Cyberattack hits supermarket refrigeration in France, Belgium and the Netherlands
Hackers forced European supermarket fridges into 50°C defrost; ~400 French stores were affected and Albert Heijn went offline in the Netherlands.
Starting Sunday afternoon, October 11, the Dutch supermarket chain Albert Heijn — together with its group siblings Etos and Gall & Gall — took its websites, apps and customer service offline as a precaution and cancelled every online order already placed. Overnight into Monday, roughly 400 stores across five French chains were affected, per tallies the BBC gathered from individual chains; across those chains, refrigerators were remotely forced into continuous defrost at 50°C — Intermarché said its cabinets sat at 50°C for six hours, where a normal defrost runs about two hours a day, per Tom’s Hardware. The direct losses in this attack are food on the shelves, not rows in a database.
Key points
- About 400 of France’s roughly 15,000 stores were affected across five chains: 180 Intermarché/Netto stores hit plus about 100 disconnected as a precaution, more than 100 at Coopérative U, 80 at Carrefour, 5% of Monoprix’s estate, and E.Leclerc named without a count (BBC, Oct 12).
- Two supermarkets in the Alsace region reported a combined €270,000 in losses, with the national total estimated in the millions; small fires broke out at some stores, and the Paris prosecutor’s office opened a cyber-crime investigation.
- On August 9, Claroty Team82 published flaws in the same AK-SM 800A controller platform — a hidden “day code” authentication bypass (CVE-2025-41450, CVSS 8.2) and post-auth RCE (CVE-2025-41451, CVSS 7.6) — when Censys counted 2,765 devices exposed to the internet.
Background
The reason freezers can be commanded remotely at all is the retail refrigeration platform they hang off: Danfoss’s AK-SM 800A controllers are how retailers manage cold equipment across stores. That is the system Claroty Team82 took apart in “Freeze the Controller, Defrost the Food,” published August 9. The authentication bypass lives in a hidden vendor-support path: the getauth handler in xml.cgi accepts a “code of the day,” and the device validates it against a password generated internally from its own current date and time. Team82 reverse-engineered the algorithm, so anyone can compute the day’s valid code and walk away with a full administrative session. One step further is CVE-2025-41451: an unsanitized SMTP email password field that allows command injection after authentication, and CVE-2025-41452 tweaks the Nginx configuration to manipulate traffic and crash the web service on demand.
Danfoss shipped fixing firmware R4.3.1 and advisory DSA-2025-08-01 before the research went public — a textbook coordinated disclosure. At publication, Censys counted 2,765 AK-SM 800A units exposed directly to the internet. The research never demonstrates a forced defrost: what it yields is an admin session, and that console is the same system retailers use day to day to run refrigeration, temperature settings included. The disclosure pipeline itself has been rocky lately — Google just froze its open-source bug bounty over a flood of useless AI-generated reports (Google froze its OSS bounty) — which makes a clean researcher-vendor handoff worth noting.
The facts
In France, the attack played out overnight into Monday, October 12: staff arrived to warm freezers. Intermarché reported cabinets holding at 50°C for six hours; a BFMTV image showed an ice-cream freezer reading 26.5°C. Small fires broke out near some units. The affected footprint, per the BBC:
| Chain | Affected | Source |
|---|---|---|
| Intermarché / Netto | 180 stores hit, ~100 more disconnected as a precaution | BBC (Oct 12) |
| Coopérative U | More than 100 stores | BBC |
| Carrefour | 80 of 6,000 stores | BBC |
| Monoprix | 5% of its 400-plus stores | BBC |
| E.Leclerc | Named, no store count given | BBC |
| Albert Heijn / Etos / Gall & Gall | Sites, apps, customer service offline; all online orders cancelled | Official statement |
| Delhaize (Belgium) | Reported disruption | NOS, via Tom’s Hardware |
Loss figures come in two flavors: the BBC reports the two Alsace stores at €270,000 combined, while Tom’s Hardware passes along La Dépêche’s early estimate of “approaching €300,000.” Both outlets expect the national total to reach into the millions of euros, before counting the discarded food.
In the Netherlands, Albert Heijn’s own media statement is precise about the mechanics: since Sunday afternoon the company has faced a cybersecurity incident and preemptively shut down systems to protect its IT environment. Websites, apps and customer service are unavailable; every placed online order was cancelled, with paid orders compensated once systems return. Physical stores stayed open and checkouts work, and this week’s national Bonus offers remain valid. Personalized discounts and savings programs such as Koopzegels and AirMiles are unavailable, with customers asked to keep receipts for later compensation. One easily misread detail is in the statement too: electronic shelf tags stayed on last week’s promotional prices, so a shelf price can sit below the checkout price — a side effect of the shutdown, not a claimed tamper. Logistics systems were cut as well, hitting deliveries (per NOS, via Tom’s Hardware).
Whether the French and Dutch incidents share attackers remains unconfirmed: Albert Heijn calls its event a “cybersecurity incident” with no attribution, and Tom’s Hardware states outright that it is unclear whether the two are related.
What others say
Christophe Hansen, the European Food Commissioner, wrote on X: “Food security requires more attention at all levels. Because the weaponisation of food has become a reality.”
Dominique Schelcher, CEO of Coopérative U, called the attack extremely serious and unprecedented. The Paris prosecutor’s office described a “large-scale cyber-attack affecting the refrigerators of several major food retail chains across France” and opened a cyber-crime case.
Danfoss told the BBC that the affected units were older models whose security software could not be updated to the fixed version, that it has long advised customers to keep supported systems current, and that “reliable refrigeration is critical to our customers’ operations.” It did not confirm how warm the units could be set. Albert Heijn’s statement never uses the word attacker and never merges its incident with the French freezer attacks.
Our take
For anyone building connected hardware or retail systems, this sample puts three things on the table. First, no derivable secrets in authentication: a day code computed from date and time is a password printed on the device’s own clock. Second, hardware needs a patch lifecycle — Danfoss says the hit units were legacy models that could not be upgraded, and for retail equipment bought on multi-year cycles, that sentence is a risk register. Third, someone has to watch the exposed-device count: 2,765 units sat on the public internet, and the attack arrived two months after the research.
A patch sitting in the repo, devices left exposed, then the incident — the same script as the Zimbra flaw exploited in the wild, except this time the losses are measured in tons, inside freezers.
What cannot be concluded yet: who the attackers are, whether CVE-2025-41450 or CVE-2025-41451 were actually used, and whether the French and Dutch cases share a source — a matching timeline is only a matching timeline. Worth watching: the Paris investigation, Albert Heijn’s system restoration, and whether Danfoss widens the DSA-2025-08-01 fix to another round of firmware.