Cyberattack Disrupts Refrigeration at French Supermarkets
French Supermarkets Refrigeration Disruption Danfoss Controllers Cold-Chain Risk OT/IT Incident
Overview
Attackers reportedly manipulated refrigeration systems overnight on October 11-12, 2026 across multiple French supermarket chains, using compromised Danfoss refrigeration controllers to trigger automatic defrosting.
The temperature increase disrupted preservation of fresh and frozen products. French media reports cited approximately 250-350 affected stores, with resulting food waste and financial losses.
Intermarche and Cooperative U publicly confirmed refrigeration-related disruption, and the Paris prosecutor's office opened an investigation. The initial access path and responsible actor remain publicly unconfirmed.
Technical Details
Affected Systems and Organizations
The reported activity targeted refrigeration controllers running older Danfoss control software and abused built-in automatic defrost functionality.
Public reporting names Intermarche, Cooperative U, Carrefour Market, Monoprix, Leclerc, and Super U among affected chains. Intermarche statements also referenced precautionary actions involving Intermarche and Netto.
Intermarche additionally indicated the incident reportedly affected a service provider involved in in-store refrigeration management. This is investigative context and does not by itself confirm a supplier-compromise mechanism.
Initial Access and Vulnerability Status
The specific intrusion method has not been publicly confirmed. Reporting does not establish a definitive entry point such as:
- Confirmed exploited vulnerability
- Confirmed compromised account
- Confirmed remote-access service abuse
- Confirmed malware family
The article references prior Danfoss AK-SM 8xxA vulnerabilities:
- CVE-2025-41450 (authentication bypass; CISA warning in May 2025)
- CVE-2025-41451 (command injection; CISA warning in August 2025)
Prior research demonstrated remote code execution potential on publicly exposed Danfoss AK-SM 800A management interfaces, but those CVEs have not been confirmed as the mechanism in this incident.
Exact affected controller models, firmware versions, and incident-specific fixed versions were not disclosed in the cited report.
Internet Exposure Context
Reported exposure counts included:
- 2,752 internet-exposed Danfoss systems identified by one researcher source (1,590 in France)
- More than 4,500 internet-reachable Danfoss devices reported by Shodan tracking
These are exposure metrics from different sources and should not be interpreted as compromise counts.
Attribution and Investigation Status
No public attribution to a named threat actor or state has been confirmed in the reporting.
The Paris prosecutor's office is investigating victim scope and links to reported losses and fires; the existence of investigation activity does not establish causality for all reported downstream effects.
A separate Ahold Delhaize cybersecurity disclosure occurred the same day, but cited reporting explicitly states no evidence linking that event to this refrigeration incident.
Technical Specifications
| Attribute | Details |
|---|---|
| Incident Type | Remote manipulation of refrigeration-control functionality |
| Primary Technology Context | Danfoss refrigeration-controller environment (older software in reporting) |
| Observed Abuse Pattern | Unauthorized triggering of automatic defrost functions |
| Confirmed Public Victim Statements | Intermarche and Cooperative U confirmed refrigeration disruption |
| Attribution Status | No publicly confirmed actor attribution |
| Investigation Status | Paris prosecutor investigation reported as active |
Affected Products
- Refrigeration-control environments using relevant Danfoss management/controller systems.
- Retail food cold-chain operations dependent on centrally managed refrigeration/HVAC controls.
Attack Scenario
- Attacker gains access to refrigeration-control systems through a method not yet publicly disclosed.
- Unauthorized control actions trigger automatic defrosting.
- Refrigeration temperatures rise beyond expected preservation thresholds.
- Fresh/frozen displays are taken out of service and products are removed as precaution.
- Store operations and refrigeration specialists work to restore control and temperatures.
- Authorities investigate incident scope, victim impact, and possible links to related reports.
Impact Assessment
- Intermarche and Cooperative U confirmed refrigeration-system disruption
- Product-removal precautions were reported at affected locations
- French outlets reported an estimated 250-350 affected stores with food loss and financial impact
- Cold-chain integrity and product availability disruption
- Inventory loss and business interruption in food-retail operations
- Safety and compliance risk requiring product-quality validation before resumption
- Public reporting does not confirm consumer illness linked to this event
- No confirmed ransomware deployment was reported in this incident
- Fire-related investigative leads do not independently prove cyber-causation
Mitigation Strategies
- Identify refrigeration controllers and remote-management interfaces, then remove unnecessary direct internet exposure.
- Restrict required management access through approved, hardened access paths.
- Verify controller models/firmware against official Danfoss advisories, including CVE-2025-41450 and CVE-2025-41451 guidance.
- Compare live defrost schedules, setpoints, alarms, accounts, and remote-access settings against approved baselines.
- Preserve logs before resetting or reimaging equipment.
- Audit service-provider and maintenance access with named accounts, least privilege, and time-bound permissions.
- Maintain independent temperature monitoring and escalation paths outside controller-only visibility.
- Coordinate recovery with refrigeration engineers, food-safety teams, operations, and incident responders.
- Segment refrigeration controls from general business and guest networks.
- Maintain known-good configuration backups and rehearse manual response and product-relocation playbooks.
Resources and References
Public Reporting
Last Updated: October 13, 2026