Hackers Target 300+ French Supermarkets: Refrigeration Attack Exposes Security Risks

Hackers reportedly manipulated supermarket refrigeration systems across France, causing temperatures to rise and food to spoil, while authorities investigate reports of fires and other damage linked to the attack.

The Oct. 12 cyberattack targeted refrigeration systems at hundreds of French grocery stores, including locations operated by Intermarché, Netto, Coopérative U, and E. Leclerc. According to AFP, attackers reportedly triggered refrigeration defrost cycles, forcing affected retailers to discard fresh and frozen inventory.

"These are the same category of systems that the security industry has been warning about as the next frontier for sabotage attacks," Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, told eSecurityPlanet, referring to refrigeration and other operational technology systems.

For cybersecurity teams, the incident highlights how compromised connected equipment can disrupt physical operations, destroy inventory, and pose safety risks without requiring ransomware or data theft.

Hackers manipulate refrigeration systems across France

The attack unfolded overnight between Oct. 11-12, affecting refrigeration systems at several major French supermarket chains.

Initial reports indicated that approximately 150 to 200 Intermarché stores were targeted. Later AFP reporting put the number of targeted Intermarché and Netto locations at at least 300. Reports placed the number of affected Coopérative U outlets at approximately 100, although published estimates differed.

Le Monde reported that approximately 80 Carrefour stores were affected. Separately, French-language AFP reporting said Monoprix confirmed that approximately 30 of its locations were affected.

E. Leclerc confirmed that a cyberattack involving one of its refrigeration equipment suppliers disrupted systems at several stores. The total number of stores that experienced equipment damage or inventory losses remains unclear.

Les Mousquetaires, which operates Intermarché and Netto, reported that attackers manipulated refrigeration controls. An Intermarché store owner in Gradignan told Le Monde that his cold-storage room reached 50°C (122°F), triggering an automatic sprinkler.

Le Monde separately reported that attackers extended defrost cycles from one hour to eight hours, delaying alarms and increasing damage. The disruption forced affected stores to discard inventory over food safety concerns.

The Paris prosecutor's office opened an investigation into the large-scale cyberattack. According to Reuters, prosecutors said the reported damage included food losses and fires, while investigators worked to identify the victims and determine the full extent of the incident.

French Prime Minister Sébastien Lecornu also instructed the country's national cybersecurity agency, ANSSI, to investigate the incident and determine whether additional organizations may have been exposed.

Attention has turned to refrigeration management software supplied by Danish manufacturer Danfoss.

Danfoss identified its AK-SM800 and AK-SC355 refrigeration controllers as affected systems and said that a version of the AK-SM800 was running outdated firmware. The manufacturer advised customers to replace unsupported legacy equipment and update supported systems.

A source close to French Prime Minister Sébastien Lecornu said ANSSI had identified a vulnerability in software supplied by Danfoss. However, investigators have not publicly disclosed the technical details or confirmed the attackers' initial access method.

The incident also raises questions about previously disclosed vulnerabilities affecting Danfoss refrigeration controllers.

In 2025, Danfoss disclosed CVE-2025-41450, a high-severity authentication vulnerability affecting AK-SM 8xxA controllers running software versions earlier than 4.2.

The vulnerability carries a CVSS score of 8.2 and can allow authentication bypass under certain conditions. However, investigators have not established whether it played any role in the French supermarket attack.

What the refrigeration attack reveals about OT security

Rather than focusing on data theft or ransomware encryption, this attack reportedly involved manipulating physical equipment through connected control systems, demonstrating how a cybersecurity incident can directly disrupt business operations.

Commercial refrigeration systems increasingly depend on connected controllers, remote monitoring platforms, and software that allows operators to adjust settings across multiple locations.

These capabilities improve efficiency and simplify maintenance, but they also introduce security risks when access controls, firmware, or network protections are inadequate. An attacker who compromises a management interface could potentially manipulate equipment settings, interrupt operations, or cause physical damage.

Patel warned that the financial consequences of an attack on refrigeration infrastructure can extend well beyond the immediate equipment failure.

"The immediate financial consequences are significant and visible," he noted, pointing to the potential loss of perishable inventory across affected locations.

The operational disruption can compound quickly. Stores may be unable to sell or restock temperature-sensitive products until refrigeration systems are restored and verified safe, turning a compromised controller into a wider business continuity problem.

The French incident also raises questions about the security of older industrial systems. As eSecurityPlanet previously explained in its coverage of embedded device security risks, many OT and Internet of Things (IoT) devices remain operational for years or decades, often long after their original software becomes difficult to maintain.

Replacing these systems can be expensive, while applying updates may require planned downtime. That creates a security challenge for organizations that depend on connected infrastructure but cannot easily replace vulnerable equipment.

The consequences extend beyond supermarkets. Similar risks can affect warehouses, pharmaceutical storage facilities, food-processing plants, and other environments where connected equipment maintains essential operating conditions.

What security teams should do to protect connected equipment

The French supermarket attack offers a warning for organizations managing refrigeration, industrial controls, and other connected operational systems.

"The food retail sector across Europe should be treating this as a signal that they are being actively targeted," Patel said.

Security teams should review whether equipment that directly affects physical operations receives the same attention as traditional IT infrastructure.

Five security priorities deserve immediate attention:

1. Identify exposed equipment. Maintain an inventory of connected refrigeration controllers, industrial devices, firmware versions, and remote management interfaces. Determine which systems are accessible through external networks or third-party services.
2. Update outdated firmware. Review manufacturer security advisories and identify unsupported equipment. Danfoss AK-SM 8xxA administrators should assess their systems against previously disclosed vulnerabilities, including CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452, and follow the manufacturer's latest remediation guidance. Where immediate updates are impractical, apply compensating controls and establish a replacement plan.
3. Restrict remote access. Limit administrative access to authorized personnel and vendors. Use strong authentication, including multifactor authentication where supported, and disable unnecessary remote management services.
4. Segment operational networks. Separate refrigeration controllers and other OT equipment from corporate IT systems and unrelated devices. Restrict communications to approved systems and services.
5. Monitor physical operating conditions. Establish independent temperature alerts, investigate unauthorized configuration changes, and ensure employees can recognize and respond to abnormal equipment behavior.

Network isolation is particularly important because an intrusion involving one connected system should not automatically expose an organization's broader infrastructure.

Organizations should also establish incident response procedures specifically for operational disruptions. As discussed in eSecurityPlanet's analysis of critical infrastructure security lessons, network visibility, secure remote access, and OT-specific incident response planning remain essential protections.

For grocery retailers, that means preparing for more than a disconnected network. Response plans should address food safety, equipment recovery, inventory disposal, vendor coordination, and the ability to operate critical systems manually where feasible.

Security teams should also coordinate with facilities managers to determine whether temperature monitoring and emergency shutdown mechanisms can operate independently of compromised management software.

Organizations using Danfoss refrigeration controllers should identify their specific models, review firmware versions, and consult manufacturer security advisories. The previously disclosed CVE-2025-41450 specifically affects AK-SM 8xxA software versions earlier than 4.2 and should not automatically be assumed to affect other Danfoss controllers.

Danfoss has also published security advisories covering two additional AK-SM 8xxA vulnerabilities: CVE-2025-41451, a post-authentication command injection flaw that could enable remote code execution, and CVE-2025-41452, a post-authentication web interface configuration vulnerability that could cause denial of service. Both affect software versions earlier than 4.3.1 and carry CVSS scores of 8.7 and 6.8, respectively.

Security teams managing these systems should follow the manufacturer's latest remediation guidance rather than assume that all Danfoss controllers share the same exposure.

The French investigation remains ongoing, and the full scope of the vulnerabilities involved has not been publicly established.

For organizations operating connected infrastructure, the immediate lesson is clear: a compromised controller can become a business-wide emergency. Security teams that identify vulnerable equipment, restrict remote access, and test their operational recovery procedures will be better positioned to contain the damage before a cyberattack becomes a physical crisis.

Related reading: The French supermarket attack echoes another recent threat to critical infrastructure: "Hackers Target Over 100 US Water Systems in a Single Month," which examines how attackers exploited exposed industrial control systems to disrupt operations.