Hundreds of French supermarkets woke up to a nightmare on Monday morning: hackers had remotely hijacked their refrigeration systems overnight, cranking temperatures from sub-zero to as high as 50°C and forcing the destruction of entire fresh and frozen food sections. The attack, which French authorities are calling “unprecedented,” represents one of the most striking real-world examples of what operational technology (OT) compromise looks like when it escapes the conference stage and hits critical infrastructure people interact with every day.
What Happened
Sometime on Sunday evening, October 11, attackers began remotely accessing Danfoss AK-SM 800A refrigeration controllers installed across a wide swath of French grocery retailers. By triggering the built-in automatic defrost cycle and pushing temperature setpoints to extreme levels, the attackers effectively “cooked” cold storage units while stores were closed for the night. In at least one documented case, a freezer set at -20°C climbed to +30°C before staff arrived Monday morning.
Coopérative U president Dominique Schelcher confirmed the incident on X, calling it “an extremely serious matter” and “unprecedented.” By midday Monday, the Paris prosecutor’s office had opened a criminal investigation into what it described as a “large-scale cyberattack” targeting the cold rooms of several major French food retail chains. The probe is also examining reports of fire alarms being triggered — likely by the rapid temperature changes — alongside the massive food losses.
Who Was Hit
French media outlets and retailer statements indicate between 250 and 350 stores were affected. The confirmed and reported victims include Intermarché (an estimated 150 to 200 stores), Coopérative U’s Super U chain (nearly 100 outlets), E.Leclerc (France’s largest supermarket chain by market share), Carrefour Market, Monoprix, Metro stores, and a number of independent businesses including butcher shops. In the Alsatian town of Haguenau alone, an Intermarché, a Super U, and an E.Leclerc were all simultaneously struck.
The financial toll is already significant. The two stores in Haguenau (Intermarché and Super U) reported combined losses of €270,000. The Groupement Mousquetaires, which operates the Intermarché network, estimates total losses across its affected locations at “several million euros.” Intermarché has also warned that standard insurance policies may not cover this type of incident — a sobering detail for the broader retail sector.
The Technical Backstory
The attack did not emerge from a vacuum. At DEF CON 34 in August 2026, researchers from Claroty’s Team82 presented findings on serious vulnerabilities in Danfoss refrigeration controllers — the very hardware targeted in Sunday night’s attack. Their research uncovered a hidden “code-of-the-day” authentication mechanism that could be abused to bypass login protections, along with a command-injection flaw enabling remote code execution. Most alarmingly, Claroty demonstrated that a compromised controller could disable cooling while simultaneously falsifying the temperature readings displayed to operators, effectively hiding the attack in progress.
Claroty also found thousands of these management interfaces publicly accessible on the internet. Danfoss responded by patching three vulnerabilities in firmware version R4.3.1 and advising all operators to upgrade. But according to BFMTV’s reporting, the stores hit on Sunday night were running Danfoss control software older than version 4 — meaning the patches released months earlier had never been applied.
It is worth noting that CISA had flagged a related high-severity authentication bypass vulnerability (CVE-2025-41450) in the AK-SM 8xxA Series back in May 2025, more than a year before this attack. The warning chain — from CISA advisory to DEF CON presentation to vendor patch — was in place. The stores simply were not updated in time.
Why This Attack Matters
Cyberattacks on operational technology are nothing new in security circles. Stuxnet, the Colonial Pipeline ransomware, and the Oldsmar water treatment incident all demonstrated that digital intrusions can have physical consequences. But this attack hits different in an important way: it targeted everyday consumer infrastructure at massive scale, and the damage was immediate, tangible, and impossible to reverse. You cannot “restore from backup” food that has spoiled.
The attack also appears to be purely destructive. As of Monday afternoon, no ransomware note or extortion demand had surfaced, and no threat group had claimed responsibility. If the motive was not financial, that raises uncomfortable questions about whether this was a test run, a politically motivated act, or something else entirely. French president Emmanuel Macron had ordered measures just last month to protect critical infrastructure against Russian “hybrid attacks,” and EU agriculture and food commissioner Christophe Hansen publicly condemned the incident — though no official attribution has been made.
The retail OT blind spot is perhaps the most important takeaway. Hospitals, power grids, and water systems receive significant cybersecurity attention because they are classified as critical infrastructure. Supermarket refrigeration rarely makes that list, yet the cold chain is a foundational piece of food safety and supply logistics. As Claroty’s research showed, the gap between vulnerability disclosure and actual patching in this sector can be measured in months or years, not days.
What to Watch Next
The Paris prosecutor’s investigation will be the primary thread to follow for attribution and motive. Danfoss has not issued a public statement on the attack at the time of writing, and its response — including whether it will push emergency firmware updates or take more aggressive steps to reach unpatched installations — will matter. Insurers are watching closely too: if policies do not cover OT-targeted cyberattacks on retail infrastructure, the industry may need to rethink its risk models.
For any organization running internet-exposed industrial control systems — whether in retail, logistics, healthcare, or elsewhere — the practical advice is blunt and immediate. Audit your OT asset inventory. Confirm that firmware on every controller is current. Remove management interfaces from the public internet or place them behind VPN and multi-factor authentication. And treat vulnerability advisories from CISA and vendors with the same urgency you would a zero-day on your firewall, because as hundreds of French supermarkets just learned, the consequences of ignoring them are not theoretical.
Leave a Reply