Temperatures as high as 50°C (122°F) were reportedly forced inside supermarket refrigeration units in France, spoiling perishable food across hundreds of stores and, in some cases, starting fires.
Retail impact: Intermarché, Carrefour, Monoprix, Coopérative U
The disruption hit multiple major supermarket chains. Groupement Les Mousquetaires, owner of Intermarché, said around 150 of its supermarkets were affected; Carrefour confirmed around 80 impacted stores; Monoprix reported roughly 5 percent of its 490 stores were experiencing the same issues; and Coopérative U CEO Dominique Schelcher said 80 of the company’s 2,000 stores were hit. Schelcher called the incident “unprecedented, extremely serious, and unacceptable,” saying “Targeting equipment essential to the preservation of fresh products is an attack on the French food supply chain.”
Retailers were forced to discard fresh produce and other perishables. Some operators mobilized engineering teams and emergency measures to limit losses. In a separate but related operational disruption, Ahold Delhaize announced it was experiencing a “security issue” that affected websites, apps, customer services and online deliveries; no link to the French refrigeration incidents has been established, but the retailer reported distribution-system disruption and stock variability in stores.
Danfoss controllers and Claroty’s authentication finding
Several affected retailers used refrigeration controllers produced by Danish company Danfoss. Claroty researchers previously disclosed a hidden authentication mechanism in the AK-SM 800A platform that “accepted a code generated from the device's current date, bypassing the configured administrator password.” The firm said anyone who reproduced the algorithm could generate a valid daily code and gain administrative access.
Claroty’s findings, and the exploitability they demonstrated, were bluntly summarized by one security practitioner: “It's a zero-skill thing to pull off, I wrote the bash script while having a shit,” said security pro Kevin Beaumont. Claroty’s research showed how compromised controllers could expose refrigeration systems to physical disruption by allowing attackers to change setpoints and other controls.
Claroty and others patched and disclosed vulnerabilities in August 2025, but authorities in France have not identified the entry point for this week's incidents or confirmed exploitation of those previously disclosed bugs. Danfoss told reporters the French supermarkets affected “were running outdated firmware” and reiterated the company’s advocacy for keeping systems updated.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageScale of internet exposure and CERT‑FR guidance
Shodan searches for internet-facing Danfoss controller interfaces indicated that more than 4,500 endpoints were exposed as of Monday, with more than half of those located in France. That exposure is the practical risk vector Claroty described: remote management interfaces that allow central engineering teams to troubleshoot equipment but also lower the barrier to attackers.
“Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks. However, our research found many of these devices are directly exposed to the public internet,” said Amir Preminger, CTO at Claroty. “Organizations must take proactive measures to ensure that management interfaces are not insecurely connected to the internet, and ensure that access to administrative services is restricted to trusted management networks or secured through VPNs and other appropriate network segmentation controls.”
French computer emergency response authority CERT‑FR published an alert reporting numerous compromises of Danfoss AK‑SM and AK‑SC controllers and advised disconnecting or restricting network access. For suspected compromises it recommended a factory reset, security patches, credential rotation, account checks and full reconfiguration.
What this means for supermarket operators, technologists, and regulators
- Supermarket operators: immediate, tangible losses — spoiled inventory and at least some fires — have driven emergency responses and public statements. Some retailers have taken offline services and are restoring distribution and digital systems while discarding affected perishables.
- Technologists and security teams: Claroty’s research and the Shodan exposure counts underline two linked priorities evident in responses — ensure firmware is up to date and remove or tightly control internet-facing management interfaces. CERT‑FR’s checklist (disconnect/restrict access, factory reset, patching, credential rotation, account checks, full reconfiguration) is the operational playbook being recommended.
- Regulators and authorities: investigators have not confirmed whether the vulnerabilities disclosed and patched in August 2025 were used in these incidents. Questions raised by The Register — including whether the same bug was abused in August to affect US military commissary refrigerators that led to food losses — remain unresolved pending forensic confirmation.
The facts on the table are stark: exposed refrigeration controllers, a known hidden-authentication weakness in at least one platform, thousands of internet-facing endpoints, and a wave of store-level spoilage and disruption. What is not yet established is the precise chain of compromise — authorities have not identified the entry point or confirmed exploitation of the previously disclosed bugs, and Danfoss says affected stores were running outdated firmware. For now, supermarkets are discarding food, CERT‑FR has issued remediation steps, and the industry faces the immediate technical task of removing management interfaces from wide internet exposure while investigators try to close the loop on how perishable-food preservation came to be weaponized at scale.
