How a cyberattack on Danfoss refrigeration controllers hit hundreds of French supermarkets

A cyberattack on the refrigeration controllers of hundreds of French supermarkets forced defrost cycles overnight on 11 and 12 October 2026, warming cold rooms and display cases for about six hours, up to 50°C. That was the account Les Mousquetaires, owner of Intermarché and Netto, gave Bloomberg, according to The Next Web. Meat, frozen goods and vegetables went in the bin.

On 12 October CERT-FR, the incident response team of France's national cybersecurity agency (ANSSI), issued alert CERTFR-2026-ALE-012 about numerous compromised remote controllers for refrigeration plant. A day later it extended the list, which covers Danfoss's AK-SM and AK-SC series and the xweb consoles from Copeland and Dixell. Nobody has claimed the attack. A source in the prime minister's office told Reuters that ANSSI had identified a vulnerability in Danfoss software, without saying which one.

What happened in the French supermarket cyberattack?

The cyberattack of 11 and 12 October 2026 hit 150 Intermarché stores, 30 Netto stores and 80 of Carrefour's 6,000, according to the retailers quoted by Infosecurity Magazine. Groupe Casino put the share of affected Monoprix stores at about 5% and said none of its other brands was hit. AFP put the Intermarché and Netto count at no fewer than 300 stores. Coopérative U, the group behind Super U and Hyper U, said fewer than 100 of its stores were affected, and its chief executive, Dominique Schelcher, called the attack "extremely serious and without precedent" on X, according to Euronews.

Thierry Cotillard, Intermarché's chief executive, expects losses of tens of millions of euros across France in a single day, Reuters reports. In Haguenau, in Alsace, an Intermarché and a Super U lost €270,000 of stock, BFMTV reported. Leclerc and Auchan, named by some outlets, have not confirmed being hit.

The Paris prosecutor's office opened an investigation on its own initiative and assigned it to the national cybercrime office (OFAC). According to Euronews, citing AFP, the inquiry aims to identify the victims and link the attack to the lost stock and to the small fires some stores reported. Intermarché warned through AFP that insurance policies might not cover an incident of this kind.

Prime Minister Sébastien Lecornu instructed ANSSI to investigate, and France is coordinating with European counterparts because other countries may also be affected, according to Reuters. Félix Aimé, an analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been hit, without naming victims. The EU food commissioner, Christophe Hansen, condemned the attack on X.

How can attackers reach a refrigeration controller from the internet?

Central refrigeration managers such as Danfoss's AK-SM family include a web interface and remote access so that a technician can deal with alarms without travelling. If that interface is published on the internet, outsiders can reach it too. A mid-sized supermarket runs dozens of display cases, cold rooms and compressor racks, each with its own regulator. Above them, the manager collects temperatures, alarms, setpoints and defrost cycles, as Claroty describes.

Particularly in France, that manager is often supervised remotely by the company that maintains the installation. The Hacker News places the attack at that controller, which maintenance firms can manage remotely.

How many Danfoss AK-SM controllers are exposed online?

On 13 October 2026 SOCRadar found 4,481 Shodan results for the Danfoss web interface worldwide, 2,898 of them in France. Shodan counts services, so a single device can appear several times. In Censys the French figure falls to 881 unique devices.

In August 2026 Claroty's Team82 had counted 2,765 AK-SM 800A interfaces reachable from the public internet with a Censys search. CERT-FR describes exposing a management interface online as contrary to good practice. Exposure signals risk but does not prove a device has been compromised.

Which affected Danfoss models are out of support?

Danfoss says most of the units hit were older models, the AK-SM 800, end-of-life since May 2021, and the AK-SC 355, phased out in 2016. Some current AK-SM 800A units running outdated firmware were also affected. The company told Reuters it was aware of incidents in France affecting "a limited number" of systems. It told Cooling Post it was working with customers on firmware updates where available, stronger network protection and removing direct internet exposure.

Fixes for the AK-SM 800A existed before the attack. Claroty disclosed three vulnerabilities on 9 August 2026. CVE-2025-41450 is an authentication bypass based on a hidden "code of the day" mechanism that derives the admin password from the date. CVE-2025-41451 is a command injection that allows code execution after authentication, and CVE-2025-41452 enables denial of service. Danfoss fixed the first in firmware 4.2 and the other two in 4.3.1.

Futura attributes the intrusion to that admin account with a date-derived password, and BFMTV reported that the targeted software predated version 4. No official source has confirmed that flaw as the way in.

Can a legitimate account trigger a defrost without an exploit?

An account with the right permissions can change a setpoint or a defrost cycle without exploiting any flaw, because that is routine administration. "Defrost isn't an exploit; it's functionality," Joshua Steinman, chief executive and co-founder of Galvanick, told Industrial Cyber.

How does the refrigeration contractor connect to the controllers?

Refrigeration contractors receive each store's alarms and telemetry and connect remotely to fix faults. CERT-FR advises checking the terms of the insurance contract before cutting that data feed over the internet.

According to an employee quoted by Je Bosse en Grande Distribution, every store whose temperatures were supervised through the Danfoss platform was affected. In Spain, industry sources consulted by El Confidencial Digital say outsourcing remote refrigeration control is uncommon and that separating external service networks from internal ones is standard practice.

Have supermarket refrigeration systems been attacked before?

A Danfoss newsletter from October 2025, cited by The Hacker News, mentions attacks in 2022 on 16 Russian supermarkets and unauthorised access to 40 Israeli stores, none of them with an adequate firewall or VPN. The newsletter identified no vulnerability. Reuters also links the case to refrigeration failures at about a dozen US military commissaries in late August.

