Hacked supermarket fridges: what we know about the cyberattack that hit hundreds of French stores

Overnight from Sunday 11 to Monday 12 October 2026, attackers took remote control of the refrigeration systems of several hundred French supermarkets. In the morning, staff found freezers warming instead of cooling. Part of the fresh and frozen food had to be thrown away, and the Paris prosecutor’s office also mentions fires. Here is what we know, what remains uncertain and what the French cybersecurity agency recommends.

Table of contents

What happened

Intermarché told AFP that 150 to 200 of its stores were hit, and Coopérative U fewer than 100. Its chief executive, Dominique Schelcher, called the attack unacceptable, according to Sud Radio. E.Leclerc, Carrefour Market and Monoprix stores are also named, but not all of these chains had confirmed it when the first articles appeared.

The overall toll varies widely by source. Le Monde Informatique, citing BFMTV, speaks of about 400 stores in total. Finance Minister Roland Lescure mentioned about 700 stores out of the country’s roughly 10,000 supermarkets, as reported by SecurityWeek. None of these figures is consolidated to date. At Intermarché, stores discarded all the affected fresh and frozen products, without the chain putting a figure on the loss. It says its insurance does not cover this type of incident.

How the attack worked

The scenario described so far, with an unconfirmed intrusion method

According to BFMTV, the attackers remotely changed defrost settings and forced cycles that pushed temperatures up to 50 °C. According to Le Monde, defrost cycles were extended from one hour to as many as eight, which delayed alarms, as explained by SecurityWeek. At one Intermarché store, equipment reportedly ran at 50 °C for six hours. These details come from the press, not from an official statement.

How the attackers got in is not established. CERT-FR does not tie the compromises to any specific vulnerability, and no group has claimed the attack or demanded a ransom.

The equipment targeted

On 12 October, CERT-FR reported numerous compromises of Danfoss AK-SM and AK-SC series controllers. Its alert was updated on 13 October to add Copeland xweb and Dixell xweb systems, as written by SecurityWeek.

Danfoss AK-SM 800: support ended in May 2021, no more patches.
Danfoss AK-SC 355: discontinued since 2016, also without patches.
Danfoss AK-SM 800A: still supported, but some of the units hit were running outdated firmware.
Copeland xweb and Dixell xweb: added to the alert on 13 October. An E.Leclerc store in the Tarn was reportedly hit overnight on 12-13 October through its Dixell equipment, according to Tom’s Guide.

Danfoss attributes the incident to obsolete or non-updated equipment and recommends renewing the installed base. That is the manufacturer’s reading, not the result of an independent investigation.

On the research side, Claroty’s Team82 had published flaws in the Danfoss AK-SM 800A on 9 August: an authentication bypass (CVE-2025-41450, CVSS 8.2), a post-authentication command injection (CVE-2025-41451, 7.6) and an Nginx directive injection leading to denial of service (CVE-2025-41452, 5.4). A fix exists in firmware R4.3.1, but sources disagree on which release fixes the first one, according to Claroty. Claroty’s CTO himself declined to link these flaws to the French attacks, and no one has done so to date.

From Claroty’s research to the drop in exposed devices

Thousands of interfaces exposed to the Internet

On 11 October, Censys counted nearly 3,000 Danfoss StoreView control panels reachable from the Internet, over 1,800 of them in France. By the 14th, the French count had fallen to 537, while other countries barely moved. Censys sees operators disconnecting equipment rather than patching it, as noted by SecurityWeek. One researcher had counted 2,752 Danfoss systems online, 1,590 of them in France, in a post on X dated 12 October, which Tom’s Guide did not verify, according to Tom’s Guide.

Sekoia said stores in Spain, Portugal, Poland, Germany and Belgium were also affected, without giving details. Separately, Ahold Delhaize took systems offline on 12 October after a “cybersecurity incident”, but the Dutch NCSC sees no link to this attack.

The investigation and official reactions

The Paris prosecutor’s office opened an investigation led by the anti-cybercrime office (OFAC), aiming to identify all victims and link the attack to the reported losses and fires. According to the Prime Minister’s office, Sébastien Lecornu asked ANSSI to take up the matter. The agency is supporting victims and coordinating with European counterparts, as detailed by Le Monde Informatique. The link between the fires and the attack is not yet established.

What to do if you run refrigeration installations

CERT-FR considers that attack campaigns are probably still ongoing. Its guidance, relayed by several outlets, including Refindustry and Tom’s Guide:

Remove direct Internet exposure of management interfaces, including other units with public IP addresses. For CERT-FR, exposing them directly is contrary to best practice.
Use a secure VPN or protected network for remote maintenance. Filtering by service provider IP address is only an emergency measure.
Check the whole configuration, especially defrost schedules.
Apply manufacturer patches and guidance: on Danfoss units, enable strict security mode and change default passwords.
For a compromised unit: remove exposure, factory reset, reconfigure, then restore access over a secure connection. On end-of-life hardware a reset is not enough: it clears persistence mechanisms but not the flaw.
Check your insurance terms before cutting data transmission to your service providers.

And if you are not directly affected?

If you don’t run stores, there is nothing to do, but the case highlights a general risk: industrial and building equipment, often old and designed for remote maintenance, is directly reachable from the Internet. When such equipment is no longer patched by its manufacturer, the only protection is to take it off the public network.

Sources: SecurityWeek, Tom’s Guide, Le Monde Informatique, IT-Connect, Sud Radio, Refindustry and Claroty Team82.

Frequently asked questions about the supermarket refrigeration cyberattack

Which stores were hit?

Intermarché (150 to 200 stores according to the chain) and Coopérative U (fewer than 100) confirmed it. Other chains are named, but the total, from 400 to 700 stores depending on the source, is not consolidated.

Who is behind the attack?

Unknown. No group has claimed it and no ransom was demanded. The Paris prosecutor’s office is investigating.

How did the attackers get in?

The method is not established. CERT-FR does not tie the compromises to a specific flaw, and the flaws Claroty published in August have not been linked to the attack.

Which equipment is affected?

Danfoss AK-SM and AK-SC controllers, plus Copeland xweb and Dixell xweb systems, according to CERT-FR’s alert.

What does ANSSI recommend?

Disconnect these controllers from the Internet or apply very restrictive filtering, use a VPN for maintenance, apply patches and replace end-of-life hardware.