Cyberattacks on supermarket refrigeration systems reportedly pushed temperatures as high as 50°C (122°F), affecting hundreds of stores in France and forcing retailers to discard food.
Major supermarkets such as Carrefour, Coopérative U, Intermarché, Monoprix, and more were hit by the attacks, which spoiled perishable food and left stores without fresh produce.
The affected equipment includes cold-storage units used to hold food before it reaches supermarket shelves. The criminals behind the attack raised temperatures to unsafe levels, spoiling food and in some cases starting fires.
Some affected retailers used refrigeration controllers produced by Danish company Danfoss.
Authorities have not identified the entry point or confirmed exploitation of the vulnerabilities previously disclosed by Claroty and patched in August 2025, although the manufacturer said affected stores were running outdated firmware.
Experts say the previously identified vulnerabilities were easily scriptable and relied on a unique but predictable authentication method.
Claroty found a hidden authentication mechanism in the AK-SM 800A platform that accepted a code generated from the device's current date, bypassing the configured administrator password.
Anyone who reproduced the algorithm could generate a valid daily code and gain administrative access.
"It's a zero-skill thing to pull off, I wrote the bash script while having a shit," said security pro Kevin Beaumont.
The research demonstrated how compromised controllers could expose refrigeration systems to physical disruption, although the vulnerabilities' role in this week's attacks remains unconfirmed.
Danfoss told reporters this week that the French supermarkets affected by the attacks "were running outdated firmware" and that the company has consistently advocated for keeping systems updated.
asked Danfoss if it would confirm whether the previously disclosed bugs were exploited to execute the attacks, and whether the same bug was also abused in August to compromise US military commissary refrigerators, which led to food losses.
CERT-FR published an alert reporting numerous compromises of Danfoss AK-SM and AK-SC controllers, which were not mentioned in Claroty's original reporting nor in Danfoss's advisories at the time.
The authority advised disconnecting or restricting network access. For suspected compromises, it recommended a factory reset, security patches, credential rotation, account checks, and full reconfiguration.
For those wondering why fridges even need to be reachable via the internet, the main reason is that it allows central engineering teams to troubleshoot issues remotely, according to Claroty's researchers.
"Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks. However, our research found many of these devices are directly exposed to the public internet," said Amir Preminger, CTO at Claroty. "While this convenience significantly reduces maintenance costs by allowing engineers to troubleshoot issues remotely, it also lowers the barrier to entry for attackers.
"Organizations must take proactive measures to ensure that management interfaces are not insecurely connected to the internet, and ensure that access to administrative services is restricted to trusted management networks or secured through VPNs and other appropriate network segmentation controls."
Intermarché owner Groupement Les Mousquetaires said around 150 of its supermarkets were affected by the attacks, while Carrefour confirmed around 80 impacted stores.
Monoprix said roughly 5 percent of its 490 stores were experiencing the same issues, and Coopérative U CEO Dominique Schelcher said 80 of the company’s 2,000 stores were hit, adding that the attack on the food sector was “unacceptable.”
“Targeting equipment essential to the preservation of fresh products is an attack on the French food supply chain,” he said. “It is unprecedented, extremely serious, and unacceptable. We remain fully mobilized.”
However, in a separate twist, Schelcher told French radio station RTL on Tuesday that Coopérative U is not a customer of Danfoss.
contacted Coopérative U for more information about what caused the attacks at its stores.
Shodan searches for internet-facing Danfoss controller interfaces indicated that more than 4,500 endpoints were exposed as of Monday, with more than half of those located in France.
Ahold Delhaize, a major grocery retailer in the Netherlands, announced on the same day that it was experiencing a "security issue." No link to the refrigeration attacks in France has been established.
The end result is similar, however, as the company's grocery brands are reporting stock issues.
Several of the group's brands have taken their websites offline and posted notices about the "cybersecurity incident."
Stores remain open, but affected brands have reported disruption to websites, apps, customer services, and online deliveries.
The disruption hit the company's distribution systems, although these are now being restored.
Updates posted to social media on Tuesday told shoppers that staff were once again able to use digital shelf labels but stock levels may vary across stores, and long-life items were likely to be more abundant than fresh fruit and vegetables.
The retailer previously suffered a cyberattack in November 2024 that disrupted its US operations. ®