Attackers Overheated French Supermarket Freezers via Legacy Refrigeration Systems
Criminals manipulated internet-connected cooling units in French stores, raising temperatures to 50C and causing fires, food loss, and equipment damage through remote control.
Key points
- Attackers raised freezer temperatures to 50 degrees Celsius while stores were closed.
- The incident targeted aging devices that remained online after manufacturer support ended.
- No new exploit was used; attackers abused a forced defrost feature on connected systems.
Attackers remotely manipulated internet-connected refrigeration systems in hundreds of French supermarkets, raising internal temperatures to 50 degrees Celsius overnight. Retailers confirmed on Monday that the incident occurred while stores were closed. The manipulation caused tonnes of food to perish, melted equipment, and sparked fires in some locations. This event highlights the physical risks of connected industrial control systems.
The risk
According to BFM, the attackers appeared to trigger a forced defrost option on the units. This action kept the heating elements active instead of allowing the cooling cycle to run. The attack did not rely on a new software exploit. Instead, it targeted aging connected devices that remained online years after their manufacturers stopped supporting them.
Who is exposed
Major French retailers including E.Leclerc, Intermarché, and Carrefour were among those affected. The vulnerability exists in legacy refrigeration hardware that maintains network connectivity despite lacking security updates. Any organization using similar end-of-life industrial control systems connected to the internet faces comparable exposure to remote manipulation.
Cost and compliance
The incident resulted in significant financial losses due to spoiled inventory and damaged equipment. Fires caused by the overheating units added to the operational disruption. Grocery deliveries were disrupted as stores dealt with the aftermath. The event underscores the tangible costs of maintaining unsupported hardware in critical infrastructure roles.
What to watch
Security teams should monitor for unauthorized changes to environmental control settings. Look for temperature anomalies in refrigeration logs during off-hours. Verify that all industrial control systems have current vendor support and security patches. Isolate legacy devices that cannot be updated from critical networks.
Signals worth monitoring
Teams usually detect this type of manipulation through anomalous temperature readings in building management systems. Check whether refrigeration units report unexpected heating cycles or defrost modes during normal operating hours. Monitor network logs for remote configuration changes to industrial controllers. Verify that alerts trigger when devices deviate from standard thermal parameters. Investigate any command sequences that reverse cooling functions without manual override.
What to do and how to stay safe: refrigeration systems
- Audit all internet-connected industrial control systems to identify devices lacking vendor support.
- Segment legacy refrigeration hardware from corporate networks to limit remote access vectors.
- Monitor environmental sensors for unexpected temperature spikes or mode changes during off-hours.
- Establish manual override procedures for critical cooling systems in case of network compromise.
Step-by-step guide: Security Awareness Training: 6 Misunderstandings That Waste Your Budget
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the attackers use a new zero-day exploit?
No, the attack did not use a new exploit. It targeted aging devices using a forced defrost feature.
Which retailers were affected by this incident?
E.Leclerc, Intermarché, and Carrefour were among the French supermarkets affected.
What temperature did the freezers reach?
Attackers pushed fridge and freezer temperatures as high as 50 degrees Celsius.
