A French supermarket cyberattack compromised refrigeration control systems at hundreds of stores, allowing attackers to manipulate temperatures, spoil fresh and frozen food, and reportedly trigger fires at several locations.
The large-scale incident unfolded overnight from October 11 into October 12, 2026, affecting major French supermarket chains including Intermarché, Coopérative U, Carrefour and Monoprix.
French cybersecurity authorities have now issued an emergency warning covering Danfoss AK-SM and AK-SC refrigeration controllers after becoming aware of numerous compromises involving the product families.
According to France’s CERT-FR security alert, organizations should disconnect vulnerable controllers from direct internet exposure or strictly filter access while investigating affected systems.
For broader coverage of attacks where cyber incidents can create real-world operational disruption, see our Ransomware and Critical Infrastructure Defense Hub.
Key Takeaway
The French supermarket cyberattack demonstrates how compromised operational technology can turn a digital intrusion into immediate physical and financial damage.
Attackers gained control of refrigeration systems used in French supermarkets and manipulated cooling behavior, reportedly forcing some equipment into prolonged defrost operation and pushing temperatures as high as 50°C.
At least 350 supermarkets were affected according to reporting based on investigators and affected companies. Authorities have not publicly identified the attackers, no group has claimed responsibility, and the precise technical entry point used in the campaign remains under investigation.
French Supermarket Cyberattack Hits Hundreds of Stores
The attack became apparent on the morning of October 12 after supermarket operators discovered refrigeration systems behaving abnormally across multiple locations.
Stores belonging to several major French retail groups were affected, including:
- Intermarché
- Coopérative U
- Carrefour
- Monoprix
- Other supermarket locations using affected refrigeration-control infrastructure
Reuters reported on October 13 that investigators were examining compromises affecting at least 350 supermarkets.
Coopérative U separately confirmed that around 80 of its approximately 2,000 stores had been affected.
The full national impact may continue to change as retailers, contractors and investigators complete their assessments.
Hackers Manipulated Refrigeration Temperatures
This was not a conventional website outage or a data-theft incident.
The attackers interfered with systems responsible for controlling supermarket refrigeration equipment.
According to reports from affected retailers and investigators, refrigeration units were remotely manipulated so that temperatures increased instead of remaining within normal cold-storage ranges.
Some systems reportedly reached temperatures of up to 50°C (122°F).
The abnormal operating conditions forced stores to dispose of refrigerated and frozen products that could no longer be considered safe for sale.
Automatic Defrost Function Was Abused
Reports indicate that attackers manipulated refrigeration controllers in a way that forced equipment into extended or repeated defrost operation.
Commercial refrigeration systems periodically use defrost cycles to remove ice from evaporator components.
Under normal conditions, the process is tightly controlled and refrigeration resumes afterward.
If an attacker can manipulate those controls and keep equipment in an abnormal defrost state, temperatures inside refrigerators and freezers can rise rapidly.
That appears to have been one of the major operational effects observed during the French incident.
Food Spoilage and Fires Created Physical Damage
The consequences moved far beyond digital service disruption.
Stores were forced to discard significant quantities of meat, dairy products, frozen food and other temperature-sensitive inventory after refrigeration systems overheated.
Several locations also reported fires or fire-related incidents associated with overheated equipment.
Industry-wide losses are expected to reach millions of euros, although no authoritative final national loss figure has yet been published.
Individual supermarkets reported losses ranging from tens of thousands to hundreds of thousands of euros in spoiled inventory.
France Issues Emergency Alert for Danfoss Controllers
France’s national cybersecurity response team, CERT-FR, published an official alert on October 12 concerning Danfoss AK-SM and AK-SC product families.
The agency said it was aware of numerous compromises involving the refrigeration controllers.
CERT-FR also warned that exposing a management interface directly to the internet is contrary to cybersecurity best practices.
Its immediate recommendation is straightforward:
- Disconnect affected AK-SM and AK-SC systems from direct exposure where possible
- Filter network access to the controllers
- Restrict remote access to trusted IP addresses when remote management is unavoidable
The warning confirms that this is not merely a theoretical vulnerability concern. French authorities are responding to real compromises affecting operational equipment.
Danfoss Says Legacy and Outdated Systems Were Affected
Danish engineering company Danfoss, whose refrigeration-control technology is widely used in food retail environments, said it was working with affected customers.
