Hackers turned up the heat in freezers at hundreds of French supermarkets

Early on Monday, October 12, supermarket managers opened their freezers and felt a blast of warm air. Several of them described “a wave of heat”, according to the French tech site Génération-NT. During the night, someone had taken remote control of the refrigeration system and started a defrost cycle that never ended. Display cases meant to keep frozen food at −18°C had been told to reach 50°C.

The scale became clear during the day. Retailers confirmed to AFP that at least 300 Intermarché and Netto stores were affected, along with just under 100 Coopérative U stores, 80 Carrefour supermarkets, about 30 Monoprix and “several stores” in the E.Leclerc group. The first count from Les Mousquetaires, the group behind Intermarché, given to Reuters, was 150 stores; it was later revised sharply upwards. According to a source close to the case quoted by AFP, the target was refrigeration controllers made by Denmark’s Danfoss.

Nobody has claimed responsibility. No customer database was copied and no ransom has been publicly demanded. The attackers did something rarer: they damaged the physical world.

One night, tonnes of goods

Thierry Cotillard, who chairs Les Mousquetaires (Intermarché, Netto), described how it worked on BFMTV on Monday evening: the hackers managed “to put all our refrigerated cabinets into defrost and raise their temperature to 50 degrees”. Some equipment stayed at that temperature for six hours, Les Mousquetaires told Reuters. Once the cold chain is broken there is no health debate to be had: everything that warmed up goes in the bin.

In Haguenau, in Alsace, one Intermarché puts its loss at €50,000, according to Génération-NT; a nearby Leclerc threw away €220,000 worth of goods. At the Alsace Intermarché the frozen food was lost, but chilled products such as dairy, meat and ready meals were saved thanks to the refrigeration contractor Axima, the trade site Points de vente reported. Multiply that by several hundred stores and the bill climbs fast. “It will be tens of millions of euros nationwide in a single morning of crisis management,” Cotillard said, calling it something “never seen before”.

Money is not the only damage. The Paris prosecutor’s office, which opened an investigation on its own initiative, has handed the case to France’s anti-cybercrime office, OFAC. Investigators must identify the victims and link the attack to the food losses and to equipment that “started to catch fire”. A compressor or a defrost heater running for hours outside its normal settings can overheat: that is the scenario investigators will have to document store by store.

Then there is insurance. According to Intermarché, one of the “sticking points” will be that policies do not “cover this type” of incident. For an independent store owner, and most Intermarché, U and Leclerc stores are independently run, the bill may well land on the manager, at least until it is clear whether the supplier or the installer can be held liable.

« Attacking equipment that is essential to preserving fresh produce and to feeding the French people is extremely serious and unprecedented. »

Dominique Schelcher, chief executive of Coopérative U, on X

The affair quickly reached the top of government. According to his office, Prime Minister Sébastien Lecornu asked ANSSI, the national cybersecurity agency, to take up the case. The agency says it is mobilised in France, to support victims, and at European level with its counterparts. The commerce ministry says it is “in contact with retailers”. The retail federation FCD has called on Danfoss and refrigeration contractors to show “total transparency on the situation”.

End-of-life controllers, open to the internet

Danfoss does not make the display cabinets. It supplies the electronics that run them: “system managers” installed in the store’s plant room, which set temperatures, defrost cycles and alarms for dozens of refrigerated units. So that the refrigeration contractor can monitor and fix things without driving over, these boxes are often connected to a network. Sometimes through a protected link, sometimes straight to the internet.

In a statement sent to AFP, the Danish group said “the majority of the affected units are older products (...) that have reached end of life and no longer receive software or security updates”. According to the manufacturer’s information reported by Points de vente, the units are obsolete AK-SM800 and AK-SC355 models, plus AK-SM800A units whose software had not been updated. Danfoss says it has “long” advised customers to migrate these systems to current-generation solutions. It announced the end of the AK-SM800 as early as May 2021.

There was no shortage of warnings. In May 2025 the US cybersecurity agency CISA flagged an authentication bypass flaw (CVE-2025-41450) in the AK-SM 8xxA range, fixed in version 4.2 of the software. A second flaw, allowing commands to be executed, followed in August 2025. As recently as September 18, Danfoss described a vulnerability that let “attackers obtain read and write access to internal values, upload and execute” programs. No source says yet which of these flaws was used on Monday, or whether any of them was.

Specialists have known about the underlying problem for years. In August, Claroty’s Team82 counted, using the Censys search engine, 2,765 AK-SM 800A controllers publicly reachable on the internet, which does not mean they were all vulnerable. On Monday Baptiste Robert, head of Predicta Lab, counted 2,752, of which 1,590 were in France, according to BleepingComputer. And in a technical note from October 2025, Danfoss itself reported that 16 Russian supermarkets equipped with AK-SM 800 units had been attacked in 2022, at the start of the war in Ukraine, along with 40 Israeli stores the same year.

« Normally, the things you expose are supposed to sit on a private network, in this case the store’s, and not necessarily directly on the internet. »

Kévin Tellier, cybersecurity expert at Synacktiv, to InformatiqueNews

Refrigeration, a cybersecurity blind spot

Specialists call this OT, or operational technology: everything that runs machines, as opposed to office IT. For a long time these controllers lived cut off from the world. “Historically, these systems were designed to prioritise reliability and cost control rather than protection against cyberattacks,” because “attackers could not reach them remotely”, Antoine Hautin, secretary general of the consultancy Almond, told AFP. Sensors and remote monitoring then connected them to networks, without their design keeping up.

Maintenance follows a different logic too. A till computer updates itself overnight; a refrigeration controller installed ten years ago often depends on a technician coming on site, sometimes with a USB stick, as Tellier points out. Who is responsible: the store, its contractor, the manufacturer? Often nobody has put it in the maintenance contract. The Synacktiv specialist sees it as “a problem on the side of the supermarket managers” and of those who install or maintain the fridges, more than a defect of a single brand.

The issue goes beyond food retail. Last week in Toulon, General André Petillot, deputy head of France’s gendarmerie, said cybersecurity had been “somewhat underestimated” in business and government. “Cybersecurity is still often seen as a cost centre,” he added. Monday gave him a costed example.

What about Africa?

No African store has been reported among the victims, and nothing suggests installations on the continent are being targeted. Yet the question is a matter of common sense. Supermarkets in Dakar or Abidjan, hotels, the cold rooms of fish wholesalers, the warehouses of pharmaceutical distributors where vaccines and insulin are stored: all of them depend on refrigeration run by controllers, from Danfoss or other makers. And much of this equipment is kept for a long time, well after support ends, because it works and replacing it is expensive.

The French pattern could easily repeat itself elsewhere: an installer who opens remote access to save time, a default password never changed, a box nobody has put on an inventory. Search engines such as Shodan or Censys, which index connected devices, do not stop at borders. Where power cuts already force operators to watch temperatures closely, an attack like this would add a risk few have built into their plans.

In France, the investigation now has to establish who carried out the attack and how they got in. Christophe Hansen, the EU commissioner for agriculture and food, has condemned it. Danfoss has not yet said how many of its customers still run the end-of-life models. That is probably the number refrigeration contractors are most waiting for, in France and elsewhere.