Overnight on 11 to 12 October, attackers took control of the refrigeration controllers in hundreds of French supermarkets and drove cabinet temperatures as high as 50°C. Les Mousquetaires, the group behind Intermarché, says fridges at about 150 of its stores stayed that hot for six hours and that staff discarded the affected food, according to Reuters. As of 14 October, no group has claimed the attack, and neither French authorities nor the equipment manufacturer has said how the attackers got in.
What Happened, and How Big It Is
Retailers confirmed the attack first. Dominique Schelcher, chief executive of Coopérative U, posted on Monday that cyberattacks had hit the refrigeration equipment of several stores, and he called the attack “unprecedented” and “unacceptable” (CNBC). Intermarché told AFP that affected stores would have to throw out all the products concerned. Managers who arrived on Monday morning met a wave of hot air from the freezers, according to the BBC, and BFMTV showed an ice cream freezer reading 26.5°C. Reuters reported that Paris resident Geert de Clercq watched staff at an Intermarché in the center of the city throw cartfuls of defrosted food into a giant trash container while melted ice cream spilled from broken tubs onto the street.
The Paris prosecutor’s office opened an inquiry that its cybercrime section is running with the national anti-cybercrime office, OFAC, to identify victims and tie them to the reported losses (Euronews, Sud Radio, both relaying AFP). It described a “large-scale” attack on connected refrigerators at several major retailers. Prime Minister Sébastien Lecornu has told ANSSI, France’s national cybersecurity agency, to investigate, a person in his office told Reuters.
Store counts differ by outlet and by day, and nearly all of them come from the companies. Reuters counted at least 350 supermarkets by Tuesday and called that a small fraction of France’s total (Reuters, as carried by Interaksyon). Adding up the chain figures, the BBC arrived at about 400 stores out of roughly 15,000 in France. France’s finance minister, Roland Lescure, told parliament on Tuesday that about 700 of the country’s 10,000 supermarkets were affected, according to CBC. The two tallies use different denominators, and the coverage does not reconcile them. The table collects what each chain, or press coverage of it, has reported.
| Retailer | Reported impact | Where it comes from |
| Les Mousquetaires (Intermarché, Netto) | About 150 Intermarché stores per the group’s spokesperson; 150 to 200 per AFP; around 180 Intermarché and Netto stores per the group’s email to CNBC and the BBC. The BBC adds that about 100 more stores were disconnected from the internet as a precaution. Some French reports put the group total near 300. | Reuters; CNBC; BBC; AFP via Euronews; Bloomberg via The Next Web; Infosecurity Magazine; Journal de l’économie |
| Coopérative U (Système U) | Fewer than 100 stores per AFP’s Monday report; more than 100 per the BBC. | AFP via Euronews; BBC |
| Carrefour | 80 of its roughly 6,000 stores. | Reuters; BBC |
| Monoprix | About 5% of its stores. Reuters counts about 490 in France, the BBC says 400-plus. | Reuters; BBC |
| E.Leclerc | “Several stores.” The group said a refrigeration equipment supplier was hit. E.Leclerc and Auchan did not respond to Reuters. | AFP via The Hacker News; Reuters |
Losses are harder to pin down. Les Mousquetaires told CNBC it expects losses of “several million euros” and is waiting for a court-appointed bailiff and insurance experts to produce firmer figures. Thierry Cotillard, Intermarché’s chief executive, told BFMTV the attack would cost tens of millions of euros nationwide in a single day, according to Reuters. At store level, BFMTV reported that two supermarkets in Alsace, an Intermarché and a Super U in Haguenau, lost about €270,000 of stock between them (BBC, Infosecurity Magazine). Intermarché also warned that some insurance contracts may not cover this type of incident, so part of the bill could stay with the stores.
The fires are the most disputed part of the story. The Paris prosecutor’s office said, as relayed by AFP, that there had also been départs de feu, or fire outbreaks, and Reuters reported that the attack led to food losses and fires. The BBC reports small fires in some places. Les Mousquetaires told CNBC that overheated equipment produced smoke in some of its stores but that no fires have been reported. No public report names a store, a number or a cause. ANSSI’s alert, posted by director general Vincent Strubel on 13 October, told operators to disconnect the affected controllers and flagged a fire-start risk alongside lost stock, according to Solutions Numériques.
