Hackers send refrigerators haywire: “It could happen in Switzerland too”

Context

TL;DR

• Attack on approximately 150 supermarkets in France
• Refrigerators reaching up to 50 degrees and tons of food thrown away
• Danfoss: vulnerability in systems connected to the Internet
• For the HSLU expert, the risk also exists in Switzerland

Key facts

• What → cyberattack on refrigerated display cases
• When → overnight Sunday to Monday
• Where → around 150 supermarkets in France
• Temperatures → up to 50 degrees
• Manufacturer → Danfoss
• Manipulated function → defrosting
• Expert → Sebastian Obermeier, HSLU
• Update → distributed in 2025

Overnight from Sunday to Monday, a cyberattack hit around 150 supermarkets in France, including branches of Intermarché, Netto and Carrefour. The hackers remotely manipulated the refrigeration systems: the refrigerators went out of control, with temperatures reaching up to 50 degrees and tonnes of food having to be discarded. The incident also raised a question for Swiss large-scale retailers: could a similar attack hit Migros, Coop, Aldi or Lidl?

Access to the refrigeration systems

Sebastian Obermeier, a cybersecurity expert at the Lucerne University of Applied Sciences and Arts, believes the risk exists. The attackers are believed to have exploited vulnerabilities in Danfoss systems connected to the internet, interfering with the defrosting function. The expert told 20 Minuten that initial access was less complex because the systems were accessible online and apparently had known vulnerabilities. Changing the parameters, however, requires specific expertise. Danfoss had distributed a security update in 2025; it is not clear, however, whether the attack exploited flaws that the update was supposed to fix.

The situation in Switzerland

Many refrigeration systems used by large-scale retailers are connected to the network for remote maintenance. As for the infrastructures of Migros, Coop, Aldi and Lidl, Obermeier does not go into detail, but notes that the vulnerabilities may be common and that Danfoss systems are widespread throughout Europe. If the temperatures appeared normal, manipulation might not be detected immediately; the required checks should nevertheless make it highly likely that the problem would be identified.

In France, the Paris public prosecutor’s office also reported fires without a connection to the attack having been established. The theory of a hybrid warfare operation is plausible, but there is no evidence and the perpetrators remain unknown. Contacted by 20 Minuten, Swiss retailers said they paid particular attention to cybersecurity without disclosing their measures. Migros reported no indications of attacks at its branches, Lidl Switzerland said it had not been involved in the French incident, Coop referred to comprehensive measures that are verified and updated, while Aldi reported periodic checks and monitoring.

Operational details

The scale of the risk for Switzerland

The French case has a specific impact in Switzerland, but does not justify turning a French incident into a supply crisis. The dividing line identified by the expert is scale: an isolated loss of fresh products on the one hand, repeated attacks on central cold-storage warehouses and logistics platforms on the other. The distinction separates a contained problem in a store from a coordinated action targeting the distribution chain.

Internet connectivity is the link between convenience and risk. It enables remote maintenance interventions, but can become a gateway for cybercriminals. For Switzerland, this does not mean that every connected system has been hit: it means that remote maintenance must be considered alongside the vulnerabilities, overlooked updates and obsolete software cited by Obermeier.

Detection also requires cautious interpretation. If the temperatures appear normal, the tampering may initially go unnoticed; the prescribed checks should nevertheless make it highly likely that the problem will be detected. The useful data point is therefore not just the visible temperature, but the ability of the checks to detect a change in the parameters.

Beyond the refrigerated displays

The same logic applies to heat pumps, charging stations and photovoltaic inverters. According to the expert, if tens of thousands of devices were switched on or off simultaneously, the electricity grid could be destabilized. A hybrid war remains a plausible hypothesis, but there is no evidence and the perpetrators are still unknown: the incident therefore cannot be attributed to anyone.

The statements from Swiss distributors do not make it possible to compare their infrastructures: Obermeier says he does not know them in detail, and the companies have not disclosed the measures they have taken. To follow separately the possible impact on everyday expenses, consult costo della vita in Svizzera.

Useful tools to protect your net income

To reduce FX leakage, compare CHF-EUR exchange options and banks for cross-border workers.

Key points

From the news to verification

The operational issue is not to automatically attribute the French incident to a single flaw. The source says that the 2025 Danfoss update exists, but does not clarify whether the attackers exploited the very vulnerabilities it was supposed to fix. For Swiss large-scale retailers, verification must therefore start with the systems actually connected and the settings that can be modified remotely.

Five checks arising from the incident

This is not a description of the measures adopted by Migros, Coop, Aldi or Lidl, which have not been made public. It is a verification sequence consistent with the points cited by the expert:

• Connectivity: verify which refrigeration systems are accessible from the Internet for remote maintenance.
• Update: check whether the system has the security update distributed in 2025, without assuming that its link to the attack has been clarified.
• Parameters: examine the defrosting function and remote changes, because this is the point the attackers allegedly acted on.
• Obsolescence: identify devices used for decades, neglected updates and obsolete software, cited as factors that complicate the situation.
• Detection: maintain the required checks even when temperatures seem normal, since manipulation may initially go unnoticed.

The result of these checks does not justify calling every connected system vulnerable. Instead, it serves to distinguish what is established from what remains to be clarified: online accessibility is indicated in the French incident, while the involvement of Swiss systems is not reported.

How to interpret the responses

The source specifies that the major retailers have not disclosed the details of the measures. Therefore, a serious assessment must be limited to what has been communicated: attention to security, checks and updates where stated. The absence of details cannot be turned into an absolute guarantee, nor can the French incident be used as proof of an attack in Switzerland. It also remains necessary to distinguish the damage to fresh products from the more serious possibility of repeated attacks on logistics nodes.

To follow the possible impact on the household budget, consult costo della vita in Svizzera. For personal income calculations, use calcolatore stipendio.

Source: tio.ch