Overnight on Sunday 11 October, refrigeration controllers in French supermarkets were told to defrost and keep defrosting. By Monday morning, according to BleepingComputer, French outlets were counting between 250 and 350 stores affected. Al Jazeera put Intermarché and Netto at no fewer than 300 shops, Coopérative U at more than 100 and Carrefour at 80, with Monoprix and Leclerc also hit. Intermarché's chief executive described losses of tens of millions of euros in a day, and Paris prosecutors have mentioned fires at some sites.
The boring part is the interesting part
Nobody has published how the controllers were reached. What is known is that the units involved ran older Danfoss control software, and that Danfoss itself says they were on outdated firmware it had long urged customers to update or replace. French authorities say ANSSI identified a vulnerability in Danfoss software. The AK-SM 8xxA family has two disclosed flaws, an authentication bypass (CVE-2025-41450) and a command injection (CVE-2025-41451), both written up by Claroty's Team82 earlier this year. BleepingComputer is careful to say there is no confirmed link between those CVEs and this attack, and we would repeat that caution.
The exposure numbers are more telling than the CVE numbers. Predicta Lab's Baptiste Robert counted 2,752 Danfoss systems reachable from the internet on Monday, 1,590 of them in France, and Shodan tracks over 4,500. These panels are online because maintenance contractors need to adjust setpoints without driving to the store. That convenience is the whole attack surface. Sekoia's Felix Aime told Reuters that stores in Spain, Portugal, Poland, Germany and Belgium were touched as well.
Why a retailer's risk register probably misses it
Refrigeration sits with facilities, the contract sits with a service firm, and the firmware sits with nobody. Intermarché's own first statement blamed a service provider managing the refrigeration systems in its stores, which is a fair summary of the problem: the device is in your estate, but the credentials and the remote access path belong to somebody else. Meanwhile the vendor says some of the equipment no longer receives updates at all, so patching was never going to be the answer for those units.
What to do on Monday
- Ask every facilities and refrigeration contractor for a list of devices they can reach remotely, and how. Compare it with what your security team believes exists.
- Pull management interfaces off the public internet. A VPN or a vendor jump host with MFA is a nuisance; a spoiled night of stock is worse.
- Find the end-of-support controllers and put a replacement date and a compensating control against each one.
- Check that alarms for out-of-range temperatures go somewhere independent of the controller being attacked, and that someone is on the hook to act at 3am.
- Write the food-safety and insurance conversation into your incident plan now. Regulators and underwriters will ask the same questions you would.
There is a related, unconfirmed footnote. Ahold Delhaize said on the Monday that it had taken some systems offline after a cybersecurity incident, and there is no evidence yet that the two events are connected. We would treat them as separate until someone shows otherwise. If you want help mapping contractor-managed devices in a store or site estate, write to sales@halfteck.com.