The refrigerated cases in about four hundred French supermarkets ran their defrost heaters through the night of 11 to 12 October with the setpoint at 50 degrees Celcius. That’s hot, even in Fahrenheit.
Attackers reached the Danfoss refrigeration controllers in roughly 300 Intermarché and Netto stores, under a hundred Coopérative U stores, and outlets of Leclerc, Carrefour Market and Monoprix, and held the defrost on for about six hours. Fresh and frozen stock was destroyed, with losses in the millions of euros. The Paris prosecutor opened an investigation on its own initiative and assigned it to the national anti-cybercrime office, citing fire starts alongside the food loss. The attack remains unclaimed and unattributed.
A spoiled summer, now fall
The attack hit the aisle already under the most strain. French fresh-produce prices rose 5.9 percent year on year in August, up from 2.7 percent in June, with salads and tomatoes each up more than 20 percent after the summer heat. Farm diesel was up 50 percent and nitrogen fertiliser had doubled by May after the Strait of Hormuz blockage. Dominique Schelcher, the Coopérative U chief who called the attack unprecedented, had already told France 2 in April to expect food prices up four to five percent. Economists expect this summer’s weather to push eurozone food inflation toward 3 percent in 2027, with fresh food first.
One night of spoiled stock across four hundred stores is small against national food spending. It lands on households already watching the fresh aisle, and it puts empty cases in front of them when their budgets are tightest.
Danish intelligence describes the aim of Russia’s hybrid campaign as creating insecurity in the targeted countries. A visible hit on food during a cost-of-living squeeze serves that aim quite clearly.
The noise of destruction was the point.
The same controllers can be made to spoil stock quietly, with no heat and no alarms. The attacker took the opposite route, pushing the cases to 50 degrees and emptying whole aisles by opening time. A quieter attack was available, and the attacker passed it over. Whoever did this wanted the damage seen and left no name on it. That is the shape of a message. Everything the heat touched had to be dumped, so the loss fell on the chains and stopped short of a customer incident.
The common factor across the chains was a refrigeration-control platform reachable over the network and running software a year past its fix. European law covers only part of this. The Cyber Resilience Act reaches the product with reporting required since last September, as explained below. NIS2 reaches the operator if they are wholesale, meaning not these stores (retail).
The mechanism
A supermarket runs its cold cases and cold rooms from one supervisory controller, here the Danfoss AK-SM family, which sets the temperatures and schedules the defrost for every case in the store. The controller is networked so a contractor can monitor and adjust hundreds of sites from one desk. An Intermarché spokesperson confirmed that the attackers targeted outdated versions of the control software on consoles reachable over an inadequately secured remote channel. A stolen password would have worked on any version, so the reported version cutoff points to an exploit aimed from a scan.
Claroty’s Team82 published its research on the AK-SM 800A in August: a hidden authentication path built on a daily code, logged as CVE-2025-41450, and 2,765 of the controller’s management interfaces exposed on the public internet. Danfoss had shipped the fix in firmware R4.3.1 in 2025. The stores hit were running vulnerable older firmware.
Where the law ends
France’s cyber agency is treating the attack as a product fault. A person close to Prime Minister Lecornu said ANSSI had identified a vulnerability in software supplied by a Danish company and contacted the vendor. The agency is working with its European counterparts because other countries may be affected, and is searching for other exposed French companies before the attack spreads. The response therefore follows the product, across many operators and borders.
The Cyber Resilience Act covers product fault, and part of it is already in force. Since 11 September, manufacturers have had to report actively exploited vulnerabilities in their products to ENISA and a national CSIRT within 24 hours of becoming aware of them, a duty that extends to products sold before the regulation fully applies.
This attack falls a month inside that window.
The full requirements, secure-by-default design and security updates across a defined support period, will start to apply from 11 December 2027. Old controllers with internet-facing interfaces and a vendor-built hidden authentication path are the case those requirements address, next year.
Liability is the real gap, which let bad network-connected software spread in the first place. For forty years a manufacturer had to answer for a defective physical product. However, software was shipped as a licensed service that disclaimed the same duty. A controller is both at once, a box on the wall and the code inside it, and the code lacked an equivalent liability. That gap has allowed a business case for shipping an internet-facing controller with a hidden authentication path and leaving the fix to a firmware update the field apparently never installs.
Berlin’s own breach this year ran on the same arrangement, with 21 state systems whose admin passwords only the vendors could change. The revised Product Liability Directive closes it, treating a missing security update as a defect the maker answers for, though only for products placed on the market from 9 December 2026.
Controllers already installed fall under the 1985 directive, where liability for software remains contested. Groupement Les Mousquetaires has already said the systems were under Danfoss’s management and so the complaint has to fall to the supplier.
The EU’s NIS2 also has a gap where the attack landed. Annex II covers food businesses engaged in wholesale distribution and industrial production, which takes in the purchasing and logistics groups behind these large retail chains. The stores where the controllers sit are considered outside Annex II, and many belong to independent members of the cooperatives. Article 21(2)(d) makes an in-scope entity answer for the security of its direct suppliers, so the duty follows whoever holds the refrigeration contract.
