Cyber-Attack on Supermarket Refrigeration Systems Puts French Food Stock at Risk

Several supermarket chains in France have reportedly been hit by a cyber-attack aimed at store refrigeration systems. Coopérative U, which runs Hyper U, Super U, U Express and Utile stores, confirmed that several stores in its network were affected from October 11. CEO Dominique Schelcher said refrigeration is essential for preserving fresh products and feeding the public, and called the attack "of utmost gravity, unprecedented [and] unacceptable." He said teams were working with refrigeration specialists to restore normal operations, and that an investigation would be needed.

French broadcaster BFMTV reported that the affected systems are administered by Danish provider Danfoss, and that attackers targeted outdated versions of its refrigeration control software. Attackers reportedly triggered forced defrost cycles remotely, with temperatures programmed to reach as high as 50 °C (122°F). Two stores in Haguenau, an Intermarché and a Super U, reportedly lost €270,000 ($302,000) of merchandise. BFMTV assessed that 150 Intermarché stores are affected, and other reports name E. Leclerc, Carrefour and Monoprix as well.

Danfoss products have had critical vulnerabilities in the past, including CVE-2023-25915, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452. Some of these could let attackers gain privileged access to refrigeration control systems and manipulate physical equipment. This report covers only the opening of the story, and many details remain unconfirmed.