In a number of major French supermarket chains, refrigeration systems were disrupted by a cyberattack, forcing stores to remove fresh and frozen foods from their display units. It is estimated that 250 to 350 retail outlets, including Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, were impacted by the incident.
Several reports indicate that the attackers compromised older versions of Danfoss refrigeration controller software and remotely activated automatic defrosting functions. The process resulted in increased refrigerator temperatures, putting perishable food supplies at risk, resulting in financial losses and food waste.
A cyberattack reportedly involving a service provider that manages refrigeration systems resulted in the inability to use some fresh and frozen food displays at Intermarché. According to the company, precautionary measures have been taken to remove products from affected units, although a complete list of the stores affected does not yet exist.
Several stores within the Coopérative U network have also experienced disruptions, according to Dominique Schelcher, president of Coopérative U. As part of its investigation into the circumstances surrounding the attack, the company's teams were working with refrigeration specialists to restore normal operations.
As a result of the incident, concerns have been raised about the security of digital systems supporting essential food retail operations.
A sense of urgency was conveyed by the European Union Agriculture and Food Commissioner Christophe Hansen, who emphasized the importance of not targeting equipment responsible for preserving food.
Vulnerabilities in Danfoss Systems Raise Security Concerns
ANSSI (National Cybersecurity Agency of France) has been directed to assess the risks and determine whether other businesses could be affected by the incident, while French authorities are investigating it. It appears that refrigeration units reached temperatures as high as 50°C, which resulted in extensive food spoilage and fires at several locations.
Approximately 150 stores in Intermarché's parent group have been disrupted, whereas 80 supermarkets in Carrefour have been affected. Due to previously revealed security vulnerabilities, Danfoss refrigeration management systems have been under scrutiny. It was discovered by Claroty's Team82 in August 2026 that there are flaws in the Danfoss AK-SM 800A platform, which allows operators to monitor and control refrigeration equipment remotely through a web-based interface.
An authentication bypass vulnerability, CVE-2025-41450, and a command injection vulnerability, CVE-2025-41451, could allow remote code execution. There is also a third flaw, CVE-2025-41452, which could be used for denial of service attacks through the injection of Nginx configuration. To address these issues, Danfoss released firmware version R4.3.1.
A number of Danfoss systems are accessible through the internet, which raises concerns about unauthorised access to equipment in supermarkets and other commercial establishments. The affected systems were equipped with outdated firmware, according to Danfoss, and customers had previously been advised to upgrade older equipment. Investigators have not yet confirmed whether any of the disclosed vulnerabilities were exploited in the attack at the French supermarket.
Moreover, it is unclear how the refrigeration controllers were accessed.
Connected Refrigeration Systems Present Cyber-Physical Risks
Security experts have stated that this incident illustrates the dangers associated with attacks against operational technology (OT) despite not targeting conventional information systems. It is possible for refrigerator controllers to make unauthorised changes that may disrupt the handling of food, pharmaceuticals, and other supply-chain functions in temperature-sensitive environments.
Researchers at Claroty warn that security teams can be overlooking refrigeration controllers, particularly when remote maintenance interfaces are accessible via the public internet. Although remote access can assist technicians in maintaining equipment at multiple locations, poorly secured connections can provide attackers with opportunities.
In order to ensure security, users should install the latest firmware, remove unnecessary internet exposure, restrict administrative access to trusted networks, and utilize virtual private networks to secure remote connections as well as network segmentation. Additionally, organizations should examine exposed devices and verify that appropriate access control measures have been implemented.
It is unclear who is responsible for the attack, and the investigation continues.
The incident emphasizes the importance of securing connected industrial equipment, particularly systems with the potential to affect public services, food safety, and crucial business functions directly.
Despite the incident, the need for securing internet-connected operational technology
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: