A damaging cyberattack affecting refrigeration systems at several large supermarket chains in France has impacted cold-food storage in stores throughout the country and caused hundreds of thousands of euros in losses, according to published reports.
One of the victims, Groupe Mousquetaire's Intermarché, told a French news outlet that 150 of its stores were impacted in the attack. The chain said that the hackers accessed Danfoss refrigeration systems and remotely manipulated temperature controls to reach 50℃, or 122℉. Reports estimate that significant amounts of food had been wasted at Intermarché. Other impacted chains include: Carrefour, Monoprix, E.Leclerc, Coopérative U’s Hyper U markets, Super U, and U Express and Utile.
Danfoss is a Danish manufacturer, and its products are used globally by original equipment manufacturers in numerous refrigeration and HVAC products. Third-party contractors and installers may also buy Danfoss products from wholesalers and distributors.
Previous Security Research on Danfoss Refrigeration Controllers
Danfoss controllers were the subject of Team82 research published in August of this year and of a presentation given at the annual DEF CON conference in Las Vegas. The research provided limited details on three vulnerabilities in Danfoss’ AK-SM 800A platform, specifically in its embedded web management interface. Team82 privately disclosed the vulnerabilities to Danfoss and the vendor provided a new firmware version in August 2025 that addressed the CVEs.
Team82’s research uncovered a hidden "code-of-the-day" authentication mechanism that could be abused to bypass normal authentication, a command-injection vulnerability leading to remote code execution, and an issue allowing authenticated users to inject arbitrary Nginx configuration directives, which could be leveraged to manipulate web traffic and trigger a denial-of-service condition.
No details are available yet on how the attackers accessed the French supermarket chains.
Internet-facing operational assets present a formidable risk to organizations if they’re not properly secured. Weak or default passwords, insecure system configurations, or exploits of legacy communication protocols can open the door to access these assets.
Publicly available internet-scanning tools such as Censys and Shodan can easily enumerate assets that are exposed online, providing attackers with a potential list of targets. Team82’s initial research into exposed Danfoss AK-SM 800A devices turned up 2,765; it’s unknown how many of those assets have since deployed the updated firmware, and how many remain exposed to these particular vulnerabilities.
Security Recommendations for Internet-Facing Assets
Exposed assets, meanwhile, can also provide attackers with a way to move deeper onto operational and enterprise networks. Organizations that choose to make these assets accessible online must not only lock down credentials, but have complete visibility into these assets, the pathways they provide internally to other systems, and also properly segment them in order to limit the blast radius of a compromised system.
One concern moving forward is the cascading impact of this incident. Vulnerabilities in other refrigeration systems, for example, have been uncovered. Team82, in August, also published research on security issues impacting the Copeland XWEB platform and disclosed 23 vulnerabilities, 21 of which were high-severity. The flaws, which were patched by Copeland in a firmware update in February, could allow an unauthenticated attacker to progressively bypass the platform's security mechanisms, resulting in root-level remote code execution (RCE).
As we saw in the cyberattacks affecting water utilities this summer in the United States, attackers are increasingly seeking disruptive attacks against critical services and will try to carry out hacks at scale. With artificial intelligence (AI) reducing the time to scan systems for access control issues or vulnerabilities, coupled with geopolitical conflict spiking activity against critical infrastructure, these are issues that must be prioritized within operational environments.
For food and beverage retailers and manufacturers they should not assume that assets such as these controllers are isolated and secure. Supermarkets, cold-storage facilities, and other healthcare and commercial enterprises dependent on refrigeration should inventory assets, assess whether they’re directly internet-facing, and ensure administrative services are restricted to trusted network segments or secured behind VPNs or industrial remote access solutions.