The Target Is a Store-Wide Refrigeration Controller
Many headlines say smart fridges, which suggests a consumer appliance with a Wi-Fi chip. The affected equipment is closer to a thermostat with a web server attached: a store-wide controller that regulates cold cabinets and cold rooms, schedules defrost cycles and raises alarms. Reuters explains that supermarket cold aisles typically run on control panels that manage a whole store’s fridges and freezers and can be reached over the internet, which lets maintenance companies adjust them from anywhere. Danfoss, the Danish manufacturer, built the AK-SM and AK-SC series that French authorities have focused on. Its AK-SM 800A system manager, for instance, hosts a web interface where administrators monitor circuits, set temperature thresholds, review alarms and manage users, according to Industrial Cyber’s description of Claroty’s research.
The internet connection exists for a reason. Schelcher said Coopérative U links its fridges to the internet so that staff can monitor temperatures around the clock and catch an anomaly (CBC). That monitoring makes the exposure hard to remove, because disconnecting a controller also cuts the alert path that protects the stock. Les Mousquetaires disconnected about 100 further stores as a precaution, the BBC reports, which shows the trade-off in practice.
Danfoss told news agencies on Monday that the affected units were running outdated firmware or had reached end of life and no longer receive software or security updates (CBC). It has said the affected equipment included the AK-SM 800, declared end of life in 2021, and the AK-SC 355, phased out in 2016, along with current AK-SM 800A units running outdated firmware (Cooling Post). The history is awkward. Danfoss’s own phase-out notice for the AK-SC 355, which carries a 2016 end-of-life date, names the AK-SM 800 series as its replacement. The BBC adds that Danfoss described the hit models as older ones whose security software could not be updated against a risk the company had identified.
Danfoss also told Reuters it was aware of incidents affecting a limited number of its refrigeration management systems in France. Retailers count stores and Danfoss counts systems, and the coverage does not reconcile the two. The company may not be the only vendor involved: according to Reuters, ANSSI said that refrigeration systems from Copeland and from Dixell, a Copeland brand, were also hit (TechNadu). Reuters reports that Copeland acknowledged a vulnerability and said it is working with affected customers (Reuters, as carried by Interaksyon). A Leclerc store in the Tarn lost its cold chain on Tuesday and uses Dixell controllers, France 3 reported, as summarized by Solutions Numériques.
The mechanism matters as much as the brand. Joshua Steinman, chief executive of industrial security company Galvanick, told Industrial Cyber that “defrost isn’t an exploit; it’s functionality.” In his reading, the most damaging commands in industrial settings are often legitimate ones, so defenders need records of who reached a controller, what changed and whether anyone authorized it.
How the Attackers Got In: What Is Known and What Is Not
No one has publicly established the entry route. CERT-FR, the French government’s computer emergency response team, issued alert CERTFR-2026-ALE-012 on 12 October reporting numerous compromises of Danfoss AK-SM and AK-SC controllers and telling operators to disconnect them or filter access to them (The Hacker News). A person in Prime Minister Lecornu’s office told Reuters that ANSSI had identified a vulnerability in software supplied by Danfoss. That account names no CVE and rests on one anonymous source.
Public research names the leading suspects, though nobody has tied them to this incident. A CISA advisory published on 20 May 2025 covers CVE-2025-41450, an authentication bypass in the AK-SM 800A: instead of checking the configured admin password, the device accepts one generated from its own date and time. Danfoss fixed it in version R4.2. A Danfoss advisory dated 1 August 2025 covers two more flaws, a command injection that can lead to remote code execution (CVE-2025-41451) and an Nginx configuration injection (CVE-2025-41452), both fixed in version 4.3.1. Claroty’s Team82 published its technical write-up on 9 August 2026, according to Reuters, and, according to Bloomberg, found thousands of these controllers reachable from the internet (The Next Web). The fixes had been public for 14 to 17 months by the night of the attack.
Experts quoted by Reuters and CBC lean toward the simple explanation. Three cyber experts told Reuters the attack looked easy to carry out, and CBC reports that the experts it consulted believe unapplied Danfoss updates and interfaces left open to the internet made it possible, while noting that the exact mechanism is still unknown. Two cautions apply. Claroty’s work covered the current AK-SM 800A, while the AK-SM 800 and AK-SC 355 are the older units Danfoss says were among those hit. And exposure is not proof of compromise: SOCRadar, which counted Danfoss interfaces visible from France, said so directly (SOCRadar).
