French Supermarket Fridge Hack Exposes a Maintenance Gap

French supermarkets lost refrigerated stock after attackers remotely forced fridges and freezers to warm overnight into Monday, October 12. Intermarché said units reached 50C for six hours and it discarded the affected food to avoid health risks. By Monday afternoon, some fresh and frozen food display units at its parent group’s stores remained out of service, the group told the BBC. A software command had become a stockroom problem.

At least 300 Intermarché and Netto stores and more than 100 Coopérative U outlets were targeted, the retailers told AFP. E.Leclerc also confirmed disruption in several stores. The Paris prosecutor’s office has opened an investigation into the attack, including the reported food losses and fires. Those store figures establish a broad disruption, though the final number of affected locations remains uncertain.

The attack involved refrigeration-control software from Danish engineering company Danfoss. These controllers let retailers manage equipment remotely, including temperatures and defrost cycles. A freezer normally enters a short defrost period; the attackers instead made units heat up and stay hot. The useful feature and the damaging action met at the same control point: a system allowed to change what the equipment does.

Why Put Refrigeration Controls Online?

A retailer with stores spread across the country needs to know when a freezer is warming, preferably before somebody opens it to start the morning shift. Connected controllers can monitor temperatures and alarms across locations. They can also support remote management of defrost cycles and, on supported devices, software updates. That is the practical case for the connection, not a novelty feature attached to an appliance.

The equipment sits in the category security teams call operational technology, or OT: software and hardware that help run physical processes. Remote refrigeration management puts routine commands and alerts within reach of people who need them. It also makes access to those commands a security question. If an unauthorized actor can issue a defrost instruction, the consequence appears in the freezer aisle rather than on a computer screen.

That does not mean every connected freezer is open to the internet or that remote monitoring caused this attack. The attackers’ precise route into the affected systems is unknown. A controller can have legitimate remote functions while a retailer still has choices about how staff reach it, which networks can reach it, and what happens when its software ages out of support. Those choices become more consequential when equipment remains useful longer than its security updates do.

Danfoss identified its AK-SM800 and AK-SC355 regulator systems among those affected. The company told AFP that most affected equipment consisted of legacy products that no longer receive software or security updates; it said a version of the AK-SM800 ran outdated firmware and that it had long advised supermarkets to move away from those models. The description identifies a maintenance problem at affected sites. It does not, by itself, identify the weakness the attackers used.

Consider the operator’s position. Replacing a controller can mean coordinating the equipment, its software and the people keeping chilled food at safe temperatures. Leaving it in place may be easier in the short term, especially while it continues to perform its everyday job. But once updates end, a plan that depends on applying the next security fix stops being a plan. The remaining questions are whether access can be restricted, whether the device can be isolated from unnecessary connections and when replacement becomes necessary. Those are risk-management choices, not proof that any one store failed to make them.

There is a cost on either side of the remote-access decision. Broad connectivity can make monitoring and maintenance easier across many stores; cutting it off without an alternative can make faults harder to spot or service. Restricting who can send commands while preserving temperature alerts would be a more targeted goal than simply declaring the equipment offline. Whether a given installation can achieve that depends on its design and on what its vendor still supports.

A Previous Warning, and Its Limits

In May 2025, the US Cybersecurity and Infrastructure Security Agency warned of a high-severity authentication-bypass vulnerability, CVE-2025-41450, in the Danfoss AK-SM 8xxA series, as described by BleepingComputer. Authentication bypass concerns the barrier that should keep an unauthorized person from reaching a system. The warning is a useful comparison because it concerns security in equipment used to manage refrigeration and HVAC in food retail.

The comparison has a hard boundary: the named advisory concerns the AK-SM 8xxA series, while Danfoss identified AK-SM800 and AK-SC355 systems in the French disruption. No connection between CVE-2025-41450 and this attack has been established. A known flaw with a CVE number tells an operator what to investigate in the affected product series; it cannot serve as an explanation for a later incident with an unknown entry path.

That earlier warning does show how a security issue can enter the maintenance calendar of equipment whose job is to keep running. The current incident adds a consequence: changing a refrigeration setting remotely can force stores to remove food from sale and bring in refrigeration specialists to restore service. For operators, a vulnerability inventory needs to answer more than Do we have this model? It needs to answer Can we update this installation, who can reach it, and how will we operate it if we restrict that access?

Danfoss was working with affected customers on updates where available, stronger network protections and removal of direct internet exposure where applicable. Each measure addresses a different piece of the problem. An update depends on a supported device; network protections can reduce routes to a controller; removing direct exposure changes how authorized workers reach it.

A person close to the French prime minister told AFP that France’s cyber agency had identified a vulnerability in software supplied by a Danish company and contacted the vendor. The agency was also liaising with European counterparts because other countries might be affected. That response gives operators a reason to check their own installations and vendor guidance now. It does not make a French store’s configuration a template for every other site.

For shoppers, the immediate outcome was food removed from affected units, not a task to perform on a home fridge. For retailers, the practical question is more exacting: when a controller still keeps food cold but its software support has ended, who decides how it can be reached tomorrow morning?