Security Advisory Cyberattack Reportedly Affects Refrigerated Displays in French Supermarkets

[Shadowra]

Content source

https://www.bbc.com/news/articles/crq5nzxv9q4yo

Hundreds of French supermarkets have been hit by a cyber attack that caused their fridges and freezers to heat up, spoiling fresh and frozen food estimated to be worth millions of euros.

Hackers reportedly gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight.

The chief executive of Coopérative U said several of its supermarkets had been hit by the "extremely serious and unprecedented" attack.

Almost 100 of the chain's stores were targeted, while between 150 and 200 Intermarché supermarkets were affected, according to the AFP news agency.

Intermarché said its fridges had heated up to 50C for six hours overnight into Monday, and the retailer had thrown away all the affected food to avoid health risks, the Reuters news agency reported.

Some supermarket staff reportedly said they were hit by waves of hot air when they opened freezer units on Monday morning.

French broadcaster BFMTV published an image showing a freezer in an ice cream aisle displaying a temperature of 26.5C.

Two supermarkets in the Alsace region reported losses of €270,000 (£228,000) between them, the broadcaster added, meaning the nationwide total could run into the millions.

Prosecutors in Paris confirmed the cyber attack and indicated it had prompted fire outbreaks, according to AFP.

The full scale of the attack is so far unclear.

Reports in specialist retail and local media said stores from other food giants, including Carrefour, E.Leclerc and Monoprix, were also attacked. BBC News has approached the supermarket chains for comment.

In a post on X, Coopérative chief executive Dominique Schelcher said staff were "fully mobilised, in co-ordination with refrigeration specialists, to restore the situation as quickly as possible".

He called for an investigation into the hack and said targeting equipment essential to the French food supply was "unacceptable".

Source : Fridges in French supermarkets hit by cyber attack

 

[Bot]

Source : Fridges in French supermarkets hit by cyber attack

Hi Shadowra — this is a particularly serious cyber-physical attack: the target was not merely supermarket data, but equipment capable of affecting food safety and reportedly starting fires.

BFMTV reports that older Danfoss refrigeration-control systems were targeted and that attackers abused the legitimate forced-defrost function, extending it for hours with a 50°C setting. That figure should be read carefully: it appears to be the programmed setting, not necessarily the measured temperature of every cabinet or food item. The BBC report cites one display at 26.5°C, which is already more than enough to ruin the cold chain.

There is an important evidence boundary here. Danfoss AK-SM 8xxA controllers have had serious published vulnerabilities: CISA lists an authentication bypass fixed in R4.2 and command-injection and denial-of-service flaws fixed in R4.3.1 in its 2025 advisory. However, no public evidence yet establishes that those particular CVEs were used in this incident. Other possibilities include exposed management interfaces, stolen service credentials or compromised remote-maintenance access. Affecting several unrelated chains suggests a common technology or access path, but does not by itself prove that Danfoss’s own infrastructure was breached.

The engineering lesson is uncomfortable: a remote account apparently had enough authority to turn a safety and maintenance function into a heater. Refrigeration operators should be checking:

• controller model and exact firmware—not merely whether it is vaguely “version 4”;
• Internet exposure and remote-service pathways;
• shared installer or maintenance credentials;
• unexpected accounts, setpoint changes and defrost schedules;
• independent temperature alarms and local limits on defrost duration;
• network separation between refrigeration controls, store IT and guest networks.

They should preserve logs and configurations before remediation, then restrict management to authenticated VPN or jump-host access and install the latest vendor-supported release.

Discarding the affected food was the correct response. Refreezing does not undo an unknown period at unsafe temperatures. The direct stock losses are bad enough, but the reported fire starts are what move this from expensive sabotage into potentially life-threatening territory.

Sources

• La température est montée jusqu'à 50 degrés: une cyberattaque contre les systèmes frigorifiques provoque la destruction de produits frais dans des centaines d'I
• Danfoss AK-SM 8xxA Series (Update A) | CISA