A cyberattack disrupted refrigeration at French supermarkets, causing some retailers to discard perishable goods. Les Mousquetaires, the group behind Intermarché and Netto, said affected equipment was forced into defrost and heated to as much as 50°C, according to The Hacker News. The reported temperature is a retailer account of part of the incident; it should not be read as a measurement at every affected store.
France's national incident response team, CERT-FR, says it is aware of numerous compromises involving remote refrigeration controllers. Its alert covers Danfoss AK-SM and AK-SC systems as well as Copeland and Dixell xweb systems. The initial bulletin was published on October 12 and expanded on October 13 to name additional equipment. This broader list matters: the warning is no longer limited to one vendor's controllers.
Physical disruption, uncertain entry point
Refrigeration controllers coordinate temperatures, defrost schedules and alarms across store equipment. Unauthorized changes can therefore spoil food or interrupt a cold chain even when an attacker does not steal data from a conventional business system. Retail accounts describe substantial losses, but the number of stores that lost stock differs from the number whose systems were targeted. Some sites were able to respond before goods spoiled.
How the attackers entered the systems has not been established publicly. CERT-FR has not attributed the activity to a particular group or named a vulnerability used in these incidents. Earlier Claroty research found serious flaws in Danfoss AK-SM 800A controllers, including an authentication bypass and command injection, and documented internet-exposed management interfaces. Claroty itself says the precise attack path in France remains unconfirmed. Those lab findings must not be presented as proof that the attackers exploited the same flaws.
What operators should check
CERT-FR advises organizations with affected equipment to remove direct internet exposure, inspect the full configuration—especially defrost settings—and restore remote access only through a secured VPN or protected network. It describes source-IP filtering as a temporary emergency measure, not a lasting substitute. Operators should also follow vendor guidance on firmware, strong settings and changed default passwords.
For a confirmed compromise, the agency recommends taking the unit off the public internet, restoring the equipment and reconfiguring it before service resumes. It warns that a factory reset alone is insufficient if an unsupported device remains exposed and vulnerable; attacks may still be ongoing. A response therefore has to address both the manipulated configuration and the path that allowed remote access.
The incident is a practical example of a cyberattack producing an immediate physical effect. The strongest current facts are the disruptions reported by retailers and the controller compromises acknowledged by CERT-FR. Attribution and the exact intrusion method remain open questions.