Criminals Blazed French Fridges to 50C Using Legacy Bugs, Igniting Fires and Melting Gear

Remote control of commercial refrigeration systems allowed attackers to turn French supermarket freezers into heating units overnight. Retailers confirmed on Monday that intruders pushed temperatures as high as 50 degrees Celsius while stores were closed. This action resulted in tonnes of perished food, melted equipment and fires in some locations. French TV channel BFM reported that the attackers appeared to trigger a forced defrost option, keeping units heating instead of cooling. The attack did not use a new exploit. It targeted ageing connected devices still online years after their manufacturer stopped supporting them.

In plain English

The attackers gained the ability to manipulate physical hardware through internet-connected controls. By accessing the refrigeration management systems, they could override standard cooling functions. Instead of maintaining safe storage temperatures, the systems were forced into a heating cycle. This turned essential food preservation equipment into a hazard. The result was immediate physical damage to the property and inventory. The attackers did not need to break into the store physically. They used remote digital commands to cause real-world destruction.

The background

Hundreds of French supermarkets experienced this disruption simultaneously. Major retailers including E.Leclerc, Intermarché and Carrefour were among those affected. The incident reached beyond simple data theft, causing tangible physical consequences like spoiled food and store fires. Disrupted grocery deliveries followed the initial damage. The attack relied on existing functionality within the devices rather than discovering a new vulnerability. The devices were still connected to the internet despite being outdated.

What changes now

Retailers have confirmed the extent of the damage after discovering the issue on Monday. The incident highlights the risks of keeping unsupported devices online. Manufacturers had already stopped providing support for these specific units. Yet they remained connected to operational networks. This exposure allowed attackers to exploit basic features for malicious purposes. The event serves as a warning about the physical impact of cyber intrusions on critical infrastructure.

What made it possible

Teams usually face risks when legacy hardware remains connected to active networks without vendor support. This scenario often involves devices that lack security updates or monitoring. The weakness typically lies in the continued exposure of outdated interfaces that can be manipulated remotely. Attackers exploit these gaps to gain control over physical functions. This stage of an intrusion serves to disrupt operations or cause physical damage. Guidance suggests checking whether unsupported devices are still online and isolating them from critical networks.

What to do and how to stay safe: E.Leclerc

• Review inventory for internet-connected devices that are no longer supported by their manufacturers.
• Isolate legacy hardware from main networks to prevent remote access.
• Monitor system logs for unusual commands or temperature changes in critical equipment.
• Ensure physical safeguards are in place to detect overheating or fire risks.

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific action did the attackers take to cause the damage?

Attackers triggered a forced defrost option that kept units heating instead of cooling.

Did the attackers use a new exploit for this incident?

No, the attack did not use a new exploit.

Which retailers were confirmed to be affected by this attack?

E.Leclerc, Intermarché and Carrefour were among the retailers affected.