French investigators were piecing together the scope of a planned cyber intrusion that handed unknown actors remote access to refrigeration systems spanning hundreds of shops, with no group or individual having stepped forward to claim responsibility. No explanation had come forward for those directing the inquiry, an individual with knowledge of the matter told journalists, adding that the case had so far produced neither a politically driven hacktivist claim nor any ransom demand from those with financial motives.
Such groups have at times converted breached data into revenue streams or publicised their operations to advance particular agendas. Three cybersecurity specialists, speaking to a broadcast news outlet, assessed that whoever carried out the temperature-manipulation attack on refrigeration units across Carrefour, Monoprix, Intermarché, and Coopérative U stores faced relatively few technical barriers in doing so.
At a number of Paris supermarkets, staff moved quantities of meat that had spoiled — along with frozen goods that had thawed — into large rubbish containers. Of the roughly 350 supermarkets drawn into the incident, that figure represented only a portion of France's broader retail network.
Cooling units involved in the incident ran on software developed by Danfoss, a company headquartered in Denmark. Danfoss disclosed on Monday that a portion of the affected devices had passed their operational lifespan and were no longer receiving software or security patches, while others were still running firmware that had not been kept up to date. The company's published guidance called on users to keep their systems running the most recent firmware releases and to move away from older hardware toward present-day product lines. No statement beyond an initial response was forthcoming from the organisation.
Security flaws affecting earlier releases of Danfoss firmware had been on record for several months before the matter drew wider attention. Vulnerabilities in the Danfoss AK-SM 800A controller — since addressed through patches — were laid out in a Claroty report dated August 9, with the firm noting that the flaws had left the door open for unauthorised access and remote code execution on affected devices.
The exact method used to gain access to the refrigeration units has not been made public. Cybersecurity professionals noted that the available evidence pointed toward an unsophisticated intrusion made possible by unpatched device software and interfaces left open to external network traffic. Ken Munro, a partner at Pen Test Partners, described the situation as a failure of foundational security practice, adding that the publicly documented nature of the vulnerabilities meant access had effectively been left open, and that the narrow scope of the incident — limited to a portion of refrigeration units in France — raised the possibility that those responsible were opportunistic rather than state-sponsored actors.
Using the internet-scanning tool Shodan, a news organisation tallied roughly 4,500 Danfoss control panels still open to external connections. The speaker placed that figure in broader context by noting that comparable exposure exists across devices in numerous other countries, and that the absence of any ransom note or follow-up contact raises the possibility that those behind the intrusion had not considered the operational harm their level of access represented to the operators of the affected systems.
Onyphe, an internet scanning firm based in France, found that the vast majority of affected devices had not been updated to the newest available version of the software, though no independent count of those running outdated builds was possible. According to Onyphe, a notable share of the internet-facing systems it examined were running software releases that had not been updated and remained open to known exploits.
