ไทย
English
Lessons from the Cyberattack on French Supermarket Refrigeration Systems, Where Temperatures Were Reportedly Set as High as 50°C
When discussing cyberattacks, many organizations often think of data theft, ransomware attacks, or IT system disruptions. However, today’s cyber threats extend beyond the digital environment, potentially affecting physical equipment and systems that control critical business operations.
The recent cyberattack targeting several supermarket chains in France highlights this growing risk. Attackers reportedly manipulated refrigeration control systems remotely, with some systems reportedly set to temperatures as high as 50°C. The incident resulted in significant food spoilage, financial losses, and operational disruptions across hundreds of supermarket locations.
This incident demonstrates how cyberattacks targeting Operational Technology (OT) can directly impact physical assets, business operations, and Business Continuity.
Table of Contents
What Happened in the French Supermarket Cyberattack?
A cyberattack that began on Sunday night, October 11, 2026, reportedly disrupted refrigeration control systems at several supermarket chains in France, including Intermarché, Netto, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U.
According to BleepingComputer, approximately 250-350 supermarket locations were affected. Meanwhile, Cybernews, citing BFMTV, reported that around 300 Intermarché and Netto stores, along with nearly 100 Coopérative U locations, experienced disruptions.
*The number of affected locations varies across news reports.
The attack reportedly involved refrigeration control systems from Danfoss running older software versions. Attackers were able to remotely access Refrigeration Controllers and activate the Automatic Defrost function.
According to Cybernews, citing BFMTV, the attackers caused the Defrost function, which normally removes accumulated ice from refrigeration systems, to operate continuously instead of allowing the equipment to return to its normal cooling cycle.
Additionally, some systems reportedly had their temperature settings raised to 50°C, exposing refrigerated and frozen food products to elevated temperatures for several hours. As a result, the affected products could no longer be safely stored under appropriate food preservation conditions.
An Intermarché spokesperson indicated that the incident reportedly involved a cyberattack targeting a third-party service provider responsible for managing the stores’ refrigeration systems. Intermarché and Netto promptly removed products from affected refrigeration equipment to ensure food safety.
Coopérative U also confirmed disruptions to refrigeration systems at several locations and stated that it was working with refrigeration specialists to resolve the situation.
Cyberattack-Related Losses Could Reach Millions of Euros
The impact of the attack extended beyond equipment disruption, resulting in substantial losses of perishable products that could no longer be sold.
According to Cybernews, two supermarkets in Alsace, eastern France, suffered approximately €270,000 in combined product losses. Nationwide damages were estimated to potentially reach several million euros, although the total financial impact had not been officially confirmed.
Beyond inventory losses, incidents of this nature also pose risks of operational downtime, additional investigation and system recovery costs, and potential damage to consumer confidence.
The Paris Public Prosecutor’s Office launched an investigation to identify affected parties and assess the food-related damage associated with the cyberattack. Meanwhile, France’s national cybersecurity agency, ANSSI, began examining potential security risks involving Danfoss systems and coordinating with software providers and relevant European authorities.
CVE Vulnerabilities Potentially Associated with Danfoss Systems
Although attackers reportedly gained remote access to the Refrigeration Controllers, the exact method used to compromise the systems had not been confirmed at the time of reporting.
However, BleepingComputer highlighted two security vulnerabilities affecting the Danfoss AK-SM 8xxA Series, a platform used to manage refrigeration and HVAC systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) had previously issued security advisories addressing these vulnerabilities in 2025.
CVE-2025-41450: Authentication Bypass
An Authentication Bypass vulnerability that could potentially allow attackers to bypass authentication mechanisms and access functions that should be restricted to authorized users.
CISA published an advisory concerning this vulnerability in May 2025.
CVE-2025-41451: Command Injection
A Command Injection vulnerability that could potentially allow attackers to inject unauthorized commands for execution by the affected system.
CISA issued an advisory regarding this vulnerability in August 2025.
BleepingComputer also referenced research conducted by Claroty Team82, demonstrating how these vulnerabilities could potentially be exploited to achieve Remote Code Execution (RCE) on Danfoss AK-SM 800A systems with management interfaces exposed to the internet.
Furthermore, Cybernews reported that security patches for three Danfoss controller models had been released on September 18. However, the patch status of the devices affected by the supermarket cyberattack remained unconfirmed.
Importantly, there is currently no confirmed evidence that CVE-2025-41450 or CVE-2025-41451 was exploited in the French supermarket cyberattack.
These vulnerabilities therefore represent relevant security risks associated with this type of system, rather than confirmed causes or attack vectors in the incident.
Internet-Exposed OT Devices: A Growing Security Risk
Another significant finding highlighted by BleepingComputer was the number of Danfoss systems accessible through the internet.
Baptiste Robert, CEO of Predicta Lab, reported identifying 2,752 internet-exposed Danfoss systems, including 1,590 located in France.
Meanwhile, Shodan, a search engine for internet-connected devices, identified more than 4,500 Danfoss devices accessible through the internet.
However, these figures represent internet-exposed systems and do not necessarily indicate that all identified devices were vulnerable or compromised.
These findings highlight the importance of Attack Surface Management, particularly for Operational Technology (OT) environments with externally accessible connections.
