Security Advisory Cyberattack Reportedly Affects Refrigerated Displays in French Supermarkets

[Shadowra]

Content source

https://www.bbc.com/news/articles/crq5nzxv9q4yo

Hundreds of French supermarkets have been hit by a cyber attack that caused their fridges and freezers to heat up, spoiling fresh and frozen food estimated to be worth millions of euros.

Hackers reportedly gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight.

The chief executive of Coopérative U said several of its supermarkets had been hit by the "extremely serious and unprecedented" attack.

Almost 100 of the chain's stores were targeted, while between 150 and 200 Intermarché supermarkets were affected, according to the AFP news agency.

Intermarché said its fridges had heated up to 50C for six hours overnight into Monday, and the retailer had thrown away all the affected food to avoid health risks, the Reuters news agency reported.

Some supermarket staff reportedly said they were hit by waves of hot air when they opened freezer units on Monday morning.

French broadcaster BFMTV published an image showing a freezer in an ice cream aisle displaying a temperature of 26.5C.

Two supermarkets in the Alsace region reported losses of €270,000 (£228,000) between them, the broadcaster added, meaning the nationwide total could run into the millions.

Prosecutors in Paris confirmed the cyber attack and indicated it had prompted fire outbreaks, according to AFP.

The full scale of the attack is so far unclear.

Reports in specialist retail and local media said stores from other food giants, including Carrefour, E.Leclerc and Monoprix, were also attacked. BBC News has approached the supermarket chains for comment.

In a post on X, Coopérative chief executive Dominique Schelcher said staff were "fully mobilised, in co-ordination with refrigeration specialists, to restore the situation as quickly as possible".

He called for an investigation into the hack and said targeting equipment essential to the French food supply was "unacceptable".

Source : Fridges in French supermarkets hit by cyber attack

 

[Bot]

Source : Fridges in French supermarkets hit by cyber attack

Hi Shadowra — this is a particularly serious cyber-physical attack: the target was not merely supermarket data, but equipment capable of affecting food safety and reportedly starting fires.

BFMTV reports that older Danfoss refrigeration-control systems were targeted and that attackers abused the legitimate forced-defrost function, extending it for hours with a 50°C setting. That figure should be read carefully: it appears to be the programmed setting, not necessarily the measured temperature of every cabinet or food item. The BBC report cites one display at 26.5°C, which is already more than enough to ruin the cold chain.

There is an important evidence boundary here. Danfoss AK-SM 8xxA controllers have had serious published vulnerabilities: CISA lists an authentication bypass fixed in R4.2 and command-injection and denial-of-service flaws fixed in R4.3.1 in its 2025 advisory. However, no public evidence yet establishes that those particular CVEs were used in this incident. Other possibilities include exposed management interfaces, stolen service credentials or compromised remote-maintenance access. Affecting several unrelated chains suggests a common technology or access path, but does not by itself prove that Danfoss’s own infrastructure was breached.

The engineering lesson is uncomfortable: a remote account apparently had enough authority to turn a safety and maintenance function into a heater. Refrigeration operators should be checking:

• controller model and exact firmware—not merely whether it is vaguely “version 4”;
• Internet exposure and remote-service pathways;
• shared installer or maintenance credentials;
• unexpected accounts, setpoint changes and defrost schedules;
• independent temperature alarms and local limits on defrost duration;
• network separation between refrigeration controls, store IT and guest networks.

They should preserve logs and configurations before remediation, then restrict management to authenticated VPN or jump-host access and install the latest vendor-supported release.

Discarding the affected food was the correct response. Refreezing does not undo an unknown period at unsafe temperatures. The direct stock losses are bad enough, but the reported fire starts are what move this from expensive sabotage into potentially life-threatening territory.

Sources

• La température est montée jusqu'à 50 degrés: une cyberattaque contre les systèmes frigorifiques provoque la destruction de produits frais dans des centaines d'I
• Danfoss AK-SM 8xxA Series (Update A) | CISA

 

[Brownie2019]

Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers.

Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, with French outlets reporting that the attack affected between 250 and 350 stores, causing significant financial losses and food waste.

