Cyberattack on French supermarket refrigeration systems sparks fires, spoils food at hundreds of stores

TLDR

• Hackers remotely triggered defrosting in refrigeration controllers at an estimated 250 to 350 French supermarkets overnight, spoiling food.¹²
• Internet-exposed industrial controllers can turn a routine scan into a physical incident, with 1,590 Danfoss systems reachable online in France.³
• Paris prosecutors opened an investigation, and no link is confirmed to Ahold Delhaize's separate incident disclosed the same day.³

Hackers compromised refrigeration control software made by Danfoss at hundreds of French supermarkets overnight on 11 to 12 October, remotely activating the units' built-in automatic defrosting systems to drive internal temperatures up to around 50°C.¹² The resulting heat spoiled fresh and frozen stock across the affected stores and, according to French media cited by BleepingComputer, caused fires at some locations.³

Security researcher Baptiste Robert said he had identified 2,752 Danfoss refrigeration systems exposed directly to the internet worldwide, including 1,590 in France alone, suggesting the attackers may have simply scanned for and exploited unsecured controllers rather than targeting any single retailer.³ BBC News and Reuters reported that affected chains included Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc and Super U, with estimates ranging from 250 to 350 stores hit.¹² CISA had previously disclosed an authentication bypass (CVE-2025-41450) and a command injection flaw (CVE-2025-41451) in Danfoss's AK-SM 8xxA controller line, though it is not yet confirmed whether either was used in this attack.³

The Paris prosecutor's office has opened an investigation into what it has called a large-scale cyberattack against the refrigeration systems of several major food retail chains.³ The incident broke the same day Ahold Delhaize, which operates grocery brands across Europe and the US, separately disclosed taking some of its own systems offline after a cybersecurity incident; both BBC News and BleepingComputer stressed there is no evidence yet connecting the two.¹³

Why it matters: a scan for unsecured industrial controllers, not a targeted breach of any one retailer, was reportedly enough to spoil food and start fires across hundreds of stores at once, underlining how exposed operational technology can turn a routine internet-wide sweep into a physical-world incident.