At an Intermarche in central Paris, staff spent Monday morning hauling carts of defrosted frozen food to a container in the street, with melted ice cream sloshing from broken tubs onto the pavement. The store’s cold aisles had been set to 50 degrees Celsius, or 122 degrees Fahrenheit, overnight, and left that way for six hours.
The scene repeated across France. Between Sunday night and Monday morning, attackers took control of the software that regulates refrigeration and raised temperatures at hundreds of supermarkets, damaging fresh and frozen stock and in some stores causing fires.
Les Mousquetaires, the group that owns Intermarche, said fridges at around 150 of its stores were heated to 50 degrees for six hours overnight and that all affected food was thrown out to remove any health risk. Chief Executive Thierry Cotillard told BFM TV the losses would run to “tens of millions of euros nationwide in a single day.” He described the attack as rare.
Carrefour said 80 of its supermarkets were hit. Monoprix, which operates about 490 stores in France, said 5% of them were affected. Dominique Schelcher, chief executive of Cooperative U, confirmed his group was targeted and wrote on X that hitting “equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is rare.”
The Paris prosecutor’s office said a “large-scale” attack was affecting connected refrigerators at several major food retailers. Figures supplied by individual chains suggest roughly 400 stores out of about 15,000 nationwide were affected, a share small enough that most shoppers noticed nothing and large enough that the write-offs landed in earnings.
A person close to Prime Minister Sebastien Lecornu said the National Cybersecurity Agency, known as ANSSI, had been asked to investigate and had identified a vulnerability in software supplied by Danfoss, the Danish industrial group. Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems, and that the units involved “were running outdated firmware.” The company said it had long advised customers to update supported systems and migrate older ones.
The technical path was documented months ago. On Aug. 9, researchers at Claroty’s Team82 unit published an analysis of vulnerabilities in Danfoss’s AK-SM 800A controller, the panel that manages a store’s cold equipment. The flaws could allow an attacker to bypass authentication and run code on the device, and Danfoss issued updates to close them. The French incidents involved the older firmware, according to the person familiar with the investigation, which is the version that most stores and their maintenance contractors had in service.
The reach of the attack was European. Felix Aime, a senior cyber threat intelligence analyst at Sekoia, said Spain, Portugal, Poland, Germany and Belgium had also been affected. French authorities said they were coordinating with counterparts elsewhere in the bloc because other countries could be exposed to the same technique.
The design of a supermarket’s cold chain explains why one compromised panel matters so much. Store refrigeration is typically run by a single management system reachable over the internet so that maintenance contractors can adjust set points remotely, which saves labor and truck rolls. The same connection gives anyone who authenticates to the controller the ability to move a store’s temperature by 40 degrees across every cabinet at once, and to do it at an hour when no one is watching.
The financial mechanics are unforgiving. Fresh and frozen food is a low-margin business in which the margin depends on holding a narrow temperature band. A single overnight excursion turns inventory into waste, triggers disposal costs, and creates a food safety question that has to be answered before anything returns to the shelves. Supermarket chains carry insurance against spoilage, but claims take months to settle while the loss is booked in the quarter it occurred.
The second-order costs are already visible. The Federation of Commerce and Distribution, which represents French retailers, called on Danfoss for “full transparency” about the incident. Retail associations in Europe have begun asking whether refrigeration controllers should be treated as critical infrastructure, subject to the same patch deadlines and reporting duties as the systems that run power grids and water plants. Manufacturers have resisted that framing for years, citing the cost of maintaining decade-old equipment still in service.
For one retailer the disruption went further than temperature. Ahold Delhaize, which owns Albert Heijn in the Netherlands and four large chains in the United States, said it was dealing with a “security issue” on its network and had taken several systems offline as a precaution. Its app told customers it could not deliver groceries, affecting a channel that accounts for about 10% of Albert Heijn sales. Websites for Stop & Shop, Giant, Hannaford and Food Lion displayed notices reading “site temporarily down.” The company said it saw no reason to link its problem to the French incidents.
The pattern is familiar from August, when about a dozen U.S. military commissaries lost food after refrigeration systems were affected, an episode that drew little public attention at the time. That the same class of equipment sits in grocery stores, warehouses and hospital kitchens across Europe and North America suggests the target set is larger than the loss figure implies.
No one has claimed responsibility, and ANSSI has not published a timeline or a technical bulletin. Investigators have not said whether the attackers were motivated by money, disruption or something else, and Danfoss has not said how many customers are still running the affected firmware.
What the industry knows for certain is narrower and more useful. Remote maintenance access paid for itself for fifteen years, and it took one weekend for hundreds of stores to discover that the convenience came with a remote control attached. The question retailers now face is whether to keep that access and defend it, or to give up the tool that made the outage possible.
