Hundreds of French supermarkets spent Monday emptying their chilled aisles into skips after a coordinated cyberattack reached the controllers that run their refrigeration, in an incident the Paris prosecutor's office described as "large-scale" and affecting "connected refrigerators in several major food retailers across France".
The retailers put the scale of it in their own statements to AFP, whose reporting Al Jazeera carried. Intermarché and its Netto chain counted at least 300 shops affected. Coopérative U said more than 100 outlets had been hit, Carrefour put its figure at 80 supermarkets, and Monoprix said about 5 per cent of its roughly 490 stores were involved. E.Leclerc said several of its stores were targeted.
According to BFM TV, the attackers "managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores". Temperatures inside fridges and freezers rose as high as 50C. Fires broke out at several stores.
Dominique Schelcher, chief executive of Coopérative U, said refrigeration had been disrupted since Sunday night. Writing on X, he called the attack "unacceptable" and asked for an investigation to "shed full light on this attack".
Intermarché told AFP that affected stores would have to "throw away all of the products" that were fresh or frozen. Thierry Cotillard, the group's chief executive, told BFM TV the losses amounted to "tens of millions of euros nationwide in a single day". The FCD, France's retail federation, said some affected stores were already trading again.
Prime Minister Sébastien Lecornu ordered ANSSI, the national cybersecurity agency, to investigate. A source close to the prime minister said the agency had identified a vulnerability in software supplied by Danfoss, a Danish manufacturer of refrigeration controls.
Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems", and that the affected units "were running outdated firmware". The FCD called on the company to provide "full transparency".
The weakness was not unknown. The security firm Claroty published research on 9 August describing Danfoss vulnerabilities that could allow an attacker to bypass authentication.
Nor was the problem confined to France. Felix Aimé of the security company Sekoia said Spain, Portugal, Poland, Germany and Belgium had also been affected, and the French authorities are coordinating with European counterparts.
It is worth being exact about what failed here, because on the available evidence very little did. A forced defrost is not a fault condition. It is a documented function, offered by the manufacturer, present in the menu, and intended to be used.
The equipment involved is called a refrigeration management system. It managed the refrigeration. Asked to stop cooling, it stopped cooling, in several hundred shops, at roughly the same time, without argument or delay.
Fifty degrees is therefore not a breakdown. It is compliance. The cabinets did not seize, stall or fail to respond. They performed in the opposite direction with precisely the reliability their specifications promise, and they did it across five retail groups and six countries at once, which in any other context would be described as a successful rollout.
Danfoss's own explanation identifies the only component that was genuinely out of date, and it was not the thermostat. The temperature logic was current. The firmware's understanding of who is entitled to operate the thermostat was from an earlier release. The machines knew exactly what to do. They were simply working from an old guest list.
The Department of Unnecessary Research has accordingly asked the retail federation to settle the one question the documentation leaves open: whether a freezer that reaches 50C on command has malfunctioned, or has merely been operated by somebody else.
No manual distinguishes between the two.