Cyberattack defrosts refrigerators at French supermarkets

Overnight on Sunday, unidentified attackers remotely interfered with the refrigeration equipment of several major French retail chains. The attack defrosted display units, spoiled food, and caused significant losses.

What happened

According to Bleeping Computer, the intruders seized control of refrigeration controllers running older versions of Danfoss software and raised display temperatures by triggering the built-in automatic defrosting function. Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U. French outlets estimate that between 250 and 350 stores were affected.

An Intermarché spokesperson said some fresh and frozen display units were knocked out of service and that the company, along with its Netto chain, moved to remove the products from those units as quickly as possible. A full list of affected stores is not yet available.

Response

Coopérative U president Dominique Schelcher confirmed the incident and said several stores in the network were affected. He called an attack on equipment essential for preserving fresh produce and feeding the public unprecedented and unacceptable. EU agriculture commissioner Christophe Hansen also condemned the attack and named Leclerc among the victims.

The Paris prosecutor's office has opened an investigation into the large-scale cyberattack to identify the victims and connect it to the reported losses from spoiled food, as well as to the fires that broke out.

Vulnerable controllers

How exactly the attackers compromised the Danfoss controllers remains unknown. Back in May 2025, however, the U.S. agency CISA warned of an authentication-bypass vulnerability (CVE-2025-41450) in the Danfoss AK-SM 8xxA Series platform, used to manage refrigeration and HVAC systems in food retail. Predicta Lab CEO Baptiste Robert found 2,752 Danfoss systems exposed online, 1,590 of them in France.

On the same Monday, Ahold Delhaize, one of the world's largest food retailers, said it had to take some systems offline following a "cybersecurity incident." There is no evidence yet that the two are connected.

Source: Bleeping Computer