According to a company statement reported by industry publication Cooling Post, most compromised equipment involved either legacy products or currently supported systems running outdated firmware.
The affected equipment reportedly included:
- Danfoss AK-SM800 — declared end-of-life in 2021
- Danfoss AK-SC355 — phased out in 2016
- Danfoss AK-SM800A systems running outdated firmware
Legacy systems that have reached end of life no longer receive normal software or security updates.
Danfoss has advised customers to migrate unsupported controllers, maintain supported systems on current firmware and remove unnecessary direct internet exposure.
Exact Vulnerability Used in the Attack Is Not Confirmed
One of the most important distinctions in this incident is between known vulnerabilities and the actual attack path.
Danfoss refrigeration controllers have been affected by previously disclosed security weaknesses.
However, authorities have not publicly confirmed that attackers used a particular CVE or vulnerability chain in the French supermarket attack.
Therefore, existing Danfoss vulnerabilities should not automatically be described as the confirmed initial access vector.
Known Danfoss Security Flaws Show the Existing Risk
Danfoss has previously published security advisories for its AK-SM 800A refrigeration-management platform.
For example, the company’s 2023 advisory documented three vulnerabilities:
- CVE-2023-25913 — authentication-related weakness, CVSS 7.5
- CVE-2023-25914 — high-severity vulnerability, CVSS 7.5
- CVE-2023-25915 — critical vulnerability, CVSS 9.8
Danfoss warned that these flaws could potentially result in full system compromise on AK-SM 800A devices running software versions earlier than 3.3.
More recently, Danfoss disclosed additional security issues affecting AK-SM 8xxA systems and continued recommending deployment of current software versions.
These advisories demonstrate why outdated refrigeration-management systems represent a security risk, but they do not establish which vulnerability was used during the October 2026 attack.
Thousands of Refrigeration Controllers Have Been Internet-Exposed
Security researchers have previously warned about internet-accessible refrigeration controllers.
Claroty Team82 researchers studying the Danfoss AK-SM 800A platform identified thousands of publicly reachable management interfaces while examining the technology’s attack surface.
The researchers uncovered weaknesses that could allow authentication bypass, command execution and manipulation of the controller’s web configuration under certain conditions.
Danfoss subsequently addressed the reported issues in updated software.
The research illustrates a broader problem across operational technology: equipment originally designed for restricted industrial or facility networks can become substantially more exposed when management interfaces are reachable from the public internet.
Why Internet-Exposed Refrigeration Systems Are Dangerous
A vulnerable website primarily threatens information and online services.
A vulnerable refrigeration controller can affect a physical process.
Supermarket refrigeration equipment is responsible for maintaining safe temperatures for large volumes of food.
If unauthorized users can control those systems, potential consequences include:
- Loss of refrigeration
- Food spoilage
- Health and food-safety risks
- Equipment damage
- Temporary store closures
- Large financial losses
- Supply-chain disruption
The October attack demonstrates that those risks are no longer purely theoretical.
CERT-FR Provides Six-Step Recovery Guidance
CERT-FR has published specific remediation steps for organizations that suspect a Danfoss AK-SM or AK-SC controller may have been compromised.
The agency recommends:
- Restrict network access to authorized service providers only
- Perform a factory reset of the affected controller
- Install all available security updates
- Rotate passwords and other secrets
- Review existing user accounts
- Fully reconfigure the equipment
Operators should preserve relevant logs and evidence before destructive remediation when incident-response or legal requirements make forensic investigation necessary.
End-of-Life Controllers Create a Bigger Security Problem
The presence of end-of-life equipment is particularly significant.
Unsupported industrial and building-management devices can remain operational for many years after manufacturers stop producing security fixes.
Replacing such equipment can also be more complicated than updating a laptop or server because it may be tied to physical infrastructure, specialist contractors and store operations.
This creates a situation where internet-connected devices remain operational even though newly discovered vulnerabilities can no longer be patched.
For organizations still operating AK-SM800 or AK-SC355 systems, migration should therefore be treated as a security and operational-resilience issue rather than simply a hardware lifecycle decision.
No Hacker Group Has Claimed Responsibility
As of October 13, no known threat group had publicly claimed responsibility for the French supermarket cyberattack.
Investigators have also not announced a confirmed attribution.
No public ransom demand has been linked to the campaign.
This means it would be premature to describe the incident as ransomware, hacktivism or a nation-state operation without additional evidence.
