All incidents

Overnight on October 11 to 12, attackers remotely pushed refrigeration systems into defrost mode. Temperatures reached 50 degrees Celsius in some cold rooms, food was spoiled and some fires started. Affected chains include Intermarché, Carrefour (80 stores), Coopérative U, Monoprix and Netto, and reporting cites upward of 350 stores. Paris prosecutors opened a criminal investigation. France's CERT-FR said numerous remote controllers were compromised and on October 13 widened its alert from Danfoss AK-SM and AK-SC equipment to Copeland and Dixell XWEB devices. Danfoss said many affected units were end-of-life models it no longer patches, and others ran old firmware. Reported effects include defrost cycles stretched from about one hour to eight and delayed alarms, and some stores closed for a time. Authorities have not attributed the attack and no group has claimed it, and other countries may be affected. Forescout says a key open question is whether the attackers reached the controllers through individually exposed interfaces or through shared maintenance infrastructure. Other counts go above 500 stores: the Mousquetaires group (Intermarché, Netto) said 300 of its stores were hit and Coopérative U said 80. The Paris prosecutor's cybercrime section is leading the investigation with the national anti-cybercrime office. Claroty counted 2,765 exposed Danfoss controllers still online, and CERT-FR's October 13 update warned the attack campaigns were probably still active. A summary from Spain's INCIBE puts losses at tens of millions of euros.