French supermarket chain Intermarché was among several retailers in France hit by a cyberattack that manipulated connected refrigeration systems, raising temperatures in refrigerators and freezers to as high as 50 degrees Celsius (122 degrees Fahrenheit) and causing fires and food spoilage. Les Mousquetaires, Intermarché’s parent group, said about 150 stores were affected, with refrigeration units heated for six hours overnight. Carrefour reported attacks affecting 80 supermarkets, while Monoprix said 5% of its approximately 490 French stores were impacted.
France’s National Cybersecurity Agency (ANSSI) has been instructed to investigate, as authorities assess the potential for wider exposure. The attack highlights the cyber-physical risks facing retail operational technology (OT), as compromised refrigeration controls can disrupt food preservation and supply-chain operations without necessarily affecting point-of-sale systems.
Back in August, Claroty’s Team82 published research uncovering vulnerabilities on the Danfoss AK-SM 800A, a centralized system manager used to coordinate refrigeration controllers in supermarkets, cold-storage facilities, warehouses, and other commercial environments. The platform gives operators a web-based interface to monitor circuits, set temperature thresholds, review alarms, and manage users, and technicians often use it for remote maintenance. Team82 found numerous management interfaces reachable from the public internet, with a Censys scan showing 2,765 exposed devices.
After reverse engineering the firmware, the researchers identified multiple vulnerabilities in the embedded web interface. They include a hidden “code-of-the-day” authentication mechanism (CVE-2025-41450) that could let an attacker bypass normal login, a command-injection flaw (CVE-2025-41451) leading to remote code execution, and an Nginx configuration injection issue (CVE-2025-41452) that can trigger denial of service. Team82 disclosed the flaws to Danfoss, which released firmware R4.3.1 to address them, and urged customers to upgrade and keep management interfaces off the internet.
“According to our research, for threat actors seeking to disrupt critical operations, refrigeration controllers are a prime target that often go overlooked by security teams,” Amir Preminger, CTO of Claroty, wrote in an emailed statement on Monday. “The compromise of refrigeration infrastructure can have severe operational consequences for many different types of organizations – supermarkets, cold-storage facilities, warehouses, pharmaceuticals, chemical manufacturing, and more. In fact, even nation-state actors have targeted refrigeration controllers to wreak havoc on geopolitical adversaries.”
He noted that the cyber attack on Coopérative U should raise the alarm for any company that is responsible for handling temperature-sensitive products.
“Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks; however, our research found many of these devices are directly exposed to the public internet,” according to Preminger. “While this convenience significantly reduces maintenance costs by allowing engineers to troubleshoot issues remotely, it also lowers the barrier to entry for attackers. Organizations must take proactive measures to ensure that management interfaces are not insecurely connected to the internet, and ensure that access to administrative services is restricted to trusted management networks or secured through VPNs and other appropriate network segmentation controls.”
A Shieldworkz analysis identified disruption of refrigeration systems at multiple French supermarket chains on the night of Oct. 11-12, highlighting the risks of connected OT, as affected units reportedly reached temperatures of up to 50 degrees Celsius (122 degrees Fahrenheit), resulting in food spoilage and reported fires. Intermarché’s parent group reported impacts at about 150 stores, while other reporting cited disruptions at more than 100 Coopérative U outlets and additional retail chains.
“The available reporting identifies Danfoss refrigeration-management equipment as a significant technical lead. Danfoss stated that affected systems were running outdated firmware,” Prayukth K V wrote in the Shieldworkz post. “This is relevant in light of Claroty Team82’s August 2026 research into vulnerabilities affecting the Danfoss AK-SM 800A platform, including an authentication-bypass vulnerability. However, the public evidence reviewed for this report does not establish that a particular CVE was exploited during the incident, which access path was used, or whether all affected retailers shared the same technical exposure.”
He added that the incident demonstrates a credible cyber-physical risk to commercial cold-chain operations: unauthorised control of refrigeration functions can produce material losses without requiring the attacker to compromise point-of-sale systems or deploy conventional file-encrypting ransomware. It does not yet establish that the attackers compromised a single central cloud platform, defeated independent physical safety devices, or used a common multi-tenant service to reach every affected store.
Prayukth noted that, in the larger context of attacks on water utilities and power companies, hackers appear to be pursuing a wider motive: disruption across multiple citizen touchpoints. He said the attack also reflects a degree of escalation in that context.
He observed that the hacker has not come forward, but the incident may have been a demonstration of the group’s capabilities. The attackers knew many operational aspects of the target and used that knowledge effectively. Instead of going after the upstream supply chain, the attack targeted the downstream part.
Prayukth added that legacy systems remain a challenge and need urgent security attention.
The cyberattack affecting Danfoss’ refrigeration control systems highlights the growing cyber-physical risks associated with operational technology (OT),” Rafe Pilling, senior director of threat intelligence at Sophos, wrote in an emailed statement. “Much of the world’s critical infrastructure, including systems that support food safety and supply chains, relies on OT. While the investigation is ongoing and many details remain unclear, organisations can still learn valuable lessons from the incident. At this stage, it’s important to avoid speculation and focus on the facts as they emerge.”
Pilling added, “Approximately one-third of ransomware intrusions in retail and manufacturing environments begin with the exploitation of known vulnerabilities. In the immediate aftermath of incidents such as this, organisations should prioritise identifying exposed and vulnerable systems, validating patch levels, and assessing whether compensating controls are in place.”
“What happened in France reminds us that in industrial environments, the most damaging commands are often legitimate,” Joshua Steinman, CEO and co-founder of Galvanick, wrote in a statement. “Defrost isn’t an exploit; it’s functionality, and there is no attack signature for a feature doing what it was designed to do. Defenders need evidence to answer quickly and confidently: who reached a controller, what they changed, and whether that change belonged there. Operators who can do that will respond far more successfully.”