Look at it logically. When a store holds it, the duty falls outside NIS2. The refrigeration-management provider enters NIS2 in its own right only if it qualifies as a managed service provider under Annex I, a question regulators should soon settle.
The CER Directive draws the same line around retail for the physical resilience of food operators. Article 22 of NIS2 lets EU bodies run coordinated risk assessments of critical ICT supply chains, and supervisory controllers for food refrigeration belong on that list.
US military base warnings
On 26 and 27 August, at least six US military commissaries lost refrigeration within days of each other, with reports from as many as fourteen. At Fort Huachuca every freezer went into defrost overnight while the power stayed on, and the base said the defrost heated the food.
The Defense Commissary Agency’s own engineering specification states that defrost is controlled through its remote monitoring system, and a DeCA contract required its refrigeration contractor to keep a master control system for all of those systems in the continental United States. A defense official acknowledged a “possible refrigeration disruption,” and three federal criminal investigative agencies, led by DCIS, opened investigations.
Claroty’s Danfoss research had appeared eighteen days before Fort Huachuca lost its freezers. The two incident nights share the defrost signature, the overnight timing and the published research that came before them. Both remain unattributed.
In August the United States was at war with Iran, and in October France sat inside Russia’s campaign against Ukraine’s supporters, so the motives point to linked yet different adversaries.
One actor rehearsing on US bases and then striking France fits the sequence. So does a method made public in August and picked up by more than one crew. The commissary controller records, still in a FOIA queue, would help distinguish or connect these incidents.
Who done it
The version cutoff and the reported hits on Metro and independent butchers fit a scan of French addresses that hit whatever fit the profile. Any actor could run it. A state or state-directed operation inside the Russian hybrid campaign fits the motive against a Ukraine supporter and the pattern of an effect felt with the hand unseen, and the technical evidence for it has yet to appear. Unclaimed and fragmented is the Russia hypothesis itself, since an operation of this kind succeeds while the case stays open. A pro-Russian hacktivist crew fits the method, and its silence counts against it, since those groups claim loudly. A criminal demonstration ahead of a private extortion demand fits the absent ransom note and little else.
There is one question nagging at me. Danfoss is a Danish company and other Ukraine-supporting states run its equipment, yet the reports come from France. Either the exposed pre-version-4 population sat in France or France was carefully chosen, and the other countries may have yet to report. ANSSI is asking its counterparts now.
The same weekend, Ahold Delhaize, the largest grocer in the Netherlands and owner of Delhaize in Belgium, took systems offline after a cybersecurity incident that hit its websites, deliveries and shelf-label pricing. Reports so far confine it to IT systems, and no link to France is established.
Ok, say Russia already
Control-system attacks with physical effect have a verified record older than the press admits, running back past the Maroochy Shire sewage release in 2000. The matching cases reached an exposed control system and pushed a setpoint or valve to a destructive value. At Køge in 2024 an intruder altered pump pressure at a waterworks and burst pipes, and Danish intelligence attributed it to Russia in December 2025. Norwegian authorities said hackers opened the valves at a dam and blamed Russia. Dutch military intelligence reported the first cyber-sabotage attack by a Russian-aligned group on a control system in the Netherlands. France is unattributed and belongs to this class.
The wider campaign is accelerating. Danish intelligence said on 7 October that Russia had begun sabotage against Danish companies supplying Ukraine. German police logged hundreds of sabotage acts against critical infrastructure in a year, from the Vulkangruppe arson that blacked out Berlin in January to the rail fires claimed by “Kommando Angry Birds” in July, and Germany attributed the Leipzig/Halle drone attempt to Russia on 1 September. Dutch rail went down four days after NATO staged trains for the Russian front, while a US indictment shows Russian recruiters paying for sabotage from a price list. These are physical attacks, a different technique from France, carried out against the same group of countries supporting Ukraine. France sits in the middle ground between cyber and kinetic attack that threat frameworks still split in two, where a network command produces a physical result.
How to settle this
| Open question | What would answer it |
|---|---|
| Entry vector | An internet-exposed StoreView interface, or compromised provider and installer credentials. The answer separates opportunistic exploitation from supply-chain compromise. |
| Scan history | Archived Shodan and Censys records of French-geolocated AK-SM interfaces, matched against the victim list. |
| Independents | Whether butchers with no shared provider were hit. If they were, the product version is the common factor. |
| Other countries | Danfoss sites outside France. ANSSI says other countries may be affected and is checking with its European counterparts. |
| Ahold Delhaize | Whether its same-weekend incident shares anything beyond timing. Reports confine it to IT systems: Albert Heijn’s websites, deliveries, loyalty and shelf labels, and Delhaize’s online ordering in Belgium. |
| Claims | Any posting on dark-web forums or Telegram. |
| Vendor telemetry | Whether the affected units were cloud-managed or exposed standalone. |
| US parallel | Controller make and firmware at the commissaries hit in August, now in a FOIA queue. |
Spoiled food is a smaller harm than a grid outage, while the security problem ends up looking the same: physical equipment behind a network control left reachable, running software a year past its fix. The Cyber Resilience Act as it stands is for the controller. These chain stores with massive footprints, where the food spoiled from infrastructure-grade attacks, isn’t yet addressed as NIS2.
