Hackers defrosted hundreds of French supermarket fridges overnight

Key points

• Between 250 and 350 French supermarkets had their refrigerators remotely defrosted overnight on Sunday, with the Paris prosecutor's office now investigating food losses and store fires.
• The attack hit Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc and Super U, and targeted Danfoss refrigeration controllers running older software.
• A high-severity authentication flaw in the Danfoss AK-SM 8xxA Series, CVE-2025-41450, was disclosed in May 2025 and fixed in version 4.2.
• CISA listed the Danfoss flaw in its May 2025 vulnerability bulletin with a CVSS score of 8.2, meaning it is rated high risk.
• No group has claimed responsibility, and investigators haven't formally linked the intrusion to CVE-2025-41450.

Someone spent Sunday night turning the fridges on. Not off. At between 250 and 350 supermarkets across France, attackers reached into the small industrial computers that run refrigerated aisles and told them to start a defrost cycle. By morning, chilled meat was warm and ice cream was soup.

The victims cover most of French grocery shopping: Intermarché, Coopérative U, Carrefour Market, Monoprix and Leclerc among them. Coopérative U president Dominique Schelcher confirmed the attack on his network and called it unacceptable. The Paris prosecutor's office has opened a formal investigation, citing both the spoiled food and, strikingly, several store fires.

How did the hackers get in?

Investigators haven't said yet. What we know, from reporting by BleepingComputer, is that the targeted equipment was Danfoss refrigeration controllers running older software. That points at a flaw CISA warned about five months before the attack.

The bug is CVE-2025-41450, an authentication bypass in the Danfoss AK-SM 8xxA Series. Authentication is the step where a system checks you are who you say you are; in vulnerable versions of this controller, that check could be skipped entirely, letting someone issue commands without a valid login. Danfoss fixed it in version 4.2, and the advisory went out in May 2025. We've covered 40 ICS stories since June, including an FBI and CISA warning on 24 September urging operators to lock down outside engineers who access their control systems, a pattern that fits here.

Triggering a defrost cycle isn't an exotic hack once you're inside. It's a normal maintenance function the controller already offers. The attackers didn't need to invent anything; they just needed the keys.

What does this mean for shoppers?

For customers, the immediate risk is the one staff are already managing: don't buy chilled or frozen goods that look like they've thawed and been refrozen. French stores hit by the attack were putting out cold-chain-broken warning signs on Monday. If you shopped at an affected branch on Sunday or Monday, keep the receipt because refunds will almost certainly follow.

There's no indication customer data was touched. This was an attack on machines in the back of the shop, not on loyalty databases.

Why this attack matters

This is the clearest ICS attack on everyday retail we've seen in Europe this year, and it didn't need a nation-state behind it. A patched vulnerability, equipment left on an older build, remote access reachable from somewhere it shouldn't have been. That's the entire recipe.

Multi-factor authentication, the extra login step beyond a password, wouldn't have saved an operator who never applied the May patch, because the flaw let attackers skip the login entirely. Running version 4.2 or later was the fix. Nothing else.

Ahold Delhaize, one of the world's largest grocery groups, also pulled systems offline on Monday after what it called a cybersecurity incident. Nobody has tied the two events together, and until someone does, treat them as separate.

Watch for a claim of responsibility, and watch whether the prosecutor confirms the Danfoss flaw as the entry point. Those are the two things that turn this from a strange Monday into a case study.