French Supermarket Cold Chain Hit by Cyberattack Causing Mass Food Waste: Danfoss Long Knew of Vulnerability Yet Did Not Mandate Upgrade, Corporate Responsibility Surfaces

French Supermarket Cold Chain Hit by Cyberattack Causing Mass Food Waste: Danfoss Long Knew of Vulnerability Yet Did Not Mandate Upgrade, Corporate Responsibility Surfaces

Hackers compromised remote temperature-control software provided by Danish industrial giant Danfoss, forcing refrigeration and freezer units at hundreds of French chain supermarkets to spike to 50 degrees Celsius overnight, triggering the mass destruction of fresh and frozen food, with economic losses estimated at millions of euros. Behind the incident lies the real picture of a supplier that holds the lifelines of Europe's cold chain in its hands, having long "advised upgrades" while knowingly allowing vulnerable legacy systems to continue managing food temperatures.

According to a report by the British Broadcasting Corporation (BBC), the cyberattack targeting France's retail cold chain occurred in the early hours of Monday. Dominique Schelcher, chief executive of Coopérative U, characterized the attack as "extremely serious and unprecedented." More than 100 stores of that chain were hit; a combined 180 stores under Intermarché and its Netto brand were breached; and to prevent the attack from spreading, the Mousquetaires group urgently severed network connections at another roughly 100 stores. Carrefour confirmed that 80 of its 6,000 stores nationwide were affected; Monoprix reported that approximately 5 percent of its more than 400 stores were hit; and E.Leclerc likewise did not escape.

Of France's roughly 15,000 supermarkets nationwide, about 400 stores were affected. Two stores in the Alsace region have together reported losses of 270,000 euros, while the nationwide actual figure, according to the BBC, runs "into the millions." The Paris public prosecutor's office in France has opened a dedicated cybercrime investigation into the incident.

The most accountability-laden detail came from Danfoss's own statement. According to the BBC, Danfoss acknowledged that the affected freezers were all legacy models whose security software "cannot be updated" to eliminate risks the company had previously identified, and said it had "long advised" customers to upgrade to supported systems.

In other words, this core supplier in Europe's commercial refrigeration sector long ago identified security vulnerabilities in its aging products, yet allowed these unpatchable devices to keep guarding the temperatures of a critical food supply chain — until attackers turned them into the site of mass food destruction. The BBC reported that Danfoss did not confirm the maximum temperature to which the hackers actually heated the units, but according to Reuters, data provided by Intermarché showed that its freezers were heated to 50 degrees Celsius for six hours overnight. On-the-scene footage released by French broadcaster BFMTV showed one store's ice cream cabinet display reading as high as 26.5 degrees, with small fires even breaking out at some locations.

The centralized, remote cold-chain management model means that a single software vulnerability is enough to cripple hundreds of stores at once. Attackers do not need to breach individual physical freezers one by one; seizing the central control hub is enough to cause key nodes of the national food supply chain to fall simultaneously. When a supplier long knows of a vulnerability and long offers upgrade options, yet still leaves unpatchable legacy systems running on critical food-infrastructure front lines, then the damage caused by the attack is not solely the attackers' culpability — it is also a bill for corporate governance failure.

EU Commissioner for Food Affairs Christophe Hansen condemned the attack on social media platform X and warned: "Food security needs to receive more attention at all levels. Because the weaponization of food has become a reality." Schelcher likewise called for a full investigation, saying that an attack on critical French food-supply equipment was "unacceptable."

Several aspects of the incident remain unresolved. The entity behind the attack is still unclear; French prosecutors have only opened an investigation, with no attribution conclusion so far. The actual losses nationwide remain unknown, with only two Alsace stores having disclosed combined losses of 270,000 euros. The technical specifics of how the hackers actually breached the Danfoss software system have likewise not been made public. Several affected chains have already removed suspicious products and rushed in emergency restocking, while refrigeration and freezer display cabinets at some stores remained out of service as of noon on Monday.