Cyberattack Hits Hundreds of French Supermarkets by Taking Control of Refrigeration Systems
Meta Title: French Supermarkets Hit by Cyberattack on Danfoss Refrigeration Systems
Meta Description: A cyberattack disrupted refrigeration systems at hundreds of French supermarkets, affecting Intermarché, Carrefour and other retailers using Danfoss controllers.
SEO Keywords: French supermarket cyberattack, Danfoss refrigeration controller attack, supermarket cybersecurity incident, industrial control system security, refrigeration system hacking, CERT-FR cybersecurity alert, IoT security, OT cybersecurity
Cyberattack Forces French Supermarkets to Discard Food
Hundreds of supermarkets across France were affected by a cyberattack on the night of October 11, 2026, after attackers reportedly gained remote control of refrigeration systems and caused temperatures to rise. Several retail chains reported disruptions, with some stores forced to discard food products that could no longer be safely stored.
The attack targeted refrigeration management controllers manufactured by Danish company Danfoss. These devices allow refrigeration systems in supermarkets to be monitored and managed remotely by maintenance providers.
According to France's national computer emergency response team, CERT-FR, numerous compromises affected Danfoss AK-SM and AK-SC controller series. The incident highlights the cybersecurity risks associated with internet-connected operational technology (OT) and industrial control systems.
Which Supermarket Chains Were Affected?
Several major French retailers reported affected stores. The reported figures vary by company and source.
- Intermarché and Netto: At least 300 stores across both brands were reported affected by AFP, while Reuters cited approximately 150 stores.
- Coopérative U: Around 80 of its 2,000 stores were affected.
- Carrefour: Approximately 80 supermarkets were reportedly impacted.
- Monoprix: Around 30 stores were affected.
- E.Leclerc: Several stores reported refrigeration-related disruptions.
Not every affected store lost its food inventory. Coopérative U said that most stores maintained the cold chain, while some locations were unable to respond quickly enough and suffered product losses. Intermarché, however, said affected stores had to discard the products concerned.
The financial impact could be substantial. Les Mousquetaires executive Thierry Cotillard reportedly estimated that losses across France could reach tens of millions of euros.
How Did the Attackers Target Refrigeration Systems?
The attackers reportedly accessed controllers responsible for managing supermarket refrigeration equipment. These systems can control multiple refrigerators and freezers and are often maintained remotely.
In affected Intermarché stores, refrigeration equipment was reportedly switched into defrost mode and heated to temperatures as high as 50°C.
French authorities and Danfoss had not publicly established the initial access method as of October 13, 2026. No specific vulnerability or CVE had been confirmed as the cause of the incident.
CERT-FR warned operators against exposing refrigeration management interfaces directly to the internet without appropriate access restrictions.
Danfoss Controllers Identified in the Incident
Danfoss identified older refrigeration controller models among the affected devices.
AK-SM 800
The AK-SM 800 reached end-of-life status in May 2021. It no longer receives software or security updates, making replacement an important consideration for operators still using the device.
AK-SC 355
The AK-SC 355 was phased out in 2016 and no longer receives software or security updates. Operators using this model should follow CERT-FR's mitigation guidance and plan for replacement.
AK-SM 800A
Some units of the newer AK-SM 800A were also reportedly affected. Danfoss indicated that these units were running outdated firmware. The latest software package listed by Danfoss on October 13, 2026, was version 5.3.x.
Danfoss has not publicly confirmed that a particular firmware vulnerability caused the supermarket attack.
Previously Disclosed Danfoss Security Vulnerabilities
Danfoss addressed three vulnerabilities affecting the newer AK-SM 800A in 2025:
- CVE-2025-41450: An authentication bypass vulnerability affecting versions before 4.2.
- CVE-2025-41451: A command injection vulnerability that could potentially lead to remote code execution.
- CVE-2025-41452: A vulnerability that could allow a denial-of-service attack.
The latter two vulnerabilities require authentication and were fixed in version 4.3.1, according to the reported advisory details.
Researchers at Claroty previously demonstrated potential attack chains involving these vulnerabilities and reported finding thousands of AK-SM 800A management interfaces exposed to the internet.
However, neither Danfoss nor French authorities had linked these previously disclosed vulnerabilities to the October 2026 incident. The method used by the attackers remains unconfirmed.
CERT-FR Issues Urgent Security Recommendations
CERT-FR advised operators to disconnect affected AK-SM and AK-SC controllers from the internet or strictly filter access to them.
Organizations responsible for refrigeration infrastructure should prioritize the following measures:
- Restrict network access: Permit access to controllers only from authorized service providers and trusted management systems.
- Remove direct internet exposure: Avoid making industrial control interfaces publicly accessible.
- Reset potentially compromised devices: Perform a factory reset when compromise is suspected, following the manufacturer's procedures.
- Apply available security updates: Install supported firmware and security fixes wherever available.
- Rotate credentials: Change passwords and other device secrets that may have been exposed.
- Audit user accounts: Review existing accounts and remove unauthorized or unnecessary access.
- Reconfigure and secure systems: Rebuild the device configuration and verify remote-access protections.
- Plan legacy-device replacement: Replace unsupported controllers that can no longer receive security fixes.
For systems that require remote administration, access should be restricted through trusted IP addresses or a securely managed remote-access gateway.
Why This Incident Matters for OT and IoT Security
The incident demonstrates how a cyberattack against operational technology can create direct physical and financial consequences without targeting traditional IT systems alone.
Refrigeration controllers, building management systems, industrial equipment and other connected devices can become potential entry points when remote-access interfaces are exposed or security updates are neglected.
A compromise of these systems can disrupt operations, damage equipment, cause inventory losses and affect business continuity. In environments involving food storage, maintaining appropriate temperatures is also essential for product safety.
Organizations should therefore treat OT security as a core part of their cybersecurity strategy, combining network segmentation, secure remote access, firmware management, account auditing and incident-response planning.
Investigation and Possible International Impact
The Paris prosecutor's office opened an inquiry into the incident, with its cybercrime division investigating the reported damage and identifying affected victims.
French cybersecurity authorities also said they were in contact with agencies in other European countries. A Sekoia threat intelligence analyst reportedly told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected, although detailed confirmation of those cases was not provided in the report.
As of October 13, 2026, the attackers' identity, initial access method and any connection to a specific vulnerability remained unconfirmed.
Key Takeaway
The cyberattack affecting French supermarkets underscores the importance of securing connected refrigeration equipment and other operational technology. Internet-exposed management interfaces, outdated firmware and unsupported devices can increase organizational risk.
Businesses operating industrial or building-management systems should review remote-access controls, apply available security updates, isolate critical devices from public networks and replace unsupported equipment wherever possible.
Sources: CERT-FR, Danfoss security guidance, and reporting by AFP, Reuters and Cooling Post.