Paris Prosecutors and Cybersecurity Authorities Investigate
French authorities have opened an investigation into the attacks.
The Paris prosecutor’s office is examining the incident while France’s cybersecurity authorities are supporting the response.
The investigation is expected to focus on how attackers reached the refrigeration systems, whether common infrastructure was used across affected stores and whether a service-provider relationship contributed to the scale of the compromises.
At this stage, those questions remain under investigation.
Retailers Should Treat Refrigeration as Operational Technology
The attack also exposes an organizational blind spot common in retail environments.
Refrigeration controllers may be managed by facilities departments or external refrigeration contractors rather than traditional corporate IT teams.
Yet once those devices become connected to IP networks or the internet, they become part of the organization’s cybersecurity attack surface.
Retailers should inventory refrigeration, HVAC, building-management, access-control and other operational systems alongside conventional IT assets.
How Retailers Can Reduce Refrigeration Cyber Risk
Retailers and food-storage operators should consider several immediate defensive measures:
- Remove direct internet exposure from refrigeration-management interfaces
- Place controllers behind firewalls or VPN-based remote-access systems
- Restrict administration to trusted IP addresses and authorized service providers
- Install the latest supported firmware
- Replace end-of-life controllers that no longer receive security fixes
- Change default and reused passwords
- Review privileged and service accounts
- Segment operational technology from corporate and guest networks
- Monitor unusual configuration and temperature changes
- Create alerts for unexpected defrost cycles and abnormal temperature behavior
- Maintain offline recovery and configuration documentation
- Include third-party refrigeration contractors in cybersecurity risk reviews
Why This Attack Matters Beyond Supermarkets
The French incident highlights a much broader cybersecurity problem.
Connected operational systems now control physical processes across offices, factories, warehouses, hospitals, stores and critical infrastructure.
When those devices remain exposed, outdated or poorly segmented, attackers may be able to cause consequences that extend beyond stolen files or unavailable websites.
A cyberattack can potentially stop production, alter temperatures, interrupt utilities or damage equipment.
The supermarket incident provides a particularly visible example because a relatively simple change to refrigeration behavior resulted in immediate physical losses.
Frequently Asked Questions
What happened in the French supermarket cyberattack?
Attackers compromised refrigeration-control systems used by hundreds of supermarkets in France and manipulated their operation, causing refrigerators and freezers to warm and forcing stores to discard spoiled food.
How many supermarkets were affected?
Investigators were examining compromises involving at least 350 supermarkets as of October 13, although the final national total may change as companies complete their assessments.
Which supermarket chains were affected?
Reported victims include Intermarché, Coopérative U, Carrefour and Monoprix, among other stores using affected refrigeration infrastructure.
Did hackers really heat supermarket fridges to 50°C?
Yes. Reports from the incident describe refrigeration systems being manipulated and temperatures at some affected installations reaching approximately 50°C.
Were Danfoss refrigeration controllers compromised?
Yes. CERT-FR says it is aware of numerous compromises involving Danfoss AK-SM and AK-SC product families.
Which Danfoss systems were involved?
Danfoss said affected installations primarily involved legacy AK-SM800 and AK-SC355 equipment, as well as supported AK-SM800A systems running outdated firmware.
Was a specific CVE exploited?
No specific vulnerability has been publicly confirmed as the attack vector. Danfoss products have known vulnerabilities, but those flaws should not be presented as the confirmed cause of this incident without additional evidence.
Who carried out the attack?
No attacker has been publicly identified. As of October 13, no group had claimed responsibility and investigators had not announced a confirmed attribution.
Was this ransomware?
There is currently no evidence that this incident involved ransomware, and no public ransom demand has been reported.
Final Takeaway
The French supermarket cyberattack is a powerful example of what can happen when internet-connected operational technology controls physical processes.
Attackers compromised refrigeration systems at hundreds of stores, manipulated cooling behavior and caused substantial food losses, with some systems reportedly reaching temperatures of 50°C.
France’s CERT has confirmed numerous compromises involving Danfoss AK-SM and AK-SC controllers and is urging operators to remove direct internet exposure, restrict access and fully remediate suspected compromised devices.
Danfoss says many affected installations used end-of-life equipment or outdated firmware, reinforcing the risks created when operational technology remains connected long after its security lifecycle has ended.
The investigation is still active, and neither the exact intrusion method nor the attacker has been confirmed.
