A cyberattack reportedly manipulated supermarket refrigeration controllers across Europe, forcing refrigerators and freezers into defrost mode and raising some target temperatures to 50 °C (122 °F). Food spoiled before employees discovered the changes, with some equipment said to have remained at elevated temperatures for about six hours.
Most of the reported disruption occurred in France. More than 300 supermarket locations in the country were affected, according to a BFM TV estimate cited by SecurityWeek. That figure describes locations affected by the incident, not a confirmed count of unique victims or sites where food losses were verified.
Belgium, Germany, the Netherlands, Poland, Portugal and Spain were also reported as affected. The named retail chains include Auchan, Carrefour, E.Leclerc, Intermarché—owned by Groupement Mousquetaire—and Monoprix.
Attackers reportedly changed settings overnight
Security researcher Lukasz Olejnik said the attackers remotely took control of refrigeration controllers, initiated defrosting and configured a 50 °C target. Employees opening freezers the following morning reportedly encountered hot air rather than refrigerated storage.
The controllers were attributed to Danish manufacturer Danfoss. The reporting does not establish which Danfoss model was compromised or provide enough evidence to connect the incident to a specific vulnerability.
The operational impact extended beyond temporary equipment disruption. Refrigeration systems preserve perishable inventory, so several hours at abnormal temperatures can force stores to discard products. BFM TV estimated that losses could reach millions of euros, but that remains an estimate rather than a confirmed total.
Dominique Schelcher, CEO of Cooperative U, confirmed on X that several of the group’s stores were affected. Cooperative U operates the Hyper U, Super U, U Express and Utile banners. Schelcher said teams and refrigeration specialists had been mobilised to restore operations and that a full investigation would be necessary.
Danfoss AK-SM 800A flaws remain a separate, unconfirmed lead
Cybersecurity company Claroty had disclosed vulnerabilities in the Danfoss AK-SM 800A management platform roughly two months before the attack. The reported weaknesses included authentication bypass, remote arbitrary code execution and the ability to inject arbitrary configuration directives.
Claroty also identified thousands of AK-SM 800A management interfaces exposed to the public internet. Because the platform centrally manages refrigeration equipment, control of its interface could allow an attacker to change operating parameters with consequences across connected systems or sites.
However, the affected controllers in the supermarket attack have not been confirmed as AK-SM 800A devices. It also remains unclear whether the attackers used any of the flaws disclosed by Claroty. The timing and technical similarities therefore do not establish a direct link.
For the AK-SM 800A specifically, Claroty advised customers to upgrade to firmware R4.3.1, which contains the relevant patches.
What refrigeration operators should check
Organisations using Danfoss AK-SM 800A should verify their deployed firmware and apply R4.3.1 where applicable. Operators should also identify management interfaces reachable from the internet and review refrigeration configurations for unexplained changes, including unexpected defrost cycles or abnormal target temperatures.
Monitoring should account for the physical process as well as the management software. In this incident, the reported six-hour delay before discovery allowed altered settings to translate into spoiled inventory and financial damage. Alerts for sustained temperature deviations and unauthorised configuration changes can help staff respond before a controller compromise becomes a food-safety and business-continuity event.
