Six Hours Of Defrost, Ordered Remotely
In the night from Sunday 11 to Monday 12 October, attackers took control of the remote-management software for refrigeration units at French supermarkets and ordered the units into defrost. Instead of a short overnight warm-up, fridges and freezers kept heating. Intermarché said its units heated up to 50C for about six hours, and it threw away everything affected to rule out health risks.
Managers who arrived on Monday morning met a wave of hot air from the freezers, and some stores had small fires. Prime Minister Sébastien Lecornu ordered the national cybersecurity agency ANSSI to investigate, and the Paris prosecutor opened a cybercrime inquiry into what it called a large-scale attack on the cold rooms of several major food retail chains. No attacker has been named.
| Chain | Stores reported hit | Reported by |
|---|---|---|
| Intermarché and Netto | 150 to more than 300 | Reuters about 150, BBC 180, AFP at least 300 |
| Coopérative U | 80 of 2,000 hit, more than 100 targeted | The chain via The Hacker News, BBC |
| Carrefour | 80 of 6,000 | Carrefour via the BBC |
| Monoprix | About 30, or 5% of its 400-plus stores | The Hacker News, BBC |
| E.Leclerc | Named as a victim, no count given | BBC, BleepingComputer |
| All chains | 250 to 350, or about 400 of roughly 15,000 | French outlets via BleepingComputer, BBC |
These counts come from the chains and from reporters writing at different hours, so read each as a range. None of the sources gives a confirmed overall total.
The Oldest Controllers Have No Patch To Install
Danfoss says most of the units that were hit are older models whose security software cannot be updated. It added that it has long advised customers to keep supported systems on current firmware.
The Hacker News reports that the AK-SM 800 has been end of life since May 2021 and the AK-SC 355 was phased out in 2016, and that neither receives software or security updates. Some units of the AK-SM 800A, a current model, were reportedly hit as well while running outdated firmware. CERT-FR's alert, updated on 13 October, lists the Danfoss AK-SC and AK-SM series together with Copeland xweb and Dixell xweb controllers as affected products.
CERT-FR adds a warning that matters to anyone holding old stock: a factory reset alone is not enough for end-of-life equipment that stays exposed to the internet, because it will likely be compromised again. For those units the remaining choices are to take them off the internet or to replace them.
How They Got In Is Still Unknown
BleepingComputer says no public information yet explains how the controllers were compromised.
Claroty's Team82 published research in August on the AK-SM 800A: an authentication bypass (CVE-2025-41450, CVSS 8.2), a command injection (CVE-2025-41451, 7.6) and a denial-of-service flaw (CVE-2025-41452, 5.4). Censys scans counted 2,765 of these units reachable from the internet, and Danfoss released an update afterwards. No source links those flaws to this attack, so treat them as context and not as the cause.
Exposure on Monday was large anyway. Predicta Lab's chief executive Baptiste Robert found 2,752 Danfoss systems online, 1,590 of them in France, and Shodan tracks more than 4,500 Danfoss devices reachable from the internet.
The attack may not be only French. Sekoia analyst Félix Aimé told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected, without details, and a person close to the Prime Minister said ANSSI is in contact with agencies in other European countries. Ahold Delhaize announced a security issue in its own network on the same Monday and took some systems offline with stores open, but its statement does not mention France and BleepingComputer saw no evidence of a link.
Intermarché Warned That Insurance May Not Pay
Intermarché said affected stores had to discard all fresh and frozen products and warned that insurance policies may not pay out, because they do not cover this type of incident in stores.
The money is still unclear. Thierry Cotillard of Les Mousquetaires expects losses of tens of millions of euros across France, according to The Hacker News, and the BBC reports food worth millions of euros. Two supermarkets in Alsace reported EUR 270,000 of losses between them. Coopérative U said the cold chain held in most of its 80 affected stores and only a minority lost goods.
CERT-FR's own guidance says to check insurance terms before cutting the data link to the refrigeration contractor. The insurer's view of remote monitoring belongs in the same conversation as the decision to disconnect.
What CERT-FR Wants Done, Step By Step
CERT-FR's alert CERTFR-2026-ALE-012, issued on 12 October and updated on 13 October, gives owners a short order of work.
If the equipment is not compromised: remove internet exposure from the affected units and from any unit on a public IP address; review the full configuration, especially defrost schedules; restore access only through a secure VPN or protected network, with filtering of the contractor's source IP addresses accepted only as an emergency measure; and apply vendor best practice, which for Danfoss means the security level set to Strict and default passwords changed.
If the equipment may be compromised: remove exposure, restore it with a factory reset, bring access back only through a secure VPN, reconfigure the unit before it returns to service and then apply the vendor measures. CERT-FR says the attack campaigns are probably still ongoing.
Ask the refrigeration contractor three things this week: which controller models and firmware versions sit at each site, which of them are past end of life and who can reach them remotely and from where.
Read next: France Bars OpenAI From Its Own Cyber Defenses | Cheap IoT Gear May Be the First Target of AI Worms
