Hackers heat French supermarket fridges to 50°C, trigger fires and spoil food

A coordinated cyber‑physical attack on a chain of French supermarkets has left dozens of refrigeration units damaged, food supplies spoiled and several small fires extinguished by staff, officials said on Tuesday. The incidents, which took place in the early hours of 8 October across three stores in the Île‑de‑France region, were traced to malicious software that commandeered the temperature control systems of the fridges, forcing them to heat up to 50 °C – well above the safe storage range for perishable goods. The breach has raised fresh concerns about the vulnerability of critical infrastructure to hacking, especially as retailers increasingly rely on internet‑connected devices to manage inventory and energy consumption.The affected supermarkets belong to a mid‑size French retail group that operates around 150 stores nationwide..

According to a statement from the company’s chief technology officer, the attack was discovered when automated monitoring alerts flagged abnormal temperature readings in the frozen aisles of three outlets in the suburbs of Paris, Lyon and Marseille. “Our systems detected a rapid rise in temperature within minutes, triggering an automatic shutdown of the cooling compressors. By the time the issue was isolated, the internal temperature of several units had climbed to 50 °C, causing the contents to thaw and, in some cases, ignite,” the statement read.Local fire crews were dispatched to each site after staff reported smoke emanating from the back‑of‑house refrigeration rooms..

In Paris, a small blaze broke out in a walk‑in freezer, igniting packaging material and causing minor damage to the surrounding shelving. The fire was extinguished within ten minutes, and no injuries were reported. Similar, though less severe, incidents were recorded in the other two locations, where the heat alone was enough to melt plastic components and trigger safety valves, leading to the release of refrigerant gases.Preliminary forensic analysis by a French cybersecurity firm, SecuriTech, suggests the malicious code was introduced via a remote access tool that exploited a known vulnerability in the refrigeration units’ firmware..

The devices, supplied by a multinational manufacturer, run on a Linux‑based operating system and are designed to receive firmware updates over the internet. While the manufacturer issued a patch for the flaw earlier this year, the analysis indicates that many units had not been updated, leaving them to exploitation. “We are looking at a classic supply‑chain attack where the threat actor gained entry through an unpatched component and then leveraged the device’s control interfaces to alter temperature set points,” said SecuriTech’s lead analyst, Marie Legrand.Authorities have not yet identified the perpetrators, but the sophistication of the attack points to a well‑resourced group..

French police cybercrime unit, the Direction Centrale de la Police Judiciaire (DCPJ), opened an investigation and is collaborating with Europol and the French National Agency for the Security of Information Systems (ANSSI). “The manipulation of industrial control systems to cause physical damage is a serious escalation in the cyber threat landscape,” said DCPJ spokesperson Laurent Dupont. “We are pursuing all leads, including potential state‑sponsored actors, given the potential motive to disrupt supply chains and create public alarm.”The economic impact of the attack is expected to be significant..

The supermarket chain estimates that the combined loss of perishable stock, equipment replacement and cleaning costs will exceed €3 million. Moreover, the incident has forced the temporary closure of the three stores while safety checks and system reinstalls are carried out, affecting both employees and shoppers. The union representing retail workers has called for a review of safety protocols, arguing that reliance on networked appliances without adequate redundancy poses unacceptable risks.Consumer groups have expressed concerns about food safety, particularly for customers who may have purchased products that were stored at unsafe temperatures before the breach was detected..

The retailer has offered refunds and vouchers to anyone who bought items from the affected stores during the period in question, and is conducting a voluntary recall of certain products. “We apologise for the inconvenience and any distress caused. Our priority remains the health and safety of our customers,” the company said in a press release.The incident arrives at a time when European regulators are intensifying scrutiny of the Internet of Things (IoT) in commercial settings..

In March, the European Commission proposed new cybersecurity standards for devices that form part of critical infrastructure, including food supply chains. The French government has already introduced a mandatory reporting framework for cyber incidents affecting essential services, and this case may serve as a catalyst for stricter enforcement. “We need to ensure that the digital transformation of retail does not outpace the security measures required to protect the public,” noted a spokesperson for the Ministry of Economy and Finance.Industry analysts say the attack could prompt a wave of retrofits and accelerated adoption of air‑gapped systems for high‑risk equipment..

“While connectivity brings efficiency, it also expands the attack surface,” said Pierre Martin, a senior researcher at the Institute for Digital Security. “Retailers will have to balance the benefits of remote monitoring with robust patch management and intrusion detection capabilities.” Some experts suggest that blockchain‑based audit trails for firmware updates could provide an additional layer of verification to prevent tampering.As the investigation continues, the French cybersecurity community is urging companies to conduct comprehensive audits of their IoT devices and to implement segmentation between operational technology networks and corporate IT infrastructure. The DCPJ has advised all organisations to review their incident response plans and to ensure that critical systems can be manually overridden in the event of a cyber intrusion..

The incident serves as a stark reminder that the line between digital and physical security is increasingly blurred, and that a failure in one domain can have immediate, tangible consequences for public safety and economic stability..