Attackers Disrupt Refrigeration Systems at Supermarkets Across France
Summary
Attackers forced refrigeration controllers at supermarkets in France and other countries into defrost mode, spoiling stock and reportedly causing fires. The intrusion method and perpetrators remain unknown; CERT-FR advised operators to restrict controller access.
Key points
- Attackers remotely forced supermarket refrigeration controllers into defrost overnight on October 11–12, heating equipment to as high as 50°C.
- Affected retailers included Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc; victims reportedly discarded fresh and frozen stock, and fires were reported.
- Danfoss identified end-of-life AK-SM 800 and AK-SC 355 controllers, as well as some AK-SM 800A units running outdated firmware.
- The intrusion method is undisclosed. No group has claimed responsibility, and authorities and Danfoss have not linked the incident to known CVEs.
- CERT-FR advised disconnecting affected controllers from the internet or tightly filtering access; operators were also advised to replace unsupported models and review contractor access.
- SOCRadar found 2,898 Shodan results for Danfoss StoreView interfaces in France, but internet exposure alone does not show that systems were compromised or explain how the attack occurred.
Article Details
- Victim Organization
- Intermarché, Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc
- Incident Type
- Cyberattack on supermarket refrigeration controllers; attackers forced systems into defrost mode, causing equipment to heat and disrupting refrigeration.
- Incident Date
- 2026-10-11
- Disclosure Date
- 2026-10-12
- Operational Impact
- Hundreds of stores in France and stores in Spain, Portugal, Poland, Germany, and Belgium were affected. Refrigerators and freezers reportedly reached 50°C for around six hours; stores discarded fresh and frozen stock, and fires were reported. Les Mousquetaires estimated losses in the tens of millions of euros across France; one Intermarché and one Super U store reportedly lost €270,000 in merchandise.
- Ransom Or Extortion
- No ransom demand or data theft was reported.
- Claim Status
- confirmed
CVE
CVE-2025-41450CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452 affect the AK-SM 800A, Claroty’s research did not cover the two end-of-life models Danfoss named, and no authority or vendor has linked the flaws to this incident.CVE-2025-41451CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452 affect the AK-SM 800A, Claroty’s research did not cover the two end-of-life models Danfoss named, and no authority or vendor has linked the flaws to this incident.CVE-2025-41452CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452 affect the AK-SM 800A, Claroty’s research did not cover the two end-of-life models Danfoss named, and no authority or vendor has linked the flaws to this incident.
People
Christophe HansenEU food and agriculture commissioner who commented that exploitation of food had become a reality.Dominique SchelcherCoopérative U CEO who described the attack as unprecedented and unacceptable.Felix AimeSekoia analyst who said Spain, Portugal, Poland, Germany, and Belgium were also affected.Sébastien LecornuPrime Minister mentioned in connection with a source close to him who said France’s cybersecurity agency had identified a software vulnerability and contacted the vendor.Thierry CotillardLes Mousquetaires CEO who estimated losses in the tens of millions of euros across France.
Threat Actors
Vendors
Products
AK-SC 355Vendor: Danfoss named its end-of-life AK-SM 800 and AK-SC 355 controllers, which no longer receive security updates, and said some current AK-SM 800A units on outdated firmware were also hitAK-SM 800Vendor: Danfoss named its end-of-life AK-SM 800 and AK-SC 355 controllers, which no longer receive security updates, and said some current AK-SM 800A units on outdated firmware were also hitAK-SM 800AVendor: Danfoss named its end-of-life AK-SM 800 and AK-SC 355 controllers, which no longer receive security updates, and said some current AK-SM 800A units on outdated firmware were also hitDanfoss StoreViewExposure: SOCRadar found 2,898 Shodan results for Danfoss StoreView interfaces in France on October 13, about 65% of the global total
Tools
Countries
BelgiumSpain, Portugal, Poland, Germany and Belgium were also affected.FranceFrench Supermarket Cyberattack: Exposed OT Behind France’s Food SupplyGermanySpain, Portugal, Poland, Germany and Belgium were also affected.PolandSpain, Portugal, Poland, Germany and Belgium were also affected.PortugalSpain, Portugal, Poland, Germany and Belgium were also affected.SpainSpain, Portugal, Poland, Germany and Belgium were also affected.