Aussie food fears after cyberattack hits store fridges in France and beyond
A coordinated cyberattack has forced refrigeration systems at hundreds of supermarkets across France and several European countries to overheat to 50C, causing fires, massive food spoilage and estimated losses in the tens of millions of euros.
The Paris prosecutor's office confirmed the large-scale attack targeted connected refrigerators at major food retailers across France, with damage including significant food losses and multiple fires. French Prime Minister Sebastien Lecornu has ordered the National Cybersecurity Agency ANSSI to investigate the incident.
France's cybersecurity agency ANSSI, which employs approximately 600 to 800 cybersecurity professionals and operates with a budget of around €100 million, is coordinating with European counterparts as the attack has affected retailers in Spain, Portugal, Poland, Germany and Belgium.
Exploiting publicly disclosed vulnerabilities
The attack exploited vulnerabilities that had been publicly disclosed months earlier. Security researchers from Claroty Team82 presented their findings at the DEF CON security conference in Las Vegas on August 9, 2026, identifying critical flaws in Danfoss refrigeration controllers. The vulnerabilities included CVE-2025-41450, an authentication bypass flaw rated 8.2 on the severity scale, and CVE-2025-41451, a command injection vulnerability enabling remote code execution.
Researchers discovered approximately 2,752 Danfoss refrigeration systems exposed on the internet at the time of the attack, with 1,590 located in France. Global scanning services tracked over 4,500 Danfoss devices accessible online worldwide, highlighting the scale of potential exposure.
Major retailers suffer massive losses
Major French retailers suffered significant damage. Carrefour reported 80 stores affected, while Monoprix confirmed five percent of its roughly 490 stores were hit. Les Mousquetaires, which operates the Intermarche chain, said hackers heated fridges at approximately 150 stores to 50C for six hours overnight by switching refrigerators and freezers to defrost mode.
Intermarche chief executive Thierry Cotillard told BFM TV the attack would result in losses amounting to tens of millions of euros nationwide in a single day. All compromised food has been discarded to eliminate health risks.
Paris resident Geert de Clercq witnessed staff at a central Paris Intermarche throwing cartfuls of defrosted frozen foods into giant rubbish containers, with molten ice cream sloshing from broken tubs onto the street.
Cooperative U chief executive Dominique Schelcher described the incident as unprecedented.
Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity
Outdated systems left vulnerable
ANSSI investigators identified the vulnerability in software supplied by Danish company Danfoss, which holds a market-leading position in European industrial refrigeration with over 8 percent market share. Founded in Denmark in 1933, Danfoss serves customers in more than 100 countries and is one of the world's largest manufacturers of refrigeration and HVAC equipment.
Danfoss confirmed it was aware of incidents affecting a limited number of refrigeration management systems in France. The company stated the affected units were running outdated firmware and had long advised customers to keep systems updated with the latest firmware.
The company had released firmware version R4.3.1 in August 2025 to address the vulnerabilities, advising operators of affected AK-SM 800A controllers to upgrade. However, Danfoss stated that most French supermarket fridges involved in the hack were legacy units running outdated firmware that no longer receive security updates.
The attack highlights a growing trend in operational technology cyberattacks. Unlike traditional IT systems that handle data, operational technology systems control physical processes, meaning cyberattacks can have devastating real-world consequences including physical damage, facility shutdowns and risks to public safety. Nearly 70 percent of industrial firms experienced an operational technology cyberattack in 2023, with over 500 sites worldwide compromised that year, causing damages ranging from 10 to 100 million dollars in some cases.
Similar incidents in the United States
The French attack bears striking similarities to incidents at approximately a dozen US military commissaries in late August that led to food losses after refrigeration systems were affected. The Fort Huachuca military commissary in Arizona reported an overnight equipment failure on August 26-27, 2024, that put every commissary freezer into defrost mode. The power remained on throughout the incident, and the defrost cycle damaged frozen inventory, distinguishing it from a normal outage caused by a failed compressor or power loss.
Multiple military installations reported problems within roughly the same period, though US authorities have not officially confirmed whether the incidents were cyberattacks.
Australian retailers respond
In Australia, major supermarket chains are reviewing their refrigeration systems following the European attacks. Aldi confirmed a small portion of its network uses Danfoss equipment and is working to ensure its fridges are protected against similar attacks.
Woolworths stated its refrigeration systems are not connected to external networks, reducing potential exposure to internet-based attacks.
Christel Delberghe, director general at European retail association Eurocommerce, said the incident underlines the importance of resilience across the entire supply chain. The attack comes as retail sectors face escalating costs from increasingly sophisticated cyberattacks, with the average global data breach cost reaching 4.88 million dollars in 2024, marking a 10 percent increase from the previous year.
Supermarket cold aisles typically operate through control panels that manage an entire store's fridges and freezers and can be accessed over the internet, allowing maintenance companies to adjust them remotely. This connectivity, while operationally convenient, creates potential vulnerabilities when systems are not properly secured and updated.
Dutch supermarket operator Ahold Delhaize, which operates the Netherlands' largest supermarket chain Albert Heijn and has major US operations, reported a separate security issue in its network and took several systems offline as a precaution. Physical stores remained open, though online delivery services were temporarily disrupted. The company said there was no reason to link its incident with the attacks on French supermarkets.