Claroty's research also covered Copeland. According to Refindustry, Team82 found 23 vulnerabilities in the XWEB Pro platform, 21 of them high severity, including an admin credential derived from the date, the MAC address and hard-coded keys. In one lab test the researchers spoofed the displayed temperature. In another they switched off a controller's fans while the screen kept showing the legitimate reading. Copeland fixed the flaws in firmware 1.13, and the xweb family is the one CERT-FR added to its alert on 13 October.

The French case hit hundreds of stores in a single night. Futura reports no data theft and no ransom demand.

Why do EDR and SIEM miss attacks on refrigeration controllers?

The refrigeration manager usually sits outside the IT inventory, because facilities or construction buys it, a third party installs and maintains it, and its remote access is agreed in the service contract. It cannot run an EDR agent, seldom sends logs to the SIEM, and its alarms ring on the on-call engineer's phone, not in the security operations centre. The same applies to the network devices we covered in our article on EDR blind spots.

The attacker's command matches a daily operation, and a control that looks for malware or known signatures will not flag a changed setpoint. Claroty's tests on Copeland also show that the manager can be made to display false readings.

Which signs reveal tampering with a refrigeration controller?

Detecting tampering with a refrigeration controller requires evidence of who reached it, what they changed and whether that change belonged there, according to Joshua Steinman of Galvanick. These checks provide that evidence:

• An external scan of each store's and warehouse's IP addresses finds the refrigeration, HVAC and building management interfaces that answer from the internet. Continuous attack surface management repeats it every week.
• Temperature probes from a system separate from the manager alert the company's own staff if the manager fails or is compromised, as SOCRadar recommends.
• The log of changes to setpoints, defrost schedules and users is reviewed with attention to changes made overnight or outside the contractor's windows.
• Each console login is matched against the addresses and time slots agreed with the contractor, and access from anywhere else means calling the contractor immediately.
• The manager should only talk to the contractor's VPN concentrator and the local regulators, so a direct inbound connection from the internet is an alert in itself.

What does CERT-FR advise in alert CERTFR-2026-ALE-012?

Alert CERTFR-2026-ALE-012 asks owners to disconnect uncompromised refrigeration managers from the internet, along with any other unit with a public IP. It also asks them to review the whole configuration, with attention to defrost settings, and to allow access only through a secure VPN or protected network. It then points to the manufacturer's good practice, which for Danfoss means current firmware, the "Strict" security level and changed default passwords. Filtering the contractor's IP addresses at the firewall is accepted only as an emergency measure.

If the device is compromised, a factory reset and full reconfiguration are added before it goes back into service. CERT-FR warns that the reset removes persistence but leaves the vulnerability in place. An unsupported device that stays exposed is very likely to be compromised again, and CERT-FR says attack campaigns are probably still under way.

For the AK-SM 800A, The Hacker News says the upgrade has to go from the 3.x branch to 4.x before reaching 5.3.x, and that 5.3.x cannot be downgraded. From version 4.0, strict session control, which enforces HTTPS, is enabled by default.

What should a refrigeration maintenance contract require?

The contract with the refrigeration contractor should set out how it connects, with a VPN and multi-factor authentication, named accounts, session logging and advance notice of out-of-hours work. This is third-party risk management applied to a supplier that, in our experience, seldom comes before the security committee. The store network should isolate refrigeration from other systems, following the criteria in our guide to internal network segmentation.

The AK-SM 800 and AK-SC 355 will receive no more fixes, so replacing them is a capital item that needs a date in the renewal plan. The cyber insurance policy should make clear whether it covers product destroyed by an attack on systems a third party manages. The incident response plan should set out who decides overnight whether stock is thrown away or moved, with the food quality lead in the alert chain.

Does NIS2 apply to supermarkets?

NIS2 Annex II covers the wholesale distribution of food and its industrial production and processing, and leaves retail out, as the Finnish Food Authority explains. The criteria apply to the company's business as a whole, so an entity with wholesale activity can fall within scope even if it also runs stores. Whoever owns NIS2 compliance should confirm it case by case.

Could a similar attack hit retailers outside France?

No retailer outside France had confirmed an incident linked to the attack as of 14 October 2026, although Sekoia places victims in five other European countries. Ahold Delhaize reported a security issue and took systems offline, but said there was no reason to link it to the French attack, according to Reuters.

Claroty had disclosed the AK-SM 800A flaws in August, Danfoss had retired the older models years earlier and connected-device search engines listed them openly. Facilities buys the equipment, the contractor runs remote access and IT does not have it in its inventory, so thousands of interfaces were left online with nobody responsible for their security.

Companies with physical sites run similar equipment, such as HVAC, access control, generators and warehouse cold rooms, and in retail there can be dozens per store. The first task is to find out which devices of this kind answer from the internet on the company's IP addresses today. That list then sets the order for contracts, replacements and the industrial cybersecurity programme.

Sources and attribution: this analysis draws on alert CERTFR-2026-ALE-012, Claroty Team82's research and coverage by Reuters, AFP, The Hacker News, Infosecurity Magazine, Euronews, Industrial Cyber, SOCRadar, Futura and the other outlets cited in the text. It reflects the information available on 14 October 2026.

Store counts and losses come from the retailers or the press and may change. The entry point has not been officially established, and citing a product or vulnerability does not mean it was used in this attack. No mention implies a security flaw in the products cited if the vector turns out to be access abuse or misconfiguration.

Technical notice: the measures described are indicative and depend on the model, firmware version and maintenance contract of each installation. Changes to remote access, firmware or the configuration of a refrigeration controller should be coordinated with the contractor and planned so as not to put the cold chain at risk.