Hackers Spoil Food Across Hundreds of French Supermarkets in Refrigeration Attack

Hackers forced overnight defrosts on Danfoss industrial refrigeration systems in hundreds of French grocery stores, spoiling perishable food across chains including E. Leclerc, Intermarché, and Coopérative U. Paris prosecutors have opened an investigation. The attack is a textbook strike on critical infrastructure — and its choice of target reveals something about how threat actors are evolving their thinking.

Refrigeration rarely features in critical infrastructure security conversations, which focus on power grids, water treatment, and financial systems. Yet the attack surface is enormous: supermarkets, hospitals, pharmaceutical cold storage, and food distribution networks all rely on networked operational technology that typically receives worse security patching than consumer devices. The economic damage from overnight defrosting at hundreds of locations — spoiled meat, dairy, and produce — could run to millions of euros in inventory losses alone, before accounting for insurance claims and reputational harm.

The attack's structure is also informative. The hackers did not deploy ransomware or demand payment; they quietly raised temperatures and withdrew. That behavior pattern is consistent with a nation-state actor testing reach without triggering an immediate response, a criminal group building a proof of concept before making demands, or a demonstration of vulnerability. The absence of an obvious financial motive makes attribution and deterrence more difficult.

The story connects directly to a separate supply-chain compromise disclosed the same day. Hardware wallet manufacturer Ledger found a hidden physical implant inside a device sold through a third-party vendor called CryptoBilis. Unlike software vulnerabilities, a hardware implant cannot be patched remotely. Anyone who purchased a Ledger device through CryptoBilis should treat it as fully compromised; such implants can be designed to remain dormant until a transaction crosses a specific dollar threshold, making them nearly impossible to detect through ordinary use. Together, the French refrigeration attack and the Ledger finding illustrate how dramatically the attack surface for physical, real-world systems has expanded as supply chains have become global and infrastructure has become networked.