Hundreds of French supermarkets have suffered refrigeration disruption in a cyberattack that forced retailers to discard food and raised concerns about the security of connected equipment used across the grocery sector.
The attack, reported on Monday, 12 October, affected stores operated by several major supermarket groups, including Intermarché and Coopérative U. Hackers triggered refrigeration defrost cycles, leaving affected branches unable to preserve fresh and frozen stock. French prosecutors have opened an investigation.
The incident highlights a particularly damaging form of cyber disruption: interference with equipment that controls physical conditions. For food retailers, the consequences can extend from interrupted operations to destroyed stock, equipment inspections and the challenge of restoring confidence in refrigeration systems before shelves can be replenished.
Hundreds of Stores Affected as Retailers Assess Damage
The scale of the disruption was still emerging on Monday, with different reports giving different totals.
Euronews initially reported approximately 150 to 200 affected Intermarché stores and nearly 100 Coopérative U outlets. Subsequent The number is at at least 300 Intermarché or Netto shops and more than 100 Coopérative U stores, alongside several E.Leclerc locations. These figures should be treated as evolving assessments rather than combined into a definitive national total.
Coopérative U chief executive Dominique Schelcher condemned the targeting of equipment essential to preserving food. AFP also reported that European agriculture and food commissioner Christophe Hansen warned about the implications for food security.
Temperatures reached 50°C, with prosecutors reporting food losses and fires. Carrefour said 80 supermarkets were affected; Monoprix reported disruption at 5% of its stores. ANSSI, France’s national cybersecurity agency, was investigating. Danfoss said affected equipment used outdated firmware. No industry-wide loss estimate was available. Separately, Ahold Delhaize reported network disruption but said there was no reason to link its incident to the French attacks.
Refrigeration Controls Become a Cybersecurity Concern
The reported manipulation of defrost cycles places the incident within the broader category of operational technology security.
Operational technology, or OT, covers programmable systems that monitor or change physical conditions. The US National Institute of Standards and Technology’sGuide to Operational Technology Securityincludes building automation and environmental monitoring among the systems requiring this approach. Its guidance stresses the need to account for safety, reliability and performance alongside conventional cybersecurity requirements.
Applied to supermarkets, that distinction matters. A refrigeration controller’s settings influence what happens inside a cabinet or cold room. If control is lost, restoring a password or reconnecting a server may address only part of the problem: operators must also establish that the equipment is functioning correctly and that affected stock has been handled appropriately.
This creates a recovery process involving store managers, refrigeration engineers, cybersecurity specialists and food-quality teams. Each has information the others need. Technical teams may identify suspicious access, while engineers establish equipment condition and store personnel document the products and locations affected.
Danfoss Advisories Provide Context, but Do Not Establish the Attack Method
Danfoss has previously disclosed vulnerabilities affecting its AK-SM 8xxA refrigeration management platform. Those disclosures provide relevant technical background, but their existence does not establish which vulnerability, if any, was exploited in this incident.
In itsMarch 2025 security advisory, the manufacturer documentedCVE-2025-41450, an authentication weakness rated8.2 out of 10.
The flaw affected versions earlier than 4.2 and could allow an attacker to generate a web report exposing information such as internal IP addresses, usernames and store names. Danfoss identified version 4.2 as the remediation for that vulnerability and directed customers to its software download resources.
That description is significant because an authentication bypass does not automatically mean an attacker can perform every administrative operation. The documented impact of this particular advisory concerns information disclosure. It should not be presented as proof of how refrigeration settings were changed.
A separateAugust 2025 Danfoss advisorydescribed two vulnerabilities affecting versions earlier than 4.3.1:
- CVE-2025-41451, rated8.7, could permit remote code execution through command injection after authentication.
- CVE-2025-41452, rated6.8, concerned web-interface configuration and could permit denial of service after authentication.
Danfoss identified release 4.3.1 as addressing those issues. Both vulnerabilities required authentication, a condition that matters when assessing possible attack paths.
The material reviewed does not establish a confirmed connection between these specific CVEs and Monday’s attack. Naming them as the proven cause would go beyond the available evidence.
Updating Equipment Requires Attention to Configuration
Danfoss’scurrent AK-SM 800A support documentationillustrates why securing connected refrigeration involves more than checking whether an update exists.
The company describes a “Strict” session-control setting, introduced in software releases 4.0.x and above, that requires HTTPS and session-based authentication. It also documents a backward-compatible mode that allows weaker communication settings and which the manufacturer does not recommend.
The documentation warns that upgrades can affect third-party connections. Where customers are uncertain about their configuration, Danfoss recommends an on-site update, personnel available at the site, or consultation with technical support. Its download page currently lists a 5.3.x software package dated October 2026.
For operators reviewing their installations, the practical implication is that historical patch numbers should not be mistaken for a complete current security baseline. Equipment model, software release, operating-system requirements and integration settings all need to be checked against the manufacturer’s applicable instructions.
There is also a management question: who is responsible for confirming that an update has been installed successfully and that the equipment remains in a secure configuration afterwards? Where responsibility is divided among a retailer, installer and maintenance provider, that answer needs to be explicit.
Shared Equipment Creates Shared Exposure
One lesson suggested by the disruption is that separate businesses can face a common operational risk through technology they all use.
A retailer may assess its exposure mainly through its own corporate network. Refrigeration management introduces additional dependencies: equipment suppliers, maintenance arrangements, remote-access services and the software supporting those connections.
This does not mean a manufacturer’s central network must have been breached for multiple customers to suffer disruption. A common product weakness or insecure deployment pattern could also expose separate installations. The investigation will need to establish which circumstances applied here.
For retail executives, the distinction changes the questions asked of suppliers. Alongside product performance and maintenance response times, businesses need visibility into security support periods, update responsibilities, remote-access controls and procedures for responding to a vulnerability affecting many locations simultaneously.
Recovery Extends Beyond Restoring Connectivity
The operational implications reach beyond the initial loss of stock.
As a business-continuity assessment, a widespread refrigeration incident can create competing demands for engineers, replacement inventory, disposal services and staff time. A store may regain technical control before it is ready to resume normal trading across every affected department.
Recovery planning should therefore address both system integrity and store operations. Useful priorities include:
- Establishing which controllers, software versions and remote connections are present at each location.
- Reviewing access permissions and unnecessary external connectivity.
- Applying manufacturer-supported updates with appropriate engineering support.
- Checking refrigeration settings and alerting functions before returning equipment to routine operation.
- Preserving available logs and configuration records for investigators.
- Coordinating stock decisions and reopening checks with the responsible operational teams.
These are broader resilience considerations, rather than a confirmed incident-specific remediation plan. NIST’s OT guidance supports a layered approach that includes network segmentation and security measures adapted to operational constraints.
Major Questions Remain
The reporting reviewed leaves important questions unresolved: the precise initial access route, the full set of affected equipment, whether attackers used shared access arrangements, and the identity and motivation of those responsible.
The existence of earlier vulnerability disclosures cannot answer those questions on its own. Nor does disruption at another retailer establish a connection without supporting technical evidence.
What the incident demonstrates is the importance of including refrigeration and other connected building systems in retail cybersecurity planning. When digital controls govern the conditions needed to preserve goods, a security failure can become an operational loss before an investigation has established how the attackers entered.
For supermarkets assessing their exposure, the immediate challenge is to understand those dependencies well enough to protect equipment, detect abnormal behaviour and recover safely across every affected location.
