Hackers cranked French supermarkets’ freezers up to 50 degrees, causing hundreds of stores to lose their stock

Overnight from Sunday to Monday, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed . The attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires.

The method is simple and nasty. Refrigeration systems have a forced defrost function that clears ice buildup, and the attackers appear to have triggered it remotely in a continuous mode, with a temperature setting of 50 degrees. The equipment heated for several hours instead of keeping goods cold, and when staff opened the fridges and freezers in the morning, a sector source told BFM, “a wave of heat” came out.

“300 Intermarché and Netto stores, and fewer than 100 U stores, were affected on Monday, October 12, by a cyberattack targeting the refrigeration control systems of the Danish manufacturer Danfoss, according to the two retailers.” reports BFMTV. “Hackers reportedly remotely altered the temperatures of the systems, causing the destruction of stocks of fresh and frozen products.”

The scale is still being counted. The Mousquetaires group says 300 of its Intermarché and Netto stores were affected, Coopérative U says fewer than a hundred of its outlets, and E.Leclerc confirmed repercussions on cooling equipment in several stores without giving numbers. A specialist site reported that Carrefour Market and Monoprix stores were hit too, which those chains haven’t confirmed.

The money follows. A sector source told BFM national losses could reach several million euros, and Intermarché said its affected stores had to throw out all the fresh and frozen products concerned. In Haguenau, an Intermarché reportedly lost its entire frozen stock, an estimated 50,000 euros, and a Leclerc store about 30 kilometers away in Wasselonne reportedly discarded frozen and fresh goods worth around 220,000 euros.

Danfoss stated that it is aware of the incidents in France, noting that they affected a limited number of refrigeration management systems . The company explained that most of the impacted equipment was older hardware—specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates—while the AK-SM800A units involved were running outdated firmware . Danfoss emphasized that it has long advised customers to keep supported systems updated and is actively collaborating with those affected .

Following the attacks, the Paris prosecutor launched an independent investigation into the cyberattack targeting connected refrigerators across major French food retailers . The anti-cybercrime unit is leading the inquiry, with the OFAC office responsible for counting victims and connecting them to the resulting damages, which include spoiled food and fires .

This incident follows a concerning precedent. On August 9, Claroty’s Team82 released research detailing vulnerabilities in Danfoss refrigeration controllers. Upon examining the AK-SM 800A, one of the models targeted in this week’s attack, the researchers discovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols.

The full extent of the damage is still being calculated . The Mousquetaires group reported that 300 Intermarché and Netto stores were affected, while Coopérative U stated that fewer than 100 of its locations were hit . E.Leclerc also confirmed that cooling equipment in several stores was affected, though they did not provide specific figures . Meanwhile, a specialized news site reported that Carrefour Market and Monoprix stores were targeted as well, though these chains have not yet confirmed it .

The financial impact is heavy. Industry sources told BFM that national losses could reach several million euros, and Intermarché confirmed that all affected stores had to throw out their fresh and frozen inventory. For example, an Intermarché in Haguenau lost its entire frozen stock, estimated at 50,000 euros, while a Leclerc store about 30 kilometers away in Wasselonne had to discard around 220,000 euros worth of fresh and frozen goods.

The damage isn’t limited to the east. In the Loire-Atlantique, the huge Leclerc Atlantis in Saint-Herblain took all its frozen products off its Drive service indefinitely, and the Leclerc in Saint-Brevin-les-Pins wasn’t expected to reopen its fresh aisle normally before Tuesday, October 13. Several U stores were hit as well, some only in the frozen aisle, and an Intermarché in the same area too. One photo from BFM shows an ice cream shelf reading 26 degrees, which is a fine temperature for a beach.

Dominique Schelcher, the CEO of Coopérative U, said on X that attacking equipment essential to preserving fresh food and feeding French shoppers is extremely serious and unprecedented. His point is easy to see. Nobody was stealing data here, and the target was food.

The authorities moved quickly. According to the Prime Minister’s office, the national cybersecurity agency ANSSI has identified a vulnerability in software supplied by Danfoss and contacted the company. ANSSI is also talking to its European counterparts because other countries may be affected, and it’s trying to find other French companies hit.

Danfoss stated that it is aware of the incidents in France, noting that they affected a limited number of refrigeration management systems. The company explained that most of the impacted equipment was older hardware, specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates, while the AK-SM800A units involved were running outdated firmware. Danfoss emphasized that it has long advised customers to keep supported systems updated and is actively collaborating with those affected.

Because these controllers are typically managed remotely and feature a built-in web server, an attacker who gains access can send direct commands to the connected cooling systems—such as forcing a manual defrost. Claroty’s research highlights that the product is widely deployed across supermarkets, cold-storage facilities, and logistics warehouses, with a Censys scan revealing 2,765 exposed management interfaces online. Claroty disclosed these vulnerabilities to Danfoss, which subsequently patched them in firmware version R4.3.1.

However, BFM notes that authorities have not officially confirmed whether hackers exploited this specific flaw in the recent attack . If it was the entry point, standard security disclosure practices were followed, as details were withheld until a patch was made available . For legacy, end-of-life units, no security patches exist, leaving disconnecting them from the public internet as the only viable defense .

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

( SecurityAffairs – hacking, French supermarkets)