Attackers remotely triggered the defrost cycle on refrigeration controllers at several French supermarket chains, pushing storage temperatures up, BleepingComputer reported on October 12, 2026. According to the outlet, the controllers were reportedly Danfoss units running older versions of Danfoss control software. The activity began overnight on a Sunday, and the report gives no calendar date. The article says no information is available on how the controllers were compromised and does not name the attackers.
Scale and named victims
BleepingComputer cites unnamed "French outlets" for a figure of 250 to 350 affected stores and for "significant financial losses and food waste." It gives no amounts. These numbers rest on that one secondary account.
Two victims are identified by officials quoted in the article:
- Coopérative U: President Dominique Schelcher confirmed that since the previous night a cyberattack had been affecting refrigeration systems in several stores of the U network. Per BleepingComputer, he said staff were working with refrigeration specialists and that an investigation would be carried out. He called the targeting of food-preservation equipment unprecedented and unacceptable.
- Leclerc: EU agriculture and food commissioner Christophe Hansen condemned the attack and named Leclerc among the victims, according to BleepingComputer.
The article's opening list of victims also includes Intermarché, Carrefour Market, Monoprix and Super U. It does not tie those names to any specific statement.
Paris prosecutors open an investigation
The Paris prosecutor's office told AFP it had opened an investigation into a "large-scale cyberattack" on the refrigerators of several major French food retail chains, BleepingComputer says. The stated goals are to identify the victims and to establish the link with the reported food losses and "the outbreak of fires."
The Danfoss platform and CVE-2025-41450
BleepingComputer notes that the Danfoss AK-SM 8xxA platform is used to manage refrigeration and HVAC systems in food retail. It does not say which product or software version was hit in these attacks, and it does not connect the incident to a specific vulnerability.
The NVD record for CVE-2025-41450 describes an improper authentication flaw in the Danfoss AK-SM 8xxA Series, affecting versions prior to 4.2. It is classed as CWE-305 (Authentication Bypass by Primary Weakness). Danfoss, as the CNA, supplied the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H, which works out to a CVSS score of 8.2. NVD has not issued its own base score and lists the record as not scheduled for enrichment. The entry was published on May 08, 2025, and last modified on June 17, 2026. Its only listed reference is Danfoss advisory DSA-2025-03-01.
BleepingComputer describes the flaw as high severity, citing a CISA warning from May 2025. Neither the article nor NVD says CVE-2025-41450 was used against the French retailers.
Operators of AK-SM 8xxA units can compare their software version with the 4.2 threshold in the NVD record and consult the Danfoss advisory for remediation details.
Ahold Delhaize incident reported separately
Ahold Delhaize, one of the world's largest food retailers, announced on Monday that it had taken some systems offline after a "cybersecurity incident," BleepingComputer reports. The article says there is no evidence so far that this is connected to the refrigeration attack.
