French supermarkets hit by cyberattack

In the night of October 11 to 12, hundreds of French supermarkets faced remote malfunctions in their refrigeration systems, causing significant damage to frozen food and estimated losses in the millions of euros. The affected stores included major chains like Intermarché, Leclerc, Super U, and Monoprix.

Cyberattack exploits refrigeration systems

The cyberattack targeted Danfoss refrigeration systems, which are controlled remotely through a web interface called StoreView. This interface was exposed on the internet, allowing hackers to access it through a vulnerability that enabled them to guess passwords based on the time and date.

Known vulnerabilities used in the attack

The vulnerabilities exploited in the attack had been known since at least March 2025, and a cybersecurity company, Claroty, had demonstrated similar scenarios at a conference in August 2025. Danfoss had previously reported similar compromises in Russian and Israeli stores as early as 2022.

Hackers manipulated refrigeration systems

The hackers manipulated the refrigeration systems to continuously activate defrosting cycles, causing temperatures to rise to 50°C, which destroyed frozen goods and posed fire risks. The attackers also modified system monitoring parameters to prevent automatic alarms from triggering, delaying the discovery of the incident until the stores opened.

Attack spreads to other systems

The French cyber defense authority (ANSSI) noted that the attack had spread to other refrigeration management equipment from competing companies, including Dixell and Copeland, through similar vulnerabilities and methods. This indicates that the issue was not isolated to Danfoss systems.

Concerns over food system vulnerabilities

The incident raises concerns about the vulnerability of the food system to digital threats and the potential impact of hybrid threats on food security. The attack disrupted the supply chain, leading to economic, sanitary, and logistical consequences, requiring emergency measures to manage the flow of fresh products and ensure food safety.

Outdated software and OT system risks

The use of outdated software and insufficient security measures in operational technology (OT) systems contributed to the attack's success. The incident underscores the importance of securing remote access and updating software to prevent such vulnerabilities.

Need for improved cybersecurity in critical infrastructure

The NIS2 directive aims to strengthen cybersecurity requirements in various sectors, including food production and distribution. However, operational preparedness remains crucial for companies to mitigate risks and ensure continuity in the face of potential threats.