Attackers heated French supermarket freezers to 50C through devices their maker stopped supporting
Hackers pushed fridge and freezer temperatures to as high as 50 degrees Celsius in hundreds of French supermarkets overnight, The Cyber Express reported. The attack used no new exploit and hit ageing devices still online years after their manufacturer ended support.
The Watch · Security desk
Key figures: Bruce Hallas said estimates sit around 400 stores affected; some reports put the total above 500 shops; some branches reported losses of about 250,000 euros, per Hallas.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Stores affected, estimates per Bruce Hallas, around | 400 stores | 10 | |
| Total, some reports | 500 shops, above | 11 | |
| Branch losses, per Hallas | 250,000 euros, about | 12 |
What happened
- Retailers confirmed the attack on Monday, saying the temperatures went up after the stores had closed for the night.
- The heat destroyed tonnes of food and melted some equipment. In some stores it set off fires.
- According to French TV channel BFM, the attackers seem to have triggered a forced defrost option, so the units kept heating instead of cooling.
Why it matters
- Who's exposed exposure Any operator running connected refrigeration that its manufacturer no longer supports, and that is reachable online, is in the position these stores were in.
- What it costs cost The retailers carry the loss. Bruce Hallas of Re-thinking the Human Factor said some branches reported about 250,000 euros.
- What's now possible capability On BFM's account, the damage came from a function the units already had, used at the wrong time.
The record here is one weekly roundup from The Cyber Express, which relays retailer statements, French TV channel BFM and an outside estimate. It does not include the device manufacturer or model, the way in, any group behind the attack, a link to an earlier campaign or the calendar date of the overnight attack. The only anchor is the Monday on which retailers confirmed it [2].
The attack did not use a new exploit [15]. It targeted ageing connected devices that were still online years after their manufacturer stopped supporting them [16]. In our view that makes the exposure an asset problem. A unit that is reachable and out of support stays that way until someone replaces it or takes it off the internet, and the attacker's job is to find it.
Store counts differ by source. Coopérative U reported more than 100 stores and Carrefour said 80 [6][7]. Monoprix said about 5 percent of its roughly 490 stores were targeted [8], which is about 25 stores [9]. E.Leclerc was also hit, with no count given [4]. With the 300 Intermarché and Netto stores as a floor [5] and the 100 as a floor, the chain figures add up to roughly 505 [13].
Re-thinking the Human Factor's chief executive, Bruce Hallas, said estimates are close to 400 stores [10]. Some reports put the total above 500 shops [11]. Hallas's figure is lower than the sum of the chain figures, and the reports above 500 are consistent with it.
What to watch
- Whether a retailer or the manufacturer names the device model or the access route, which would show if the way in was default credentials, a known flaw or something else.
- Whether a group claims the attack or the same method turns up at other retailers, which would separate a one-off from a sustained campaign.
- Whether the retailers settle on a single store tally to replace the range of estimates.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence40
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Hackers took remote control of internet-connected refrigeration systems at hundreds of French supermarkets overnight, leaving spoiled stock.
- [2]
Retailers confirmed on Monday that attackers pushed fridge and freezer temperatures as high as 50 degrees Celsius (122F) while stores were closed.
- [3]
Tonnes of food perished, some equipment melted, and in some stores the heat sparked fires.
- [4]
E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U were all hit.
- [5]
At least 300 Intermarché and Netto stores were affected.
- [6]
Coopérative U reported more than 100 stores affected.
- [7]
Carrefour said 80 stores were affected.
- [8]
Monoprix said about 5 percent of its roughly 490 stores were targeted.
- [9]
Monoprix's 5 percent of roughly 490 stores is about 25 stores.
- [10]
Bruce Hallas, CEO at Re-thinking the Human Factor, noted that estimates sit around 400 stores.
- [11]
Some reports put the total above 500 shops.
- [12]
Some branches reported losses of about 250,000 euros.
- [13]
The chain-reported store counts (300 + 100 + 80 + about 25), with 300 and 100 as minimums and no E.Leclerc count, add up to roughly 505.
- [14]
French TV channel BFM reported that the attackers appeared to trigger a forced defrost option, keeping units heating instead of cooling.
- [15]
The attack did not use a new exploit.
- [16]
The attack targeted ageing connected devices still online years after their manufacturer stopped supporting them.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- End-of-life devicesFollow
- Critical Infrastructure AttacksFollow
- IoT SecurityFollow