Cyberattack Disrupted Cooling Systems at French Supermarkets
A cyberattack on cooling systems affected several French retail chains. The investigation covers the extent of the damage and how the intrusion occurred.
A cyberattack on cooling systems affected connected refrigeration and freezer systems at several major retail chains in France during the night of October 11–12, 2026. The incident had physical consequences: retailers discarded food and temporarily restricted sales. The investigation also includes reported fires.
Intermarché said approximately 150 of its stores were affected. According to Reuters, refrigerators at these locations were set to as high as 50 degrees Celsius for approximately six hours. Carrefour confirmed that 80 supermarkets were affected. Monoprix reported that the incident affected approximately 5% of its stores.
The Paris prosecutor’s office opened an investigation into the large-scale attack. It concerns reported damage, including food losses and fires. The exact total number of affected locations and the final amount of damage have not yet been established.
Cyberattack on Cooling Systems and Outdated Firmware
Danfoss confirmed incidents in France involving a limited number of cooling control systems. According to the manufacturer, the affected units used outdated firmware.
In March 2025, Danfoss published a security advisory concerning the CVE-2025-41450 vulnerability in the AK-SM 8xxA platform. The flaw allowed authentication bypass. For affected devices, the manufacturer recommended updating to version 4.2 or later.
Firmware 5.3.x from October 2026 is available for the AK-SM 800A series. For versions 4.0.x and later, Danfoss introduces stricter sessions and HTTPS by default.
However, the existence of a patched flaw does not confirm how the attack occurred. It has not been publicly confirmed that the attackers exploited CVE-2025-41450 or another known vulnerability in Danfoss products. It is likewise not known who carried out the attack.
Disrupted Cold Chain, Not Just a Data Incident
The case is an example of a cyber incident with a direct impact on retail operations. Disrupting cooling controls can mean breaking the cold chain, destroying merchandise and temporarily restricting sales. This was therefore not merely an incident involving data or office systems.
For operators of AK-SM systems, the availability of updates is particularly relevant because the manufacturer confirmed outdated firmware on some affected units. However, the available information does not show which specific models and firmware versions were attacked in the incident.
What French Authorities Are Investigating
Further information is expected from France’s ANSSI agency, the Paris prosecutor’s office and Danfoss. Confirmation of the method of intrusion, the technical specifications of the affected devices and the recommended mitigation measures will be important.
Reuters reported that French authorities are coordinating their response with European partners. This does not, however, confirm that the same attack affected supermarkets outside France. The retail chains are also expected to clarify the number of affected stores, the volume of discarded food and the status of restored operations.
Sources
- Reuters via Euronext – Confirms the scope of the incident in France, statements from the retail chains, the investigation, reported damage and Danfoss’s statement about outdated firmware.
- Danfoss Security Advisory DSA-2025-03-01 – Confirms CVE-2025-41450, affected AK-SM 8xxA units before version 4.2 and the availability of a fix.
- Danfoss AK-SM 800A Series – Confirms the availability of firmware 5.3.x in October 2026 and the security settings of newer versions.
- BleepingComputer – Reports Intermarché’s statement about the cyberattack and the shutdown of some refrigerated displays; it also explicitly distinguishes that a connection to specific CVEs has not yet been proven.
Verified and updated: October 13, 2026, 15:20
