Hackers remotely forced refrigerators and freezers at hundreds of French supermarkets to heat as high as 50°C overnight, spoiling food and reportedly causing fires. Reuters reports that about 150 Intermarché stores were hit for six hours, while Carrefour said 80 supermarkets were affected and Monoprix said 5% of its French stores were disrupted. France has ordered its national cybersecurity agency to investigate and is coordinating with European counterparts because other countries may also be affected.
A maintenance feature became the attack
The systems at issue are not ordinary display thermostats. A central controller can monitor and configure a store's refrigeration circuits, temperature limits, alarms and operating schedules. Internet access lets a maintenance company diagnose equipment without visiting every store. It also means a compromised control plane can turn one remote console into leverage over an entire cold aisle.
The attackers appear to have abused forced defrosting, a legitimate process that briefly warms equipment to remove accumulated ice. In the affected stores, that protective function was reportedly held on and its temperature set far beyond normal operation. Intermarché discarded food from affected units to eliminate health risks. The Paris prosecutor's office has opened an investigation into the large-scale attack and the reported food losses and fires.
AFP says Intermarché or Netto reported at least 300 targeted shops, Coopérative U reported more than 100, and E.Leclerc confirmed that an attack on a refrigeration-equipment supplier disrupted several stores. Those totals differ from earlier reporting and may describe targeted stores rather than equally severe damage at every location. There is not yet a definitive public count.
Old firmware is confirmed; the entry point is not
Danfoss said affected equipment included legacy AK-SM800 and AK-SC355 systems that no longer receive software or security updates, along with at least one AK-SM800 running outdated firmware. French authorities said they identified a vulnerability in Danfoss-supplied software. That establishes a serious exposure problem, but it does not yet establish the exact flaw, credential or service the attackers used.
The distinction matters because public vulnerability research is context, not attribution. In August, Claroty's Team82 documented an authentication bypass, command injection and configuration weakness in the AK-SM 800A platform. Danfoss released fixes, and Claroty advised customers to install current firmware, remove management interfaces from the public internet and restrict administration through trusted networks or secured VPN access. No source reviewed by TechInform has shown that this attack used those specific vulnerabilities.
TINA's view: cyber risk is now food safety
TINA's view: this incident should end the habit of treating connected building controls as low-stakes IT. Refrigeration controllers can destroy inventory, create fire risk and disrupt food availability without attackers ever touching a payment terminal or customer database. Organizations should inventory these devices as operational technology, isolate remote management, retire unsupported controllers and test whether staff can detect and override unsafe commands locally.
The strongest caution is that the event is still developing. Danfoss describes a limited number of affected management systems, while retailer counts run into the hundreds of locations; one vulnerable service provider or shared maintenance path could explain that gap. A broad claim that every internet-exposed Danfoss controller is compromised would outrun the evidence, as would linking the separate Ahold Delhaize disruption without proof.
TINA would narrow this judgment if investigators show that the attack depended on a unique third-party failure rather than weaknesses common to connected cold-chain operations. It would strengthen if the same technique appears in additional countries or supported devices. Watch for ANSSI's technical findings, Danfoss remediation guidance and a reconciled store count. The immediate lesson is already concrete: when remote convenience controls physical systems, patch status and network exposure can decide whether the freezer aisle stays frozen.
This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
