Hackers turned French supermarket fridges into 122°F fire hazards

Hundreds of French supermarkets just learned the hard way that a cyberattack can literally turn the cold chain into a fire hazard. In a large-scale hack, attackers remotely pushed refrigeration units to 122°F, spoiling food and sparking fires across multiple locations. This wasn't a ransomware note on a screen; it was physical sabotage delivered through the same internet-connected systems that keep groceries fresh. The number that matters is 122°F - not a typo. Refrigerators designed to hold perishables at near-freezing temperatures were driven to a heat level that can ignite insulation, melt components, and turn a store into a liability. The fact that this happened at hundreds of supermarkets simultaneously points to a coordinated, automated attack, not a one-off prank. It also means the attackers likely had a playbook for exploiting a common vulnerability across many sites.

How does a fridge get hacked? Modern supermarket refrigeration is part of the operational technology (OT) landscape. These systems are often connected to the internet for remote monitoring, energy management, and predictive maintenance. In many cases, they run on legacy protocols, default credentials, and flat networks that give attackers an easy path once they find an entry point. A compromised point-of-sale system or a vulnerable IoT device can become a pivot to the refrigeration controller. From there, changing a temperature setpoint is trivial. The attack surface is enormous: every store has dozens of internet-connected devices, from HVAC to lighting to security cameras, and each one is a potential door into the physical world.

The business impact is severe. Spoiled inventory is a direct write-off, but the costs go deeper: store closures for cleanup and repair, fire damage to property, potential liability for foodborne illness, and a reputational hit that lingers. Grocery margins are notoriously thin, often in the low single digits. A single incident can erase a quarter's profit; an attack on hundreds of stores could threaten a chain's solvency. Insurance will not cover everything, and cyber policies increasingly exclude physical damage or require proof of security controls. Supply chain partners may also face contractual penalties if a retailer cannot take delivery of perishable goods, amplifying the financial shock.

Regulators are watching. The European Union's NIS2 Directive, which member states are transposing into national law, explicitly covers the food sector and requires companies to manage cybersecurity risks in their supply chains and operational systems. France's ANSSI (National Cybersecurity Agency) is likely to investigate, and fines for non-compliance can reach millions of euros. Boards that previously treated cybersecurity as an IT problem will now have to answer for OT security as a governance issue. The incident also raises questions about whether the affected supermarkets had conducted the risk assessments and incident response planning that NIS2 mandates. For any company operating in the EU, this is a regulatory wake-up call: the era of ignoring OT security is over.

This attack is a preview of a broader threat. Every retailer, logistics operator, and manufacturer with connected physical infrastructure faces the same exposure. HVAC systems, lighting controls, security cameras, and even vending machines are all potential entry points. The convergence of IT and OT means that a breach of a low-value device can become a physical safety event. The French supermarket hack is not an isolated incident; it is a demonstration of how cyberattacks can now touch the physical world. Security researchers have long warned that industrial control systems are under-protected, and this incident validates those warnings in the most visceral way possible: fire and spoiled food.

For CEOs and CISOs, the strategic takeaway is to treat OT as critical infrastructure, not as an afterthought. That means segmenting networks so that a compromised cash register cannot reach a refrigeration controller, monitoring for anomalous temperature or command activity, and developing incident response plans that include fire suppression and food safety protocols. It also means asking whether your cyber insurance covers physical damage and whether your board receives regular reports on OT risk. The cost of prevention is far lower than the cost of a fire, and the reputational damage from a preventable physical incident can be permanent.

The French supermarkets are a warning shot. The next attack could target a hospital's HVAC, a data center's cooling, or a chemical plant's valves. The tools and techniques are the same; only the target changes. Executives who ignore OT security are leaving the door open for the next attack. The question is not if but when. For now, the immediate priority is to find out whether your own refrigeration units are reachable from the internet, whether your network is segmented, and whether your incident response plan includes a fire department. The 122°F hack is a reminder that in the connected world, cybersecurity is not just about data - it's about physical safety.