Somewhere between 250 and 350 French supermarkets lost their cold chain on Sunday night.
Attackers raised the temperature inside refrigerators and freezers to as much as 50°C — 122°F — and held it there for roughly six hours, overnight, while the stores were empty. Staff arrived on Monday to destroyed stock across Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, Super U and Netto. The Paris prosecutor's office is investigating, and its statement includes three words that should stop you: "the outbreak of fires."
Here is the part almost nobody is leading with.
They did not break the fridges. They pressed defrost
The attackers did not invent a way to make a refrigerator heat up. They did not need an exotic exploit against the cooling hardware.
They reached the controllers that manage the refrigeration, and they triggered the automatic defrost cycle.
Defrost is not a bug. It is a designed, documented, entirely normal function that every commercial refrigeration system has, because evaporator coils accumulate ice and have to be cleared or the unit stops working. Every supermarket fridge in the world runs defrost cycles, usually several times a day, usually for a few minutes, usually while nobody notices.
The attack was to run that legitimate feature at scale, continuously, in the middle of the night.
This is why the story matters more than the comedy headline suggests. There is no patch for defrost. You cannot remove the function; the equipment does not work without it. The only thing standing between a working cold chain and a six-hour heat soak is who is allowed to send the command — which makes this, start to finish, an access-control failure rather than an engineering one.
And a fridge commanded to heat, packed with cardboard and plastic film and years of compressor grease, in a sealed room, for six hours, is a heating element. Hence the fires.
The warning is seventeen months old
Reporting points at Danfoss refrigeration controllers running older versions of the company's software. Danfoss has said, via secondary reporting, that the affected units were mostly legacy hardware on outdated firmware. A person close to the French prime minister told AFP that investigators had traced the problem to a vulnerability in software from a Danish company.
Now the timeline that should be in every account of this and is in almost none.
May 2025 — CISA publicly warns of an authentication bypass vulnerability, CVE-2025-41450, in the Danfoss AK-SM 8xxA series: the hardware platform used to manage refrigeration and HVAC in food retail.
August 2025 — CISA warns of a second flaw in the same family, a command injection bug, CVE-2025-41451.
Also August 2025 — Claroty's Team82, which found both, publishes a detailed write-up on chaining them to achieve remote code execution against AK-SM 800A management interfaces exposed on the public internet.
Say the important caveat clearly: nobody has confirmed that these are the flaws that were used. The method of compromise has not been established, and may not be for some time. It is entirely possible the route in was something else — stolen credentials at the service provider, for instance.
But the shape of the risk was described, publicly, by the US government, seventeen months ago, with a vendor patch available.
You could count the targets from a laptop
This is the number that turns a warning into an indictment.
On Monday, as the story broke, Predicta Lab chief executive Baptiste Robert ran the search. He found:
| Danfoss systems exposed on the public internet | 2,752 |
| Of those, in France | 1,590 |
| Danfoss devices tracked by Shodan | 4,500+ |
These are not obscure assets buried behind corporate firewalls. They are industrial control panels, reachable from anywhere, enumerable with a search engine built for exactly that purpose, in a sector that had been formally warned about this hardware a year and a half earlier.
Fifteen hundred and ninety of them in France, on the morning the French cold chain broke.
Six chains, one night — which tells you where the weakness was
Carrefour, Leclerc, Intermarché and Monoprix are competitors. They do not share IT. They were not all breached independently on the same Sunday.
Intermarché's own statement names the common point, carefully:
"Following a cyberattack reportedly affecting a service provider that manages refrigeration systems in stores, some fresh and frozen food display units are out of service."
If that holds, this is a supply-chain compromise: one contractor, or one class of equipment, sitting underneath an entire national grocery sector. The blast radius was not a company. It was an industry's shared plumbing.
Coopérative U president Dominique Schelcher, who confirmed the attack on his own network:
"Targeting equipment essential for preserving fresh produce and supplying food to the French people is an extremely serious matter and is unprecedented. It is unacceptable."
Christophe Hansen, the EU's agriculture and food commissioner, condemned the attack and named Leclerc — France's largest chain — among the victims. That is a European commissioner intervening over supermarket refrigerators, which is itself a measure of how this is being read in Brussels.
The regulatory hole underneath all of this
Here is the structural point, and it is not about France.
Energy networks, water utilities and telecoms are designated critical national infrastructure nearly everywhere in Europe. That designation brings obligations: mandatory incident reporting, security baselines, regulatory oversight of exactly the kind of internet-exposed control systems described above.
Food retail generally is not.
So the systems that keep a nation's perishable food cold — across thousands of sites, managed remotely by third-party contractors, running industrial controllers with published CVEs — sit largely outside that regime. They are treated as a commercial matter for the grocer.
One Sunday night just demonstrated what that assumption is worth. Nobody was hurt and nobody went hungry, because France has slack in its food system and the chains could throw the stock away. The interesting question is what the same six hours would have done in a country with less slack, or applied to cold-chain pharmaceutical storage, or run for sixty hours instead of six.
What is not known
Who did it. No group has been identified and none has claimed it. No attribution has been offered by French authorities.
Why. No ransom demand has been reported. That absence is notable — a purely destructive attack with no extortion attached reads differently from ransomware, but it is far too early to draw a conclusion from a silence one day old.
How they got in. Unestablished, despite the convenient fit of the published CVEs.
And whether it is finished. Separately, and with no evidence of any connection, the global food retailer Ahold Delhaize took some systems offline on Monday after what it described as a cybersecurity incident. That may well be unrelated. It is being watched.
What to watch
Whether the anti-cybercrime office attributes the intrusion, and whether CVE-2025-41450 or -41451 turn out to be the route. Whether those 1,590 exposed French systems drop sharply this week, which would be the single clearest measure of whether anyone has learned anything. Whether any ransom demand surfaces. And whether France or the EU moves to pull food retail's control systems inside the critical-infrastructure perimeter, which is the only response that would outlast the news cycle.
This is a developing story. Store counts vary between sources and are provisional. The method of compromise has not been established, and the vulnerabilities referenced above are published flaws in the hardware family involved rather than a confirmed attack route. No individual or group has been identified or has claimed responsibility.
