A cyberattack targeting supermarket refrigeration systems across France forced hundreds of stores to discard fresh and frozen food Monday after hackers remotely manipulated temperature controls, causing widespread spoilage and reports of fires.
The attack, which began overnight October 11–12, affected major grocery chains including Intermarché, Coopérative U, E.Leclerc and Carrefour. French authorities opened a criminal investigation, while Danish refrigeration equipment manufacturer Danfoss acknowledged that older versions of its control systems were among those affected.
Store operators face losses running into millions of euros. The incident also exposed a vulnerability in an essential part of modern food retailing: the network-connected controllers that manage commercial refrigerators and freezers, often through remote access maintained by outside service companies.
Hundreds of Stores Affected Across France
The full scale of the disruption remained uncertain Monday, with retailers and news organizations reporting different numbers of affected locations.
Intermarché and its discount chain Netto reported approximately 150 affected stores to Reuters, while retailers told Agence France-Presse that at least 300 locations across the two brands had been targeted. Coopérative U reported approximately 100 affected stores.
Carrefour said approximately 80 of its supermarkets were attacked, a small fraction of its roughly 6,000 stores. E.Leclerc confirmed problems at several locations, attributing the disruption to a cyberattack affecting one of its refrigeration equipment suppliers.
More Read
The figures were not independently reconciled, and no definitive national total was available.
At affected stores, employees arriving for work discovered refrigerators and freezers operating far above their normal temperatures. Products that should have remained frozen had thawed, leaving retailers with little choice but to remove potentially unsafe food from sale.
According to French broadcaster BFMTV, attackers remotely activated continuous defrost cycles on refrigeration equipment, in some cases setting temperatures as high as 50°C (122°F). Defrost cycles are normally controlled to remove ice buildup without compromising food storage temperatures.
Some store employees also reported that temperature alarms had been disabled, preventing automatic warnings from reaching personnel responsible for responding to refrigeration failures.
Intermarché said affected stores would have to discard their fresh and frozen inventories. Some locations documented the losses before destroying the food.
The financial damage could be substantial. BFMTV reported that an E.Leclerc supermarket in Wasselonne, in eastern France, lost approximately €220,000 in merchandise. Other stores reported losses reaching hundreds of thousands of euros.
Beyond the discarded inventory, retailers face cleanup expenses, interrupted sales and uncertainty over insurance coverage. Intermarché warned that some policies might not cover this type of incident.
Danfoss Identifies Older Refrigeration Controllers
Danfoss, a major supplier of commercial refrigeration equipment and controls, said it was aware of incidents in France involving a limited number of refrigeration management systems.
In a statement reported by AFP, the company identified its AK-SM 800 and AK-SC 355 controllers among the affected products. Most of the systems involved were older products that no longer receive software or security updates, Danfoss said. Some were running outdated firmware.
The controllers are used to monitor and manage refrigeration equipment in supermarkets and other commercial facilities. Depending on the installation, a central management system can supervise multiple refrigerated display cases, freezer circuits, temperature settings and alarm functions.
That centralized control makes refrigeration systems easier to operate and maintain. It can also create a single point of failure if an unauthorized user gains administrative access.
The age of the affected equipment is particularly relevant.
Danfoss officially declared the AK-SM 800 end-of-life in May 2021. In an October 2025 technical bulletin, the company explained that it was ending remaining support services for several legacy products, including the AK-SM 800 and AK-SC 355.
The newer AK-SM 800A remains supported and has received additional security protections through firmware updates.
Danfoss said it had long encouraged customers to update their systems or replace aging equipment.
Researchers Previously Found Serious Security Flaws
The attack followed several years of published warnings about cybersecurity weaknesses in Danfoss refrigeration management equipment.
In August 2023, Danfoss published security advisory DSA-2023-08-01, identifying three vulnerabilities affecting AK-SM 800A controllers running software versions earlier than 3.3. One received a critical severity rating of 9.8 out of 10.
