The attacks hit hundreds of stores across multiple major supermarket chains. Intermarché owner Groupement Les Mousquetaires said approximately 150 of its supermarkets were affected, while Carrefour confirmed around 80 impacted stores. Monoprix reported that roughly 5 percent of its 490 stores experienced the same issues, and Coopérative U CEO Dominique Schelcher said 80 of the company’s 2,000 stores were targeted, calling the assault on the food sector “unacceptable.”
The compromised equipment includes cold-storage units that hold food before it reaches supermarket shelves. Attackers raised temperatures to unsafe levels, spoiling fresh produce and, in some cases, starting fires. Danfoss, the Danish manufacturer of the refrigeration controllers, told reporters that the affected stores “were running outdated firmware” and that the company has consistently advocated for keeping systems updated.
The attacks follow research by security firm Claroty, which in August 2025 disclosed vulnerabilities in Danfoss AK-SM 800A controllers. The researchers found a hidden authentication mechanism that accepts a code generated from the device’s current date, bypassing the configured administrator password. Anyone who reproduces the algorithm can generate a valid daily code and gain administrative access. Security professional Kevin Beaumont described the exploit as “a zero-skill thing to pull off” and said he wrote a bash script to do it.
CERT-FR published an alert noting numerous compromises of Danfoss AK-SM and AK-SC controllers, and recommended factory resets, security patches, credential rotation, account checks, and full reconfiguration for suspected compromises. The role of the previously disclosed vulnerabilities in this week’s attacks remains unconfirmed, although Danfoss did not answer whether the same bugs were used. The Register asked if the vulnerabilities were also exploited in August to compromise US military commissary refrigerators, leading to food losses; Danfoss did not respond.
Claroty CTO Amir Preminger said that while remote access to refrigeration controllers reduces maintenance costs by allowing engineers to troubleshoot issues, it also lowers the barrier to entry for attackers. “Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks. However, our research found many of these devices are directly exposed to the public internet,” he said. “Organizations must take proactive measures to ensure that management interfaces are not insecurely connected to the internet, and restrict access to trusted management networks or secured through VPNs and other appropriate network segmentation controls.”