The exposure counts also vary with the scanner. Predicta Lab’s Baptiste Robert found 2,752 exposed Danfoss systems on Monday, 1,590 of them in France (BleepingComputer), and Reuters found at least 4,500 Danfoss interfaces on Shodan on Tuesday without being able to confirm how many ran vulnerable software. French scanning firm Onyphe told Reuters that only a small minority of exposed units appeared to run the latest software.
Other routes fit the same facts. Synacktiv, a French security firm, told Solutions Numériques that a recent audit found refrigeration systems reachable from the internet with no password at all, and that the geographic spread of the attacks resembles opportunistic scanning for exposed devices, though it said that does not confirm the method. Retailer statements also frame the incident as a supplier-side event: Les Mousquetaires told CNBC that the attack hit a service provider responsible for managing refrigeration systems in some of its stores. That would make a compromised maintenance channel as plausible as a scanned device.
Attribution is equally open. A source with knowledge of the probe told Reuters that investigators are puzzled by the absence of a hacktivist claim or a ransom demand. Ken Munro of Pen Test Partners called it a basic cyber hygiene issue, said amateurs could be responsible, and doubted that a state actor would hit only a subset of French fridges. He also read the missing ransom demand as a sign that the attackers did not grasp the commercial losses they could inflict (Reuters, as carried by Interaksyon).
Why the Patch Has No Clear Owner
Whatever the entry route turns out to be, the public statements already show a structural problem, because they point in different directions. Danfoss says the units hit were legacy products with no updates, or current products on outdated firmware, and that it has long advised customers to keep supported systems current and to migrate old ones. Its own cybersecurity guidance tells customers to keep its devices off the internet, put them behind a firewall or VPN, change default passwords and run the latest software.
Retailers place the incident elsewhere in the chain. Les Mousquetaires told Bloomberg that the systems were managed by Danfoss and that the supplier, not the retailer, should file a complaint with the authorities (The Next Web). E.Leclerc said a refrigeration equipment supplier was attacked (The Hacker News). France’s retail federation, the FCD, has publicly called on Danfoss for full transparency about the incident (Reuters).
The remote-access design divides the job three ways. The manufacturer publishes the fix, the retailer or its contractor has to install it, and the contractor often holds the remote access. When a controller retired in 2021 is still running in 2026, which of the three was supposed to notice?
Danfoss’s upgrade path is staged, according to The Hacker News: systems on 3.x move to 4.x first, and a controller on the 5.3.x package cannot be downgraded. Journal de l’économie cited update complexity and cost as obstacles to patching. Those frictions help explain how a fleet this size can run behind its vendor’s updates, and the delay carries a price. Ritesh Kotak, a Toronto-based cybersecurity analyst, told CBC that a published firmware update shows attackers exactly which vulnerability to target, which is why he stresses installing updates quickly.
What Nobody Has Confirmed
The coverage so far mixes confirmed facts with plausible inference. As of 14 October, five points remain open.
• The entry route. Whether attackers used a known flaw, an exposed interface with weak or no authentication, or a compromised maintenance account, nobody has said. CERT-FR had published no indicators of compromise as of 13 October (The Hacker News).
• The attacker. No group has claimed responsibility, and no ransom demand has been reported. Investigators are puzzled by both facts, according to a source who spoke to Reuters.
• The fires. The prosecutor’s office mentions them, the BBC reports small fires in some places, and Les Mousquetaires reports smoke without fires. No store, number or cause has been published.
• The spread beyond France. Félix Aimé, a threat analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium also appear affected. SOCRadar noted that retailers in those countries had not confirmed incidents (SOCRadar).
• The Copeland and Dixell link. It rests on ANSSI’s statement as relayed by Reuters. Copeland acknowledged a vulnerability and said it is working with affected customers, but the coverage reviewed here gives no product-level detail.
