Key Notes
- Intermarché’s owner told Reuters that refrigeration at around 150 stores reached 50°C for six hours, while later reporting showed a broader impact across several retail chains.
- Danfoss said affected equipment included outdated and unsupported systems, making both firmware maintenance and replacement of legacy controllers relevant to the response.
- French authorities are investigating food losses and reported fires, while the precise exploit chain and total financial damage remain unresolved in the public accounts reviewed.
A French supermarket cyberattack sent refrigeration temperatures as high as 50°C, forcing retailers to discard food and prompting an investigation into reported fires. The incident affected several chains, showing how a compromise of connected control systems can become a physical disruption across hundreds of stores.
Les Mousquetaires, which owns Intermarché, told Reuters that refrigerators at around 150 of its stores were heated to that temperature for six hours overnight. A spokesperson said affected food had been thrown away to eliminate health risks, Reuters reported on October 12.
That figure does not represent the full extent of the incident. In a later AFP report, retailers put the affected Intermarché and Netto total at at least 300 stores, alongside more than 100 Coopérative U outlets and several E.Leclerc locations. The counts cover different groups and reporting stages.
The Attack Reached the Equipment Keeping Food Cold
Refrigeration management systems give operators a central interface for monitoring equipment and changing settings across a store. Remote access lets maintenance teams investigate faults without visiting each location, but it also makes the security of the management interface part of the food-storage operation.
Claroty’s Team82 described that architecture in its August research into Danfoss AK-SM 800A controllers. The researchers found internet-exposed management interfaces and vulnerabilities involving authentication bypass, command injection and web-server configuration. Danfoss issued fixes following coordinated disclosure.
The operational consequence is different from losing access to an ordinary office application. A controller’s settings influence real equipment, while food continues to deteriorate during an outage. Restoring the interface cannot reverse the loss of stock that has already warmed beyond acceptable conditions.
Legacy Systems Complicate the Firmware Question
Danfoss told Reuters that the affected units were running outdated firmware and that it had long urged customers to update supported systems and replace legacy equipment. AFP separately reported the company’s statement that most affected equipment consisted of legacy products no longer receiving software or security updates, including AK-SM800 and AK-SC355 systems.
Those product distinctions matter. Earlier vulnerability research into the AK-SM 800A provides relevant background, but it does not establish that every affected supermarket was attacked through the same flaw. The precise exploit chain used in this incident has not been established in the public accounts reviewed here.
Danfoss’s current support guidance for the AK-SM 800A describes stricter session authentication and HTTPS requirements in newer software. It also warns that upgrades can affect third-party interfaces and recommends on-site support where the existing configuration is uncertain.
For a retailer, that creates two separate maintenance decisions: updating equipment that remains supported and replacing equipment that no longer has a viable security-update path. Treating both as a single missed software patch would obscure the work needed to restore a defensible system.
Investigators Are Assessing the Damage
The Paris prosecutor’s office confirmed a large-scale attack and opened an investigation into food losses and fires. Reuters also reported that Prime Minister Sébastien Lecornu instructed France’s cybersecurity agency, ANSSI, to investigate, with officials coordinating with European counterparts. An industrywide loss estimate was not immediately available.
The research published before the incident points to practical defensive priorities: install supported firmware, keep management interfaces off the public internet and restrict administration to trusted networks or protected remote-access arrangements. Those measures reduce exposure, though they do not replace an investigation into how this attack unfolded.
The immediate burden falls on stores disposing of stock and restoring safe refrigeration. The broader issue is how retailers manage equipment whose digital controls can change physical conditions at scale. Keeping those controls secure is part of keeping the supply chain operating, rather than a task separate from it.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