Today, OT systems are no longer limited to industrial machinery and manufacturing environments. They also include Building Management Systems, refrigeration systems, warehouses, utilities, and equipment used to control physical business processes.
Connecting these systems to networks can improve operational efficiency and remote management capabilities. However, without appropriate security controls, such as access management, vulnerability assessment, and secure remote connectivity, these connections may create additional opportunities for attackers to access critical systems.
This is particularly concerning for Legacy Systems, which may have limited patching capabilities or no longer receive ongoing security support from their manufacturers.
Proactive OT Security: Prevent Threats Before They Disrupt Business Operations
Even limited manipulation of equipment control commands can significantly affect business operations. Cyberattacks do not necessarily need to involve data theft or ransomware encryption to cause substantial damage.
Organizations should therefore prioritize Proactive OT Security, focusing on identifying, assessing, and mitigating security risks before cyber threats result in operational or financial damage.
5 key approaches can help organizations strengthen OT security, covering vulnerability management, access controls, continuous threat monitoring, and incident response readiness.
1. OT Asset Visibility & Risk Assessment: Identify Assets and Evaluate Security Risks
Protecting OT environments begins with understanding which devices are connected to the organization’s network, which software or firmware versions they use, and what potential security risks they may present.
OT Asset Visibility and Risk Assessment enable organizations to identify outdated devices, vulnerable systems, and unnecessary external exposure.
By gaining greater visibility into OT assets, security teams can prioritize critical risks and implement appropriate mitigation strategies before vulnerabilities are exploited.
2. Vulnerability Management: Address Security Weaknesses Before Exploitation
Publicly disclosed vulnerabilities can provide attackers with opportunities to identify and exploit weaknesses in OT environments.
Organizations should establish continuous processes to identify, monitor, assess, and prioritize vulnerabilities affecting OT devices, while regularly reviewing security patches and advisories issued by equipment manufacturers.
For systems that cannot be immediately patched or updated, additional risk mitigation measures should be considered, such as restricting access or implementing network segmentation.
These measures should be carefully planned to maintain the stability, safety, and continuity of critical OT operations.
3. OT Network Security: Strengthen Access Controls for Critical Systems
OT environments responsible for controlling essential equipment and operational processes should not be externally accessible without appropriate security controls.
Implementing Network Segmentation, Secure Remote Access, User Access Management, and Authentication Controls can help reduce the likelihood of unauthorized access and limit attackers’ ability to move between connected systems.
Organizations should also assess security risks associated with Third-Party Service Providers that remotely manage or maintain OT infrastructure.
4. OT Threat Monitoring & Detection: Detect Anomalies Before They Cause Major Disruptions
Effective OT security monitoring should cover both network activities and abnormal behavior within operational control systems.
Potential indicators of suspicious activity include unauthorized access to management interfaces, unexpected configuration changes, and control commands that deviate from normal operating patterns.
Furthermore, integrating cybersecurity monitoring with operational alerts, such as abnormal temperature increases or unexpected equipment status changes, can help security and operations teams identify and investigate potential incidents more quickly.
Continuous monitoring and threat detection can strengthen an organization’s ability to respond before suspicious activities escalate into significant operational disruptions.
5. Incident Response & Business Continuity: Prepare to Minimize Operational Impact
Even with proactive security measures in place, organizations must remain prepared for incidents that could affect critical OT environments.
An effective incident response strategy should define clear response procedures, responsibilities, affected-system isolation methods, and safe recovery processes.
Coordination between IT Security teams and OT Operations teams is also essential to ensure that cybersecurity responses do not unintentionally compromise operational safety or system availability.
A well-established Incident Response and Business Continuity Plan enables organizations to respond systematically, minimize downtime, and reduce the risk of isolated incidents escalating into widespread business disruptions.
Prevent Cyber Threats Before They Strike with OT Security Solutions from BMSP
The cyberattack on refrigeration systems in France serves as an important reminder that cybersecurity incidents are not limited to data or IT infrastructure. They can directly affect physical equipment, inventory, operational processes, and overall business continuity.
Cybersecurity protection should therefore begin long before an attack occurs, with a proactive approach focused on asset visibility, risk assessment, reducing unnecessary access points, and continuous threat monitoring.
BMSP helps organizations strengthen the security of their Operational Technology (OT) environments through comprehensive OT Security Solutions, covering Asset Visibility, Risk Assessment, Vulnerability Management, Network Security, and Threat Monitoring & Detection.
Supported by our End-to-End Cybersecurity and IT Managed Services, BMSP helps organizations establish security strategies tailored to their IT and OT environments, operational requirements, and business risk profiles.
Cyberattacks can cause far greater damage than organizations anticipate. Implementing proactive security measures today is an essential step toward reducing cyber risks, protecting business reputation, and maintaining long-term operational resilience.
Looking to strengthen your organization’s OT Security or enhance your overall cybersecurity posture?
Contact BMSP’s cybersecurity specialists to assess potential risks and explore security solutions designed to protect your critical operations.
References
- BleepingComputer. (October 12, 2026). Cyberattack shuts down refrigerators at French supermarkets.
https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/ - Cybernews. Hackers turn up supermarket fridges to 50°C, threatening millions in food losses.
https://cybernews.com/security/danfoss-refrigeration-hack-france-supermarkets/
