites offline after a separate security issue. There is no established link to the French attack.
The structural pattern is familiar. Last week, OSRS described how attackers hijacked small national domain registries in Ghana and Sierra Leone to forge certificates for global brands. This attack follows the same logic in the physical world. The adversary did not breach Carrefour or Intermarché. It breached the small supplier beneath them, and it reached every store at once.
Why Africa Should Read This as a Warning
A supermarket freezer is a low-stakes target. A vaccine cold room is not. The same families of controllers that failed in France run pharmaceutical warehouses, food import terminals, and blood banks on every continent. Internet scans cited by TIME found exposed Danfoss controllers in South Africa, the United States, and the United Kingdom, with France holding nearly 60 percent of the world's visible units. Nobody has published a comparable count for Nigeria, Ghana, or Kenya. That silence should not be mistaken for safety.
Three features make the region's cold chains more exposed than France's:
Longer equipment life. Danfoss says the affected French units were legacy models that no longer receive security updates. Controllers in African facilities are, on average, older and replaced less often.
More remote management. Where skilled refrigeration technicians are scarce, contractors manage sites from a distance, which means more interfaces reachable from the internet.
Thinner margins for error. A French supermarket lost a day of stock. A vaccine warehouse that loses its cold chain loses a national immunization campaign, and the loss may not be noticed until the doses fail.
"A supermarket freezer is a low-stakes target. A vaccine cold room is not."
An Analyst's View: Who Benefits, and What Comes Next
The attack has no public attribution, so the honest analysis is to reason from the evidence. Three readings deserve weight.
First, this looks like sabotage, not extortion. No ransom demand has been reported, no data was taken, and the method destroyed value rather than holding it. Criminal groups prefer leverage. Someone who sets freezers to 50 degrees and stretches the defrost cycle to hide the alarm wants damage, and wants it noticed the next morning.
Second, the reach suggests preparation. Hitting hundreds of stores across six brands in one night requires a list of reachable controllers assembled in advance. The exposure maps have been public since Claroty's research, and the United States' CISA published a parallel advisory on Copeland's competing XWEB Pro controllers in February. A patient adversary had more than a year to build a target list.
Third, the precedent is spreading. In late August, at least six United States military commissaries reported refrigeration outages that spoiled chilled stock; Army investigators have not said what caused them. The European Union's agriculture commissioner, Christophe Hansen, warned after the French attack that the weaponization of food has become a reality.
Practical steps for the audiences OSRS serves:
Security agencies: Inventory every internet-reachable refrigeration and building controller in critical facilities. The Claroty and CISA advisories give the model numbers to search for.
Policymakers: Classify national vaccine and food cold chains as critical infrastructure with mandatory patching timelines and incident reporting.
Facility operators and business leaders: Remove remote management from the public internet, restrict it to known addresses, require a second factor, and replace controllers the manufacturer no longer supports. Test what happens when a freezer is set to 50 degrees at 2 a.m. and ask who gets the alarm.
Insurers and boards: Intermarché has warned that standard policies may not cover this type of in-store loss. Review coverage before the next incident, not after.
The Bottom Line
The French attack is the first proof at national scale that a keyboard can spoil a country's food. It worked because a handful of aging controllers were reachable from the internet, because the flaws were documented and unpatched, and because no one treated a refrigeration contractor as a security boundary. Those conditions exist in Lagos, Accra, and Nairobi as surely as in Lyon. The organizations that act now, by mapping their controllers, closing remote access, and planning for a sabotage scenario rather than a ransom scenario, will be the ones whose cold rooms are still cold when the next overnight attack arrives.
OSRS can help. OGUN Security Research and Strategic Consulting provides critical infrastructure risk assessments, operational technology and cold-chain security reviews, incident readiness planning, and strategic advisory services for government, law enforcement, and private-sector leaders operating in Nigeria and across Africa. Contact us to schedule a briefing or a cyber-physical security assessment for your organization.
Enjoyed this article? Share it with a colleague who needs to see it. Stay informed by subscribing to our email list and following us on Google News, Twitter, and LinkedIn for more exclusive cybersecurity insights and expert analyses.
About the Author
Dr. Sunday Oludare Ogunlana is the Founder and CEO of OGUN Security Research and Strategic Consulting LLC, a Professor of Cybersecurity, a national security scholar, and a television commentator. He advises government, law enforcement, academic, and private-sector organizations on security strategy and serves on advisory bodies including the Global Alternative Agenda, the Council for African Security Affairs, and the African Security Forum.
Intelligence. Protection. Strategy. www.ogunsecurity.com
Comments