Supermarket Fridge Hack: French Chains Lose Food to 50°C Heat

On the night of 11 October, attackers reached into the refrigeration systems of French supermarkets and turned the cold off. This supermarket fridge hack hit Intermarché, Carrefour, Monoprix and others, and it left staff throwing away whole shops of fresh and frozen food.

What happened in the supermarket fridge hack

Reuters, as carried by ABC News, reported that fridges at about 150 Intermarché stores were heated to 50°C overnight for six hours. AFP, via CBS News, put the Intermarché and Netto figure at no fewer than 300 stores. The counts differ, and nobody has reconciled them yet.

Other chains were hit too. Carrefour said 80 of its roughly 6,000 stores were targeted, though most were unaffected. Monoprix reported around 5% of its French shops. Coopérative U’s chief executive, Dominique Schelcher, called the attack “unprecedented”. Paris prosecutors confirmed that the attack also sparked fires, and they have opened an investigation into the link between the intrusion, the fires and the lost stock.

Intermarché’s chief executive told BFM TV the losses would run to tens of millions of euros nationwide in a single day. There is no industry-wide estimate yet.

The device behind the fridge hack

The common thread is a type of box most shoppers never think about. A refrigeration controller sits in the back of a store and tells the compressors and defrost cycles what to do. Maintenance firms manage these devices remotely, so many of them sit on the internet.

France’s national alert, CERTFR-2026-ALE-012 from CERT-FR, names the Danfoss AK-SC and AK-SM series, plus Copeland and Dixell xweb units. It says it is aware of numerous compromises and that attack campaigns are probably still going on. Danfoss told the press that most affected units were older products that no longer receive security updates, and that it knew of incidents affecting “a limited number of refrigeration management systems”.

The AK-SM 800 reached end of life in 2021. The AK-SC 355 was phased out back in 2016. Some newer AK-SM 800A units were also hit while running outdated firmware.

How the attackers got in is still unclear

No one has said how the intruders broke in. A source close to the French prime minister told AFP that the national cyber agency, ANSSI, found a vulnerability in software from a Danish company. That is not the same as naming the flaw used.

There is a plausible candidate worth knowing about, with a firm caveat. In August, Claroty’s Team82 published research on the AK-SM 800A covering three flaws. CVE-2025-41450 is a login bypass built on a hidden “code-of-the-day” password. CVE-2025-41451 is command injection that gives code execution once logged in. CVE-2025-41452 allows web-server configuration injection. Claroty counted 2,765 exposed devices in a Censys scan.

So, that research was done in a lab, and it did not cover the older models that now seem to be at the centre of the attacks. Nobody has linked these CVEs to the French incidents, so treat the connection as unproven.

Why this is a penetration testing story

Strip away the shock value and this supermarket fridge hack is a familiar failure. Danfoss’s own October 2025 newsletter said that 40 Israeli supermarkets were hacked in 2022, and that all 40 lacked a proper firewall or VPN. The lesson was public three years ago.

It also fits a pattern we covered in internet-exposed edge devices. The device is out of sight, it belongs to a contractor, it never appears on the asset register, and nobody is sure whose job it is to patch it. An attacker only needs one of those assumptions to be true.

A tester looking at a retailer would ask a few plain questions. What do we expose to the internet that we did not put there ourselves? Which suppliers hold remote access, and how is it protected? Which kit has no patches left? If a device cannot be patched, can it sit behind a VPN?

What to do this week

CERT-FR’s advice applies well beyond France, and beyond fridges. The same logic covers building management systems, CCTV recorders and heating controls.

• Take any management interface off the public internet. Reach it through a VPN or a protected network instead.
• Ask your maintenance contractors in writing how they connect, and who else can log in.
• Change default passwords and set the vendor’s strictest security level.
• Review the configuration of any device you suspect, including schedules such as defrost timings. CERT-FR warns that a factory reset alone is not enough.
• Retire end-of-life units that cannot be patched. CERT-FR expects exposed ones to be compromised again.

Any supermarket fridge hack of this kind starts with a forgotten device. The UK has the same kit in the same back rooms. If you run shops, cold storage or a kitchen, ask your facilities team this week where the controller is and who can reach it.