Two other incidents surfaced in the coverage and should stay separate for now. Dutch retailer Ahold Delhaize took systems offline after a cybersecurity incident that began Sunday evening. The company said it saw no reason to link the incident to the French attacks, and the Dutch NCSC does not believe the two are connected (Reuters, CBC). Reuters also noted that the French attacks resemble disruptions at about a dozen US military commissaries in late August. Since then, Army CID’s cyber field office, the Air Force Office of Special Investigations and the Defense Criminal Investigative Agency have been investigating those outages, where some freezers went into defrost mode (Stars and Stripes). No cause or manufacturer has been named, no findings had been announced as of 30 September, and the Defense Commissary Agency says separate freezer problems at four European stores were unrelated to the US outages (Stars and Stripes).
The Regulatory Clock Is Already Running
Politicians moved quickly to frame the attack as a food-security issue. Lescure told parliament on Tuesday that there was no risk to the food supply, but he acknowledged that the attack goes to the heart of the country’s food security (CBC). European Commissioner for Agriculture and Food Christophe Hansen condemned it on X and said the “weaponization of food” has become a reality (CNBC). Food distribution has been a target before, CBC notes: JBS shut down operations in Canada, the US and Australia in 2021, and a 2025 attack on United Natural Foods led to shortages at Whole Foods.
The timing also makes this an early test for EU product-security law. Since 11 September 2026, manufacturers of products with digital elements have had to report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act, through the single reporting platform that ENISA operates. The rules call for an early warning within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report afterward (European Commission). Law firm Jones Day reads the duty as covering products placed on the market before the Act’s main obligations start in December 2027, and notes fines of up to €15 million or 2.5% of worldwide turnover for non-compliance (Jones Day).
Whether any manufacturer has to file depends on facts that have not been published: whether a vulnerability in its product was actively exploited, and whether it has reasonable certainty of that. Danfoss declined further comment on Tuesday, and its security advisories page listed nothing about the attack as of 13 October, according to The Hacker News. How the duty applies to a model retired in 2021 is an open question that this case may force.
The operator side moves more slowly. The French bill transposing the NIS2 directive, whose sectors include food production, processing and wholesale distribution, was due for debate in the National Assembly on 7 October. The conference of presidents postponed it a day earlier, citing a busy agenda, and France missed the EU’s October 2024 transposition deadline (Next.ink). For now, the EU duty already in force reaches the manufacturers, while the operator-side rules in France are still waiting for a parliamentary slot.
Five Checks for Operators This Week
The public record already supports a short list of actions for anyone running connected refrigeration, whatever the final forensic report says.
1. Inventory every refrigeration controller and remote-access gateway, including units a contractor installed. Record the model, firmware version and end-of-life status. Sophos’s Rafe Pilling advises identifying exposed and vulnerable systems, validating patch levels and assessing compensating controls (Industrial Cyber).
2. Take management interfaces off the public internet, or limit them to trusted addresses through a VPN. That is the first instruction in CERT-FR’s alert, and it matches Danfoss’s own guidance. Keep the monitoring itself: Schelcher’s stores connect their fridges so that someone can watch temperatures around the clock, and a VPN preserves that without publishing the login page.
3. Update supported units and plan the replacement of end-of-life ones. Ask your vendor or contractor to confirm in writing which firmware each store runs. If a unit may already be compromised, CERT-FR’s sequence is to restrict network access to service providers, factory reset, apply all fixes, change secrets, check accounts and reconfigure.
4. Put the contractor’s access in the contract: who connects, from where, with what authentication and with what logs. Steinman’s point about evidence of who reached a controller and what changed only works if those logs exist.
5. Add temperature monitoring that does not report through the controller. A separate sensor with its own alert path catches a controller that is compromised or misreporting. That is our recommendation rather than an official one, and it follows from Claroty’s demonstration, as Infosecurity Magazine described it, that a compromised AK-SM 800A could cut cooling while showing false temperatures.
The Question That Outlasts the Investigation
Investigators will probably name an entry route, and a CVE number may follow. The harder question is the one the retailers and the manufacturer are already answering differently: who was responsible for keeping that controller current and its login closed? Operators that can answer that for every cold room they run will be better placed when the next advisory lands, and those that cannot are leaving the answer to whoever scans the internet first.
The post Hackers Heated French Supermarket Fridges Up to 50°C. The Real Gap Is Who Maintains the Controllers appeared first on DataFLOQ.
