HAGUENAU, France — At 6:30 a.m. before Theo Pinto dos Santos had left home for the supermarket he manages in eastern France, an alarming call came from one of his employees.
“What is supposed to be cold is now hot,” the staffer told him Monday morning
The store’s 80 cold units — including freezers, refrigerators and storage rooms in the back — were now blasting heated air into the aisles.
Dos Santos, 28, logged into the app that allows him to monitor the Intermarché store he manages in this small town in eastern France.
“I see that the cold storage is failing,” he recalled of those moments before he realized he was in the midst of a national crisis. “At that point, we start panicking.”
He tried calling the company that manages the cooling systems but the line was busy. He didn’t know it at the time but hundreds of other stores were suffering the exact same emergency.
His was among 700 facilities across France that were targeted by hackers who seized control of refrigerators and cranked the temperature to as high as 50 degrees Celsius (122 degrees Fahrenheit). Millions of euros of food had to be thrown away, and the cybercrime section of the French prosecutor’s office said it was hunting those responsible. Now a crucial question is perplexing not just shoppers, store workers and government officials, but also experts at the top of the field: Who would carry out such an act, with no obvious monetary or political gain? And what other aspects of daily life might be at risk?
Ciaran Martin, the former founding chief executive of the British government’s National Cyber Security Centre, said it was one of the most “odd” hacking incidents he could remember.
“A criminal group might hack into a group of supermarkets and say, ‘We’ve encrypted your computer” but ‘”we can stop it if you pay us,’” Martin, now a professor at the Blavatnik School of Government, at the University of Oxford, told NBC News.
But the hackers in France have not identified themselves publicly, let alone discussed money or politics. Indeed, Vincent Strubel, director general of France’s cybersecurity agency, the ANSSI, said Tuesday that officials “do not yet have a detailed understanding” of what happened.
That poses the question: “Who is this and what do they want?” Martin asked. “They’re just melting all this food, which has to be thrown out. They got no leverage; they can’t do it again.”
There is no evidence this hack involved artificial intelligence or was carried out by a nation-state. Indeed it was relatively easy to carry out because the fridges’ vulnerability was known for months. The units were controlled by software from a Danish firm, Danfoss, as well as Dixell, owned by the American industrial giant Copeland, according to French officials.
In August, a New York-based cybersecurity firm, Claroty, warned Danfoss that some of its systems were accessible to members of the public on the open internet, and that these had since been patched.
But Danfoss said Monday that the hackers had targeted older systems that no longer received software updates. Copeland acknowledged the “vulnerability” and said “we are currently working with impacted customers to mitigate the risk.”
“This isn’t a case of a brand new vulnerability being found and exploited — it’s a case of someone reading someone else’s published research,” said Ken Munro, a partner at the British cybersecurity firm Pen Test Partners.
The upshot is that “this could have been done by pretty much any semi-competent hacker, including bored teenagers,” he said.
The good news, perhaps, is that hackers have a much more difficult time targeting anything deemed critical infrastructure, such as power grids, the water supply or aviation.
This “is far more carefully patched and more closely monitored,” said Leonie Maria Tanczer, an associate professor in international security and emerging technologies at University College London. In the United Kingdom, for example, the National Cyber Security r Centre “would be far more attentive to making sure that any known vulnerabilities are immediately patched and rectified,” she said.
Damaging hacks do happen, of course.
In the United States, a 2021 ransomware attack prompted Colonial Pipeline to take its pipeline system offline, and two years later hackers compromised a water system controller in Pennsylvania.
Britain saw its flagship retailer M&S suffer months of disruption after an April 2025 attack, auto brand Jaguar Land Rover halted production for more than a month following a hack the same year, and the publicly-run National Health Service has had its appointment systems targeted by at least two ransomware attacks in the past decade.
But what makes the French fridge hack distinctive and especially shocking is that it “brings an abstract software vulnerability into the physical world, and into the day-to-day reality of the average person,” Tanczer said.
Dos Santos says he and his staff spent Monday tossing 43,000 euros ($47,800) of food into a dumpster. He was so shaken up that he slept in his store the night after the attack, rotating in shifts with his girlfriend, who also works at the supermarket, to make sure everything was running normally.
By Wednesday, when NBC News visited the store, one-third of the frozen shelves were still empty, with a note on the doors explaining what had happened.
“I remain shocked by this situation. It is unprecedented,” said Clarisse Hoernel, 57, who works in insurance and shops there once a week. “I struggle to understand how we let this happen today. Everything is digital, yet there is no security system.”
That last point couldn’t be more true, according to Patrice Auffret, CEO at Onyphe, a cyber defense search engine based in France that aims to find and fix such weaknesses.
“Every day we see things online that shouldn’t be,” he said. This includes management systems for heating and air conditioning, solar panels, electric vehicle chargers, surveillance cameras and 4G internet routers.
“If a device has an IP address, someone will connect it on the internet. Being exposed makes it a target,” Auffret said.
About the Author
