Shop staff across France arrived on Monday 12 October to find freezers warming up instead of keeping food cold.
Overnight, attackers had got into the systems that run supermarket refrigeration and, according to French media, set them to defrost for hours. One store said it had to throw away all of its fresh products, butcher's counter included.
It's an unusual attack, but the weakness behind it is very ordinary: a box on the wall, connected to the internet, running old software, that nobody thought of as "IT".
What happened
Overnight from Sunday 11 to Monday 12 October, refrigeration systems in stores run by several of France's biggest grocery chains were hit, Infosecurity Magazine reported. The chains gave these figures to the press:
Intermarché said 150 stores were affected (Infosecurity Magazine); it gave AFP a range of 150 to 200 (IT-Connect).
Carrefour said the incident "primarily affected 80 out of our 6000 stores".
Monoprix owner Groupe Casino said 5% of its Monoprix supermarkets were affected, and Coopérative U reported fewer than 100 stores.
French broadcaster BFMTV put the total at around 400 stores, Cybernews reported. The counts differ between outlets and the story is still developing.
According to BFMTV, attackers remotely triggered the defrost cycle and left it running, with some systems set as high as 50°C. Two supermarkets in Alsace reportedly lost €270,000 of stock between them. The Paris prosecutor's office has opened an investigation, including into a reported outbreak of fire, and France's national cyber agency ANSSI is reportedly coordinating with European counterparts on risks in other countries.
How do you hack a fridge?
The affected controllers are made by Danish firm Danfoss. Danfoss said the targeted models were either obsolete (AK-SM800, AK-SC355) or not updated (AK-SM800A), according to Infosecurity Magazine. There's no confirmation that Danfoss itself was breached. The problem appears to be older controllers in stores that could be reached remotely without a properly secured connection.
The warning came in August
In August, researchers at Claroty Team82 published three flaws in Danfoss's AK-SM 800A system manager. The worst, CVE-2025-41450, was a hidden "code of the day" login that worked from a password based on the date rather than the admin password. Danfoss fixed the flaws in firmware R4.3.1. Team82 counted 2,765 of these controllers visible on the internet in a Censys scan, while a Shodan scan on 19 August found 3,726, Infosecurity reported. Nobody has confirmed that these specific flaws were used on 11 October. But it shows how long known weaknesses can sit in kit that rarely gets looked at.
It's not just fridges
The NCSC has warned that internet-connected business devices widen the attack surface, with "cyber security often being an afterthought", and that attackers exploit default passwords, missing updates and poor configuration (NCSC). Printers, CCTV, door entry and heating controls belong to the same family. The NCSC also notes that some organisations "do not have processes in place to monitor and manage" whether these devices are still supported.
Old passwords matter too. In 2019 a former employee of a Dutch refrigeration contractor was jailed for four months after using passwords that were still valid to change the temperature settings at a supermarket (Cooling Post).
What this means for UK small businesses
No UK stores have been reported as affected. But UK cafés, butchers, pubs, convenience stores and food producers rely on the same kind of equipment: refrigeration, heating, alarms and cameras, often looked after by an outside contractor with remote access so they can check in without a visit. That's convenient, and it's fine when it's set up properly.
The risk is when that remote access is a login page open to the whole internet, protected by a default or shared password, on software nobody has updated since installation. The UK's smart device law has banned easily guessable default passwords since April 2024, but it's aimed at consumer products such as smart speakers and doorbells (NCSC), so don't assume the commercial kit in your back room is covered. For a small food business, one night of warm fridges can mean binning a week's stock and losing a day's trading.
What to do this week
List what's connected. Walk round and note anything with a network cable or Wi-Fi: fridge and freezer controllers, heating, CCTV, alarms, door entry, printers. Ask your contractors what they've connected on your behalf.
Ask your engineer three questions. Can this be reached from the internet? Is the software up to date and still supported? Who has the password, and is it unique to us?
Close the front door. Control screens shouldn't be open to the whole internet. Claroty's advice is to restrict admin access to trusted networks or a VPN. Ask your supplier to do the same, with multi-factor authentication if it's offered.
Change default and shared passwords. Do it now, and again whenever a contractor changes or a member of staff leaves.
Keep a simple backup check. Claroty's research showed a compromised controller could switch off cooling while showing normal temperatures. A standalone fridge thermometer and an out-of-hours alarm mean you'll notice if the screen says "fine" but the food isn't.
Sophia Says
"What strikes me about this one is that nobody in those stores did anything wrong on Sunday night. The weak spot was a box on the wall that had quietly done its job for years, probably set up by a contractor and never thought of as a computer. Most small businesses I look at have at least one of these: a CCTV recorder, a heating controller, a router login page. They don't feel like IT, so they never get updated."
"That's exactly the kind of thing HackRisk is built to catch. I look at your business from the outside, the way an attacker would, and flag login pages, control panels and devices you've left visible to the internet, plus outdated software with known flaws. I explain what I found in plain English, who probably needs to fix it, and I keep checking, so a forgotten box doesn't stay forgotten."
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Control panels open to the internet: a Recon Scan maps your external footprint, so a forgotten login page or device doesn't hide in a corner.
Old firmware with known flaws: our Vulnerability Scan spots outdated, unpatched services you expose to the internet and ranks them by risk.
Contractors with remote access: Supply Chain Risk monitoring shows whether the suppliers you rely on have exposed weaknesses of their own.
Leaked passwords: a Dark Web Scan checks whether logins linked to your business are circulating among criminals.
Get your free HackRisk report
Not sure what your business has left visible on the internet? Get your free HackRisk report and Sophia will show you what an attacker can see, in plain English, with clear next steps.