Cyberattack Remotely Defrosts Refrigerators at Hundreds of French Supermarkets
A cyberattack reportedly targeting Danfoss refrigeration controllers remotely defrosted refrigerators at several French supermarket chains overnight, causing food waste and significant economic losses.
The incident affected an estimated 250 to 350 stores, including outlets operated by Intermarché, Cooperative U, Carrefour Market, Monoprix, Leclerc, and Super U, according to a report.
Attack increased supermarket refrigerator temperatures
On Sunday night, the attackers reportedly took control of refrigeration controllers running an outdated version of Danfoss control software. They activated the equipment’s built-in automatic defrost function and increased the temperature of supermarket refrigerators.
The incident disrupted systems responsible for maintaining the cold chain used to preserve fresh food.
Cooperative U confirms the cyberattack
Cooperative U president Dominique Scherscher confirmed the incident and said the attack affected multiple stores within the chain.
“Since last night, we have confirmed that a cyberattack has affected the refrigeration systems of several stores within our @CooperativeU network. Our teams are fully mobilized, working with our refrigeration experts to resolve the situation as quickly as possible. An investigation will be conducted to fully understand this attack,” Schelcher said.
“The targeting of equipment essential to preserving fresh food and feeding the French population is extremely serious, unprecedented and unacceptable.”
French investigation launched
EU Agriculture and Food Commissioner Christoph Hansen also condemned the attack in a statement, naming Leclerc, France’s largest supermarket chain, as one of the victims.
The Paris public prosecutor’s office said it had launched an investigation into “a major cyberattack that affected refrigerators in several major food retail chains across France.” The investigation aims to “identify the victims and establish a link to the food losses and fires reported by the victims,” according to AFP.
How were the Danfoss refrigeration systems compromised?
There is currently no information on how the attackers gained access to Danfoss’ refrigeration control equipment. However, the U.S. Cybersecurity and Infrastructure Security Agency issued a May 2025 warning about a high-severity authentication-bypass vulnerability, CVE-2025-41450.
The Danfoss AK-SM 8xxA hardware platform is used to manage refrigeration and HVAC systems commonly found in the food retail sector. There is no evidence that the vulnerability was used in this attack.
Ahold Delhaize reports separate cybersecurity incident
Retail giant Ahold Delhaize, one of the world’s largest food retail chains, also announced on Monday that it had taken some systems offline following a “cybersecurity incident.” There is no evidence that the Ahold Delhaize incident is connected to the attacks affecting French supermarket refrigeration systems.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com