The Fridge Hack That Cost French Supermarkets Millions

How Hackers Manipulated Supermarket Refrigeration Systems

On the night of October 11th, more than 400 supermarkets across France were hit by an unprecedented cyberattack. Hackers remotely manipulated the settings of fridges and freezers, reportedly raising temperatures to as high as 50°C, effectively turning cold storage units into warming chambers and forcing stores to discard large quantities of stock the following morning. Major retailers, including Carrefour, Monoprix, Intermarché and Coopérative U, were among those affected. According to Intermarché CEO Thierry Cotillard, the financial damage reached tens of millions of euros nationwide in just one day.

You wouldn't necessarily think that hacking a supermarket fridge could cause millions of euros in damage. But when you look at how these systems operate, it becomes easier to understand.

Most supermarket refrigeration systems are connected to centralised controllers, allowing maintenance companies to monitor and adjust temperatures remotely. For retailers managing multiple sites, this provides greater control. But that same connectivity also creates potential entry points for attackers.

In this case, the affected stores were using older refrigeration control systems made by Danfoss, a Danish manufacturer. These models were no longer receiving updates and contained a known security flaw: an emergency master password that changed automatically based on the calendar date. Anyone who knew the formula could log in as an administrator. The systems had also been left directly exposed to the internet without a firewall, making them easy to locate and access remotely. Once inside, the attackers changed the settings, raising temperatures far above their normal levels overnight. By the following morning, stores had reportedly lost millions of euros’ worth of fresh and frozen food.

While the method of attack was clear, the motive remained uncertain. No data theft was reported, no ransom demands were made and no group claimed responsibility. Possible motives could include demonstrating hacking capabilities, causing economic disruption, geopolitical sabotage or opportunistic vandalism, though none has been confirmed.

And this is far from an isolated case.

Marks & Spencer, Coop Sweden and Starbucks have all experienced cyberattacks that disrupted operations across multiple locations. Although the attacks differed, they highlight the same underlying risk: when critical systems are interconnected, a single compromise can disrupt operations far beyond one location.

For large, distributed organisations, this creates a particularly difficult security challenge.

Why Large Distributed Organisations Are Hard to Protect

Every additional site, office or location brings its own network, devices and potential vulnerabilities, making it increasingly difficult for organisations to secure everything at once. This is a real-world challenge often discussed in IT under concepts such as “Branch Office Security” and the “Dissolving Network Perimeter.”

While security solutions such as Secure Access Service Edge (SASE) exist to address this challenge, they can be expensive, complex to deploy and difficult to scale across a distributed network. According to a survey cited by TechTarget, fewer than 30% of IT professionals described the SASE migration process as easy.

There's also the human aspect to consider. Most organisations don't have a dedicated IT expert at every location. Instead, a centralised team oversees security across all sites, often with limited visibility into what's happening locally. And when something goes wrong at a particular store, someone may need to physically travel there to resolve the issue.

As a result, many organisations may prioritise securing their headquarters while leaving smaller sites far more exposed.

Among the most vulnerable are often IoT devices, such as connected fridges, security cameras, smart door locks, and heating and air conditioning systems. Unlike traditional IT equipment, these devices are often overlooked by security teams, despite being connected to the same networks. Many also run outdated software, making them attractive targets for attackers.

How to Secure Every Location at Scale Without Excessive Costs

The challenge then, is finding a way to protect every site without multiplying costs or requiring additional IT staff at each location. Each location needs to be treated as its own infrastructure, with its own network, devices, vulnerabilities and security requirements, much like an independent SMB.

In practice, this means having a solution that can automatically scan for vulnerabilities, identify every IT and IoT device connected to the network, and detect and respond to suspicious activity in real time. It also needs to be easy to deploy without requiring a team of engineers on-site, and affordable enough to secure an entire network of sites.

This is exactly what Chimera was built for. It takes just five minutes to deploy. Plug it into your router, and it starts working immediately, with no complex configuration. Every device connected to the network becomes visible, vulnerabilities are hunted for and reported, while suspicious activity is flagged in real time.

When deployed across multiple sites, Chimera's Aggregate feature brings data from every appliance into a single dashboard, so there's no need to log in and out of each location separately. This is the kind of visibility that could have made a difference on October 11th. For example, unusual activity involving a refrigeration controller in the middle of the night could potentially have been detected and flagged before the damage escalated.

The Growing Threat to Physical Infrastructure

What makes this attack particularly striking is what it did not involve. No stolen data, no encrypted files, no ransom demand. Just a change in temperature settings overnight, resulting in serious financial consequences.

Now imagine the same principle applied elsewhere. Disrupting cold storage infrastructure in a country at war could threaten food supplies, while manipulating temperature controls in a hospital could put patients at risk. These are plausible scenarios that show how cyberattacks targeting everyday infrastructure can have serious physical consequences.

This reflects a broader shift in cybersecurity. Cyber threats are no longer just about compromising information systems. They increasingly extend into the physical world, targeting the systems that keep supply chains running, buildings functioning and people safe. On a larger scale, coordinated attacks against critical infrastructure could undermine a country's stability and even become a tool of geopolitical pressure or conflict.

As these threats evolve, organisations need to treat connected infrastructure as part of their attack surface. Equally, the cybersecurity industry needs to make protection affordable and accessible across every location, not just headquarters. When a single vulnerable system can potentially disrupt multiple sites, securing only part of the network is no longer enough.