Hackers Turn French Freezers Into 122°F Ovens
Hackers remotely forced supermarket refrigeration systems into defrost mode, spoiling food and causing fires across hundreds of French stores.
France has suffered a cyberattack in which the stolen asset was not customer data but temperature itself. Intruders remotely manipulated refrigeration controllers at hundreds of supermarkets, forcing equipment into defrost cycles and raising some units to 50 degrees Celsius, or 122°F. Food was ruined, fires were reported and store workers spent Monday throwing away carts of melted and unsafe stock.
What happened
At least 300 Intermarché and Netto locations were affected, alongside roughly 100 Coopérative U stores, 80 Carrefour supermarkets, about 30 Monoprix locations and several E.Leclerc outlets. An Intermarché in Haguenau estimated its destroyed frozen inventory at €50,000. A Leclerc in Wasselonne reported losses of about €220,000. National losses are expected to reach millions of euros.
The Paris prosecutor opened an investigation into the large-scale attack. Danfoss acknowledged incidents affecting refrigeration-management systems. No group has claimed responsibility, and officials have not announced evidence identifying a state, criminal gang or insider.
Why it matters
The affected controllers sit in the operational-technology layer: the computers that supervise physical machinery rather than ordinary office email. Security researchers had previously disclosed serious flaws in Danfoss AK-SM 8xxA devices, including an authentication bypass and command-injection risks. Danfoss produced updates, but reports indicate many exposed stores were using older or end-of-life equipment without adequate firewall or VPN protection.
That distinction matters. The attack does not prove that an advanced artificial intelligence autonomously broke into French retail chains. A more conventional explanation—known weaknesses, exposed interfaces, weak segmentation and delayed patching—already fits the available evidence.
Calling the operation “not ransomware, but sabotage” is broadly reasonable because the visible goal was physical disruption. Yet investigators still need to establish whether extortion demands, data theft or reconnaissance occurred alongside the damage. Cyberattacks rarely respect the clean categories used in headlines.
The international lesson is uncomfortable. Supermarkets, warehouses, farms, hospitals and apartment towers increasingly depend on internet-connected controllers but often lack industrial-security teams. The United States is not uniquely safe. American authorities have repeatedly warned operators to isolate control systems, remove default credentials, patch firmware and monitor abnormal commands. The cheapest attack path is often not futuristic AI; it is a forgotten device placed directly on the internet.
How to read the signal
The central discipline in reading “Hackers Turn French Freezers Into 122°F Ovens” is separating the documented event from the larger story being attached to it. A strike, arrest, military movement, technical failure or political statement may be real while its cause, scale or strategic meaning remains disputed. Early certainty is often a warning sign rather than proof.
Incentives also matter. Governments want to reassure citizens, deter opponents and preserve freedom of action. Armed groups advertise reach and minimize responsibility. Political critics select details that support a wider argument. The most reliable picture comes from comparing official statements with independent reporting, technical evidence, commercial behavior and what happens next.
Timing is another source of error. Initial reports may use incomplete casualty figures, confused locations or claims made before investigators reach the scene. Later evidence can identify a weapon, revise a number or show that two alerts described the same incident. Preserving those uncertainties is more useful than freezing the first viral version into history.
Verification and competing accounts
French prosecutors, retailers, Danfoss and multiple independent outlets confirm a large attack on connected refrigeration systems. Investigators have not publicly identified the attackers or their motive. Reports that monitoring was disabled and that AI or jailbroken phones enabled the operation have not been established by the public evidence. Sources used for this report include Reuters, Agence France-Presse, Le Monde, Paris prosecutor’s office, Danfoss, Claroty Team82. Claims from belligerents, anonymous officials and viral posts are attributed rather than converted into established fact. Figures and operational details may change as authorities release evidence or corrections.
The slogan “freezers became ovens” captures the shock but is technically loose: the attackers reportedly changed setpoints or forced defrost behavior, not converted refrigeration units into cooking appliances. There is also no public national loss total yet. Individual store estimates should not be multiplied mechanically because store sizes, insurance and salvage rates differ.
What to watch next
Watch for the prosecutor’s forensic findings, a Danfoss technical advisory identifying affected models and confirmation of the initial access method. Retailers should disclose whether controllers were patched, internet-exposed and segmented from corporate networks. Those facts will determine whether this was a novel intrusion or a preventable exploitation of known weaknesses.