A French supermarket cyberattack reportedly disrupted refrigeration systems at 250 to 350 stores, forcing retailers to remove fresh and frozen products. Attackers allegedly triggered automatic defrost functions remotely, raising temperatures inside food storage and display units.
The incident began overnight on October 11 and affected several major retail chains. Reports named Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc and Super U among the victims.
Attackers Reportedly Activated Defrost Controls
Initial reports suggest the attackers targeted refrigeration controllers running older Danfoss control software. After gaining access, they allegedly activated a built-in defrosting function to increase refrigerator temperatures.
However, investigators have not established how the attackers accessed those systems. The reported store count also remains an estimate, rather than a confirmed total from every affected retailer.
The disruption caused food waste and financial losses as stores removed products from affected units.
Retailers Remove Food and Work to Restore Cooling
Intermarché confirmed that some fresh and frozen food display units had stopped working. According to the retailer, the incident reportedly involved a service provider responsible for managing refrigeration systems.
Intermarché and Netto consequently took precautions to remove products from affected units as quickly as possible. However, the company did not provide a complete list of impacted locations.
Meanwhile, Coopérative U confirmed refrigeration problems at several stores within its network. Its teams began working with refrigeration specialists to restore normal operations.
The chain also said an investigation would examine the attack. Separately, EU agriculture and food commissioner Christophe Hansen condemned the incident and identified Leclerc among the affected retailers.
Prosecutors Investigate French Supermarket Cyberattack
The Paris prosecutor’s office opened an investigation into the widespread refrigeration disruption.
Investigators aim to identify affected businesses and determine whether the attack caused reported food losses and fires. At this stage, the reported fires remain part of that inquiry, rather than an established consequence of the intrusion.
Authorities have not publicly identified the attackers or explained their motives.
Earlier Danfoss Vulnerabilities Draw Attention
Two previously disclosed vulnerabilities affect the Danfoss AK-SM 8xxA platform, which manages refrigeration and heating, ventilation and air-conditioning systems.
CVE-2025-41450 concerns an authentication bypass, while CVE-2025-41451 involves command injection. CISA highlighted the flaws in May and August 2025, respectively.
Researchers also published technical findings in August explaining how attackers could exploit the weaknesses to achieve remote code execution through publicly accessible management interfaces.
However, no evidence currently establishes that either vulnerability enabled this supermarket attack.
Thousands of Systems Appear Accessible Online
An examination of internet exposure identified 2,752 Danfoss systems online on October 12, including 1,590 in France. Separately, the Shodan search engine listed more than 4,500 internet-accessible Danfoss devices.
These figures represent different searches and do not establish how many devices attackers compromised. Nevertheless, they highlight the scale of publicly reachable refrigeration management equipment.
The incident also coincided with a separate network security disruption at Ahold Delhaize. No evidence currently links the two events.
0 responses to “French Supermarket Cyberattack Disrupts Refrigeration”