Cyberattack defrosts the fridges at hundreds of French supermarkets

The attack did not encrypt a single file, steal a single customer record or display a single ransom note. It simply told the equipment that keeps food cold to warm up, and then kept telling it. Reports from the affected stores describe temperatures inside display cabinets climbing to around 50°C over a period of roughly six hours, with staff arriving to find pools of water beneath the freezers and a wave of warm air escaping when the doors were opened. In a handful of stores the overheated units caught fire.

It is a useful reminder, delivered at scale, that the systems we rely on most are increasingly the ones nobody thinks of as computers. A supermarket's refrigeration plant is managed by a small embedded controller with a web interface, installed by a specialist contractor and left to run quietly for years. It is precisely that quiet, dependable, out-of-sight quality that makes it such an attractive target.

Who was hit

The two chains that confirmed the incident first were Intermarché and Coopérative U, both of which spoke to AFP on Monday morning. Intermarché, part of the Groupement Les Mousquetaires, put the number of affected stores at somewhere between 150 and 200, and said those branches would have to discard all of their fresh and frozen products. Coopérative U said that almost 100 of its outlets, trading as Super U and Hyper U, had been affected. Carrefour later confirmed that around 80 of its supermarkets had been hit, while stressing that the vast majority of its 6,000 French stores were untouched. French retail press and BFMTV also placed Leclerc, Monoprix and Carrefour Market among the victims, although not every chain had confirmed its exposure by Monday evening. Taken together, the early estimates run to somewhere between 250 and 350 stores across the country.

Intermarché's spokesperson told BleepingComputer that the attack had reportedly affected a service provider that manages refrigeration systems in stores, that some fresh and frozen display units were out of service, and that Intermarché and its discount sister brand Netto had taken all necessary precautions to remove products from those units as quickly as possible. The company said it did not yet have a list of affected stores to share.

Dominique Schelcher, president of Coopérative U, confirmed the incident on X in the early hours of Monday, saying that a cyberattack had been affecting the refrigeration systems in several of the network's stores since the previous evening, that teams were fully mobilised alongside refrigeration specialists, and that an investigation would be needed to shed full light on what had happened. He described the targeting of equipment essential to preserving fresh produce and feeding the French public as extremely serious, unprecedented and unacceptable.

Christophe Hansen, the European Commissioner for Agriculture and Food, condemned the attack publicly and named Leclerc, France's largest grocer, among the victims. Early loss estimates reported by French outlets were approaching €300,000 on Monday, with the expectation that the final figure for spoiled stock, cleaning and replacement equipment would run into the millions once every store had been counted.

How the attack worked

The equipment at the centre of the incident is reported to be the Danfoss AK-SM 800A series, a supervisory controller that sits above the individual refrigeration cases in a store and coordinates them. It is the device a contractor logs into to set temperatures, schedule defrost cycles, review alarms and check that the plant is behaving. Because that contractor is usually off site, the controller ships with an embedded web server and a browser-based management interface, and it is common for that interface to be reachable remotely.

That architecture is what turned one compromised box per store into a whole shop of warm cabinets. The supervisory controller, whether the newer AK-SM 800A or the older AK-SC 355 that is still widely installed, has an Ethernet port facing the network on one side and LON over RS485, Modbus and RS232 facing the plant on the other. Those field buses carry no authentication at all. The case controllers, pack controllers and sensors hanging off them were designed on the assumption that the only thing talking to them is the front end they are wired to, and they will act on whatever it tells them. Compromise the one Ethernet-facing device and you inherit unchallenged write access to every piece of refrigeration equipment behind it, which is exactly the leverage the attackers used.

Every commercial freezer has to defrost periodically to clear the ice that builds up on its evaporator coils. On a healthy system the controller runs that cycle for a short, bounded period, typically totalling around two hours a day spread across several short bursts, and then returns the case to its set point. According to the French reporting, the attackers did not need to invent anything clever. They gained access to controllers running older versions of the Danfoss software, invoked the defrost function that was already built in, and removed the limits that would normally stop it. The cases warmed steadily through the night until, by the time staff arrived on Monday, the contents of hundreds of freezers had thawed and spoiled.

The physical consequences went beyond lost stock. The Paris prosecutor's statement refers explicitly to outbreaks of fire alongside the food losses, and the retailers' own descriptions of heat escaping from the units are consistent with defrost heaters running far longer than they were designed to. That a remotely issued configuration change could produce a fire on a shop floor is the part of this story that should make operators of connected building systems sit up, because it moves the conversation from data loss to physical safety.

Both Intermarché and the French press point to a third party rather than the retailers' own IT estates as the likely point of entry. Intermarché described the incident as affecting a service provider that manages refrigeration systems in stores, which is consistent with a single maintenance contractor or monitoring platform holding remote access to controllers across many different brands. That would also explain how an attack could land on competing chains in the same night. Nothing has been published yet to confirm exactly how that access was obtained.

A vulnerability that was already known

The weaknesses in these controllers were not a secret. In 2025 Claroty's Team82 research group examined the attack surface of the AK-SM 800A and found three vulnerabilities in its web management interface. The most serious, tracked as CVE-2025-41450, is a hidden "code of the day" authentication mechanism, apparently intended for vendor support, in which the controller generates a daily administrative password from its current date. Team82 reconstructed the algorithm, which meant anyone who could reach the interface could calculate that day's credentials and bypass normal authentication entirely. A second flaw, CVE-2025-41451, passed the SMTP email password into an operating-system shell command without sanitisation, opening a path from authenticated access to remote code execution on the device.