Additional vulnerabilities were disclosed in 2025, including an authentication-bypass flaw identified as CVE-2025-41450. The vulnerability received a severity score of 8.2 and was addressed in firmware version 4.2.
Two other vulnerabilities, CVE-2025-41451 and CVE-2025-41452, affected software versions earlier than 4.3.1. They involved potential remote command execution after authentication and unauthorized changes to web-server configuration.
In August 2026, cybersecurity researchers at Claroty’s Team82 published a technical investigation examining the AK-SM 800A platform.
The researchers described an undocumented authentication mechanism that could be abused to bypass normal login protections, along with vulnerabilities that could allow attackers to execute commands on a compromised controller.
Claroty said Danfoss had addressed the vulnerabilities and recommended upgrading affected AK-SM 800A systems to firmware version R4.3.1 or later.
There is an important distinction: the vulnerabilities documented in that research concern the newer AK-SM 800A platform, while Danfoss identified older AK-SM 800 and AK-SC 355 products among the equipment affected in France.
Investigators have not established whether the French attacks exploited any previously disclosed vulnerability, compromised legitimate maintenance credentials or used another method of accessing refrigeration systems.
There has also been no public indication that Danfoss’s own corporate network was breached.
Remote Maintenance Creates a Potential Route Into Refrigeration Systems
Commercial refrigeration equipment increasingly relies on connected controls that allow technicians to monitor operating conditions, review alarms, adjust settings and troubleshoot problems without visiting a store.
For supermarkets operating dozens or hundreds of refrigerated cases, remote management can reduce service visits and help technicians identify failures before food is lost.
But the same access can become dangerous if administrative credentials are compromised or equipment management interfaces are exposed to unauthorized users.
Unlike a conventional ransomware attack, which may prevent employees from accessing business systems, this incident appears to have involved direct manipulation of physical equipment.
Changing a refrigeration setpoint or initiating a defrost cycle is ordinarily a legitimate maintenance function. The danger arises when someone without authorization can issue those commands.
The attack also illustrates why responsibility for refrigeration cybersecurity can be complicated. Equipment may be purchased by a retailer, installed by a refrigeration contractor, connected by a systems integrator and subsequently maintained by a separate service company.
Those arrangements can leave questions about who is responsible for firmware updates, access credentials, network security and replacement of obsolete controllers.
Claroty’s researchers recommended restricting controller management interfaces to trusted networks, rather than exposing them directly to the public internet.
For refrigeration service companies, the French attack provides a concrete reason to review which customers still operate unsupported controllers, whether remote access is appropriately restricted and whether alarm systems can independently detect abnormal temperatures.
French Authorities Investigate as Retailers Assess Losses
The Paris prosecutor’s office opened an investigation into the cyberattack, with France’s national police cybercrime office involved in the inquiry.
According to AFP, prosecutors are examining the relationship between the attack and reported food losses and fires at affected stores.
Prime Minister Sébastien Lecornu directed France’s national cybersecurity agency, ANSSI, to investigate the incident, according to published reporting citing his office.
Information attributed to the prime minister’s office indicated that the agency had identified a vulnerability involving software supplied by a Danish company and contacted the manufacturer.
French officials were also coordinating with European counterparts because additional countries could be affected.
As of October 12, neither ANSSI nor France’s national computer emergency response team, CERT-FR, had issued a public technical advisory identifying the attack method.
Separately, Dutch supermarket operator Ahold Delhaize reported a security-related disruption affecting some digital services. No connection between that incident and the French refrigeration attacks has been established.
The identity of the attackers, their motive and the precise means of access remain unknown.
For affected supermarkets, the immediate priority is restoring refrigeration equipment, verifying safe operating temperatures and replacing destroyed inventory.
For retailers and refrigeration contractors elsewhere, the more lasting question is how many older, remotely accessible control systems remain in service without security updates—and who is responsible for securing or replacing them.
