French Supermarket Refrigerators Defrosted in Cyberattack Targeting Danfoss Controllers
Attackers remotely triggered automatic defrost cycles in hundreds of French stores, affecting major chains and causing significant food waste and financial losses.
Key points
- Overnight cyberattack targeted Danfoss refrigeration controllers at multiple French supermarket chains.
- Between 250 and 350 stores reported issues, including Intermarché, Carrefour Market, and Leclerc.
- Paris prosecutor’s office opened investigation into food losses and reported fire outbreaks.
Attackers remotely triggered automatic defrost cycles in refrigerators across hundreds of French supermarkets overnight on Sunday. The cyberattack targeted Danfoss refrigeration controllers, raising temperatures in cold storage units and disrupting operations for several major retail chains.
French media outlets reported that the incident affected between 250 and 350 stores. Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U. The disruption caused significant financial losses and substantial food waste due to the loss of cold chain integrity.
Context and Background
The threat actors compromised refrigeration controllers running older versions of Danfoss control software. By exploiting these systems, attackers manipulated built-in automatic defrosting functions to raise refrigerator temperatures. This method effectively shut down cooling capabilities without destroying hardware, allowing for remote disruption of perishable goods storage.
While no direct evidence links this specific incident to known vulnerabilities, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned in May 2025 of a high-severity authentication bypass vulnerability, CVE-2025-41450. This flaw affects the Danfoss AK-SM 8xxA Series hardware platform, which manages refrigeration and HVAC systems commonly found in food retail environments.
Who Is Affected
Coopérative U president Dominique Schelcher confirmed the incident earlier today, stating that multiple stores within the network were impacted. He noted that teams are working with refrigeration specialists to resolve the situation and that a full investigation will determine the scope of the attack. Schelcher described targeting essential food preservation equipment as unprecedented and unacceptable.
EU agriculture and food commissioner Christophe Hansen condemned the attack, naming Leclerc, France’s largest supermarket chain, as a victim. The Paris prosecutor’s office told AFP it has opened an investigation into the large-scale cyberattack. Authorities aim to identify victims and establish links between the cyber intrusion and reported foodstuff losses and fire outbreaks.
Retail giant Ahold Delhaize also announced on Monday that it took some systems offline following a cybersecurity incident. However, there is no evidence connecting this separate event to the French supermarket attacks.
What should you do?
Organizations using industrial control systems should immediately audit their refrigeration and HVAC hardware for outdated software versions. Security teams should verify that all Danfoss controllers are not exposed to known authentication bypass vulnerabilities. Network segmentation should be reviewed to ensure critical infrastructure cannot be accessed from corporate IT networks.
What to do and how to stay safe: Danfoss
- Inventory all Danfoss AK-SM 8xxA Series hardware and check for CVE-2025-41450 exposure.
- Implement network segmentation to isolate refrigeration controllers from general corporate networks.
- Monitor system logs for unauthorized triggers of automatic defrost or temperature changes.
- Verify that firmware updates are applied once vendors release patches for identified vulnerabilities.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which French supermarket chains were affected by the cyberattack?
Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U were all reported as victims.
Was CVE-2025-41450 confirmed as the cause of this attack?
No, there is no evidence yet connecting this incident to the CISA-warned vulnerability, though both involve Danfoss systems.
How many stores were impacted by the refrigeration failure?
French outlets reported that between 250 and 350 stores were affected by the overnight cyberattack.
