French Supermarket Fridge Hack: Is the U.S. at Risk?

Hackers pushed refrigerators and freezers at hundreds of French supermarkets to as high as 50 degrees Celsius (122 degrees Fahrenheit) overnight into Monday, Oct. 12, forcing stores to throw out fresh and frozen food. At least 350 supermarkets were hit, Reuters reported, across Intermarché, Carrefour, Monoprix, Coopérative U and E. Leclerc. The fridges ran on control systems from Danish supplier Danfoss. Investigators have not said how the attackers got in.

Is the U.S. at risk? Short answer: the same controller lines are sold in the U.S., CISA flagged flaws in one of them in 2025, and about a dozen U.S. military commissaries had similar fridge failures in August. But no U.S. grocery chain has reported an attack, and no one has tied the commissary outages to France.

Which Chains Were Hit, by Source

Counts conflict and are still moving. Each figure below names who gave it and when.

Chain	Stores affected	Source, date
All chains	At least 350	Reuters, Oct. 13
Intermarché (Les Mousquetaires)	About 150, heated to 50 C for six hours	Company spokesperson to Reuters, Oct. 13
Intermarché (Les Mousquetaires)	Around 180	Company email to CNBC, Oct. 13
Intermarché and Netto	At least 300	Retailer statements to AFP, Oct. 12
Carrefour	80 of about 6,000	Carrefour to Reuters, Oct. 13
Monoprix	5% of about 490, roughly 25 (our estimate)	Reuters, Oct. 13
Coopérative U	80 of 2,000	CEO Dominique Schelcher to Reuters, Oct. 13
Coopérative U	More than 100	Retailer statement to AFP, Oct. 12
E. Leclerc	Several	Retailer statement to AFP, Oct. 12

The gap at Intermarché is the widest. AFP's figure, from Monday, covers Intermarché and Netto together; the lower figures came Tuesday from the parent group.

The Paris prosecutor's office opened an investigation into what it called a "large-scale" attack, citing food losses and fires, according to AFP as reported by CBS News.

What It Cost Stores

Schelcher put the loss at several tens of thousands of euros for a smaller store and up to 200,000 euros at a large hypermarket, Reuters reported. There is no official industry total.

What Danfoss and French Officials Said

Danfoss told AFP that most of the affected equipment was "legacy" products that "no longer receive software or security updates," and that its AK-SM800 and AK-SC355 systems were notably affected, with a version of the AK-SM800 on "outdated firmware."

A person close to Prime Minister Sébastien Lecornu told AFP that ANSSI, France's cybersecurity agency, had identified "a vulnerability in software supplied by a Danish company and has contacted the vendor." No one has said which vulnerability that is.

ANSSI's response team, CERT-FR, issued an alert on Oct. 12 citing "numerous compromises" of Danfoss AK-SM and AK-SC series controllers. A Tuesday update added XWEB systems from St. Louis based Copeland and its Dixell brand. It tells operators to take units off the public internet and warns that attacks are probably still under way.

The Patch Record, and Its Limits

Danfoss has published fixes for one controller line since March 2025. Its March 24, 2025 advisory fixed an authentication bypass in the AK-SM 8xxA series with version 4.2, and an Aug. 1, 2025 advisory fixed two more flaws with version 4.3.1. Those advisories cover the AK-SM 8xxA series only. They do not cover the AK-SC355, so this patch record may not apply to every affected unit.

Investigators have not tied the attack to any of these flaws. Reuters found at least 4,500 Danfoss interfaces viewable online on Tuesday.

Could This Happen at U.S. Grocers?

The U.S. Cybersecurity and Infrastructure Security Agency republished the AK-SM 8xxA flaws in an advisory first issued May 20, 2025, and updated Aug. 26, 2025. It says the controllers are deployed worldwide in commercial facilities and tells owners to keep control systems off the internet. We found no CISA or FBI statement on the French attack as of Tuesday.

The closest U.S. parallel came in late August. The French attacks resemble disruptions at about a dozen U.S. military commissaries that led to food losses, Reuters reported. Stars and Stripes confirmed outages at six commissaries plus a seventh reported elsewhere, and Military Times counted at least seven. At Fort Huachuca, Ariz., the base said all freezers went into defrost mode overnight and all frozen food spoiled. Army CID's Cyber Field Office and the Air Force Office of Special Investigations confirmed investigations, with the Defense Criminal Investigative Service taking the lead. The Pentagon acknowledged only a "possible refrigeration disruption," with no cause given. No one has linked those outages to France or named a vendor.

Danfoss case studies name two U.S. chains as customers. Those case studies are years old (Winn-Dixie 2014; Giant Eagle's describes a program from 2016), and they show only that Danfoss sold controllers to U.S. grocers. They say nothing about whether those stores still run the same equipment, which firmware it runs or whether it is reachable online. Neither chain has reported an incident, and no source suggests either was affected.

This is separate from the recent outage at Ahold Delhaize's U.S. chains; no source links the two. Defenders are also raising money. Watch for whether CISA adds guidance, whether Danfoss or Copeland publish affected model lists, and whether other countries report incidents.

Cover photo: Melting ice by Khamkéo on Unsplash, used under the Unsplash License.