"I can confirm that, since last night, a cyberattack has been affecting the refrigeration systems in several stores within our @CooperativeU network," Coopérative U president Dominique Schelcher said as supermarket refrigerators across France were forced into unwanted defrost cycles overnight.
Attackers hijacked Danfoss refrigeration controllers
According to reporting, threat actors remotely hijacked refrigeration controllers running older versions of Danfoss control software and used those devices to trigger a built‑in automatic defrosting function. The result: supermarket refrigerator temperatures were raised intentionally, a direct assault on the systems designed to preserve fresh food.
Scope and impact across major French chains
Multiple retailers reported being affected. Named victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U. French outlets say between 250 and 350 stores were affected. Reported consequences include significant financial losses and food waste; the Paris prosecutor's office told AFP it opened an investigation to "identify the victims and establish the link with the damage they reported in terms of foodstuff losses and the outbreak of fires."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOfficial responses: Coopérative U, the EU commissioner, and the Paris prosecutor
Coopérative U said its teams were "fully mobilized, working alongside refrigeration specialists, to resolve the situation as quickly as possible." Schelcher called the assault "extremely serious" and "unprecedented," adding that "Targeting equipment essential for preserving fresh produce and supplying food to the French people is an extremely serious matter and is unprecedented. It is unacceptable."
EU agriculture and food commissioner Christophe Hansen condemned the attack and explicitly named Leclerc as one of the victims. Meanwhile, the Paris prosecutor's office has opened a formal investigation into "the large-scale cyberattack affecting the refrigerators of several major food retail chains across France." The investigation will aim to identify victims and determine links to reported losses and fires.
CISA warning and CVE-2025-41450
While investigators have not publicly identified how the attackers compromised the Danfoss controllers, the U.S. Cybersecurity and Infrastructure Security Agency warned in May 2025 of a high-severity authentication bypass vulnerability — CVE-2025-41450 — in the Danfoss AK‑SM 8xxA Series hardware platform used to manage refrigeration and HVAC systems commonly found in food retail. The reporting notes there is currently no evidence tying that CISA advisory and the present incident, but the advisory provides a specific, named vulnerability in the same vendor platform the attackers are reported to have abused.
How technologists, policymakers, and retailers are responding
- Technologists and security teams: Retailers reportedly mobilized refrigeration specialists to restore control of affected systems. Security teams will be watching closely for indicators tied to older Danfoss controller software and any exploit activity that could explain the remote defrosting.
- Policymakers and prosecutors: The Paris prosecutor's opened investigation will seek to identify victims and link the cyber activity to material damages and any fires. The EU agriculture and food commissioner publicly condemned the attack and named a specific victim, Leclerc, underscoring the political salience of assaults on food-supply infrastructure.
- Retailers and procurement leaders: In addition to the named French chains, retail giant Ahold Delhaize announced it had to take some systems offline after a "cybersecurity incident." Reporting notes there is no evidence the Ahold Delhaize action is linked to the Danfoss-targeting attacks, but the operational precaution illustrates the broader anxiety across major food retailers.
This episode is notable for its direct targeting of equipment whose normal function preserves perishable food. Investigations by French authorities are now underway to identify the technical path the attackers used and to quantify damage; for now, the public record ties the incident to hijacked Danfoss controllers running older software, cites CISA's CVE-2025-41450 advisory as contextual background, and documents a wide footprint of affected stores across several household-name supermarket chains.
Original story: https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/