The threat actors hijacked refrigeration controllers running older versions of Danfoss control software on Sunday night and used them to raise supermarket refrigerator temperatures by triggering a built-in automatic defrosting system.

Coopérative U president Dominique Schelcher confirmed the incident earlier today and said that the attack affected multiple stores in the chain.

"I can confirm that, since last night, a cyberattack has been affecting the refrigeration systems in several stores within our @CooperativeU network. Our teams are fully mobilized, working alongside refrigeration specialists, to resolve the situation as quickly as possible. An investigation will be conducted to shed full light on this attack," Schelcher said.

"Targeting equipment essential for preserving fresh produce and supplying food to the French people is an extremely serious matter and is unprecedented. It is unacceptable."
EU agriculture and food commissioner Christophe Hansen also condemned the attack and named France's largest supermarket chain, Leclerc, as one of the victims.

The Paris prosecutor's office has told AFP that it has opened an investigation into "the large-scale cyberattack affecting the refrigerators of several major food retail chains across France" to "identify the victims and establish the link with the damage they reported in terms of foodstuff losses and the outbreak of fires."

While no information is available on how the attackers were able to compromise the Danfoss refrigeration controllers, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned in May 2025 of a high-severity authentication bypass vulnerability (CVE-2025-41450) in the Danfoss AK-SM 8xxA Series hardware platform used to manage refrigeration and HVAC systems typically found in the food retail sector.

Although there is no evidence yet that the two are connected, retail giant Ahold Delhaize, one of the world's largest food retail chains, also announced on Monday that it had to take some systems offline after a "cybersecurity incident."

Cyberattack shuts down refrigerators at French supermarkets

Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers.

www.bleepingcomputer.com

 

[Bot]

Hi Brownie2019, this is a particularly clear example of an OT incident producing immediate physical and financial consequences. The attackers apparently did not need to damage the refrigeration machinery: abusing its legitimate forced-defrost function was enough to break the cold chain and make stock unsafe to sell.

A few details are worth separating:

• AFP reports 150–200 affected Intermarché stores and almost 100 Coopérative U stores. Some additional chains have been reported, but not all have independently confirmed their involvement.
• Danfoss told BFMTV that most affected devices were end-of-life AK-SM800 and AK-SC355 systems, while affected supported AK-SM800A units were running outdated firmware.
• The possible connection to CVE-2025-41450 remains unconfirmed. That vulnerability affects AK-SM 8xxA versions before R4.2 and can permit authentication bypass. The same CISA advisory also covers later command-injection issues fixed in 4.3.1.
• The reported fires are under investigation. The prosecutor is trying to establish their connection to the attack; that connection should not yet be treated as proven.
• There is presently no evidence connecting this with the Ahold Delhaize incident. Similar timing is a reason to investigate, not attribution.

For refrigeration operators, the lesson is not merely “install antivirus.” These controllers should not be directly reachable from the Internet. Supported units need current firmware; obsolete AK-SM800/AK-SC355 installations need replacement planning rather than wishful thinking. Remote administration should sit behind properly secured, patched access infrastructure, with the control network segmented from ordinary business systems. Alerts for unusual set-point changes, forced-defrost commands and loss of cooling would also shorten the time before staff can intervene locally.

One vulnerable or badly exposed controller model deployed across several unrelated chains creates a shared point of failure. The supermarket names differ; the technical blast radius does not.

Sources

• Au moins 300 supermarchés touchés, un système danois visé... Ce que l'on sait des cyberattaques qui ont frappé les systèmes frigorifiques des supermarchés
• Danfoss AK-SM 8xxA Series (Update A) | CISA

 

[LinuxFan58]

Don´t know if this was posted, but today also a Dutch supermarket retailer was attacked

"Cybersecurity incident:" Hack may be behind outage at Albert Heijn

The outage that has been affecting Albert Heijn and several other Ahold Delhaize subsidiaries since Sunday evening may have been a hack. Early this morning, the supermarket chain reported that it was offline due to an “IT incident.” Now Albert Heijn is speaking of a “cybersecurity incident.”

nltimes.nl