CISA included the authentication bypass in its vulnerability bulletin in May 2025 and rated it high severity. Danfoss addressed all three issues in firmware release R4.3.1, published in August 2025, and advised customers to upgrade to that version or later. Team82's own write-up carried the title "Freeze the Controller, Defrost the Food", which with hindsight reads as a fairly precise description of what happened in France fourteen months later. The same research programme also found two dozen issues in Copeland's XWEB Pro controllers and further problems in Trane's Tracer SC+, so the exposure is an industry pattern rather than a single vendor's oversight.

The other half of the problem is reachability. When Team82 searched Shodan and Censys during its research it counted around 2,765 AK-SM 800A management interfaces exposed directly to the internet. On Monday, as the news broke, Predicta Lab's Baptiste Robert ran a fresh scan and found 2,752 Danfoss systems still online, of which 1,590 were in France. A patch that was available for over a year, applied to only some of the installed base, combined with thousands of management interfaces reachable from anywhere in the world, is the whole story in two numbers.

We ran our own check on Monday. Using the currently available open-source internet scanning services alongside our founder's IP Insights threat intelligence project, we identified over 800 refrigeration and building-management controllers in the United Kingdom — spanning Danfoss, Carel, Copeland and other vendors — whose management interfaces answer directly from the public internet. The Danfoss units at the centre of the French attack are only a fraction of that total; the larger exposure is the wider family of refrigeration and building controllers that share the same design, a web interface reachable from anywhere, more often than not sitting on a store's own broadband line. Each of those is a UK store, cold store or plant room where the only thing between an attacker and the defrost cycle is a login page, and in a good many cases an unpatched one.

The investigation and the wider picture

The Paris prosecutor's office confirmed to AFP on Monday that it had opened an investigation into a large-scale cyberattack affecting the refrigerators of several major food retail chains across France, with the stated aims of identifying the victims and establishing the link between the attack and the reported food losses and fires. No group has claimed responsibility and no attribution has been offered by the French authorities. Danfoss had not commented publicly by Monday evening.

The incident arrives at the end of a difficult year for French retail. Intermarché disclosed in August 2026 that attackers had accessed the personal data of 287,605 customers of its Drive click-and-collect service, an incident the Paris prosecutor is also investigating, and Auchan and Picard have suffered their own breaches since 2024. Those were conventional data thefts. Sunday's attack is of a different character altogether, aimed at physical operations rather than information, and it is the first time a European grocery sector has seen an operational technology attack at this scale.

Separately, and on the same Monday, the Dutch-Belgian retail group Ahold Delhaize announced that it had taken some of its systems offline in response to a cybersecurity incident. Ahold Delhaize owns Albert Heijn, Delhaize and a number of large American grocery brands. There is no evidence at the time of writing that the two events are connected, and the company has not described the nature of its incident, but the coincidence of timing has not gone unnoticed.

What this means for UK operators

The comforting fact at the heart of this story is that it was entirely preventable with ordinary, unglamorous housekeeping. There was no novel exploit, no zero-day and no sophisticated adversary required. The controllers that stayed cold on Sunday night were, in all likelihood, the ones that had been updated to current firmware and were not reachable from the open internet. The ones that warmed up were the ones nobody had looked at for a while. That is good news, because it means the difference between a normal Monday and a skip full of spoiled stock is within the gift of every operator reading this.

The first question for any UK retailer, cold-store operator, food manufacturer, hospital or facilities team is a simple one: do you know which refrigeration, HVAC and building management controllers you have, who manages them, and what firmware they are running? In our experience the honest answer is often that the contractor knows and the business does not. The AK-SM 800A, the Copeland XWEB Pro and the Trane Tracer SC+ are all widely installed across the UK, and all three have had fixes available for over a year. Confirming that those fixes have been applied is an afternoon's work with the right contractor on the phone.

The second question is whether those management interfaces can be reached from outside your network at all. A refrigeration controller has no business being directly addressable from the internet, however convenient that is for an engineer on call, and the lesson is the same one we drew from the Citrix NetScaler zero-days: anything that answers on the internet-facing side will eventually be found by someone who is not your engineer. Remote access should run through a VPN or a properly managed remote-access gateway, restricted to named engineers, with multi-factor authentication and a record of every session. Where a third-party maintenance provider holds that access on your behalf, as appears to have been the case in France, it belongs in your supplier due diligence alongside every other provider with a route into your operations, a point we made after the City Relay breach. Ask them how they secure it, who at their end can use it, and what they would notice if someone else did.

The third is visibility. The attack in France ran for roughly six hours before anybody noticed, because nobody was watching the controllers and the controllers were doing exactly what they had been told. A temperature alarm from the plant, a configuration change logged outside working hours, or a login to a controller from an unfamiliar address are all events a monitored environment would have raised within minutes. For clients of our SOC we treat operational technology on the same footing as servers and laptops, because an attacker plainly does. If you would like us to help you find out where your own controllers stand, or to bring them under monitoring, our team is happy to talk it through.

Retail runs on trust that the chilled aisle is cold. Keeping that trust turns out to be a matter of knowing what you own, patching it, and not leaving its front door open to the street. That is a very ordinary kind of good morning, and it is the one worth selling.

Sources

BleepingComputer: Cyberattack shuts down refrigerators at French supermarkets · AFP via France 24: French supermarket chains say cyberattack forced refrigerator shutdown · France 24: 'Unprecedented' cyberattack targets refrigeration units at hundreds of French supermarkets · Euronews: Hundreds of French supermarkets hit by cyberattack on refrigeration systems · Quartz: Cyberattack disables refrigeration at French supermarkets · Claroty Team82: Freeze the Controller, Defrost the Food · Refrigeration Industry: Danfoss, Copeland and Trane address controller security vulnerabilities · AFP: Enquête ouverte après la fuite des données de 300.000 clients d'Intermarché