Cyberattack shuts down refrigerators at French supermarkets

Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers.

Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, with French outlets reporting that the attack affected 250 to 350 stores, causing significant financial losses and food waste.

The threat actors hijacked refrigeration controllers running older versions of Danfoss control software on Sunday night and used them to raise supermarket refrigerator temperatures by triggering a built-in automatic defrosting system.

"Following a cyberattack reportedly affecting a service provider that manages refrigeration systems in stores, some fresh and frozen food display units are out of service," an Intermarché spokesperson told BleepingComputer when asked for more information on the incident. "Intermarché and Netto have taken all necessary precautions to remove the products from these units as quickly as possible. We don't have further information currently, nor a specific list of affected stores to share with you."

Coopérative U president Dominique Schelcher also confirmed the incident earlier today and said that the attack affected multiple stores in the chain.

"I can confirm that, since last night, a cyberattack has been affecting the refrigeration systems in several stores within our @CooperativeU network. Our teams are fully mobilized, working alongside refrigeration specialists, to resolve the situation as quickly as possible. An investigation will be conducted to shed full light on this attack," Schelcher said.

"Targeting equipment essential for preserving fresh produce and supplying food to the French people is an extremely serious matter and is unprecedented. It is unacceptable."

EU agriculture and food commissioner Christophe Hansen also condemned the attack and named France's largest supermarket chain, Leclerc, as one of the victims.

The Paris prosecutor's office has told AFP that it has opened an investigation into "the large-scale cyberattack affecting the refrigerators of several major food retail chains across France" to "identify the victims and establish the link with the damage they reported in terms of foodstuff losses and the outbreak of fires."

While no information is available on how the attackers were able to compromise the Danfoss refrigeration controllers, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned in May 2025 of a high-severity authentication bypass vulnerability (CVE-2025-41450) in the Danfoss AK-SM 8xxA Series hardware platform used to manage refrigeration and HVAC systems typically found in the food retail sector.

While researching the attack surface, Predicta Lab CEO Baptiste Robert found 2752 Danfoss systems exposed online, 1590 of them in France.

Spokespersons for Danfoss, Leclerc, and Coopérative U were not immediately available for comment when contacted by BleepingComputer earlier today.

Although there is no evidence yet that the two are connected, retail giant Ahold Delhaize, one of the world's largest food retail chains, also announced on Monday that it had to take some systems offline after a "cybersecurity incident."

Update October 12, 13:23 EDT: Added Intermarché statement.

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat