During the night of Sunday 11 October into Monday 12 October 2026, an unidentified attacker took control of internet-connected refrigeration controllers at hundreds of French supermarkets. The attacker forced fridges, freezers and cold rooms to run their built-in defrost cycles until some reached 50°C (122°F). Food spoiled and, by several accounts, some units caught fire. Affected retailers confirmed the attack, and so did France's national cybersecurity agency, ANSSI, whose CERT-FR has named compromised Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB systems (SecurityWeek). Reported scope varies widely. Early French reports cited 250 to 350 stores (BleepingComputer). Later counts settled at roughly 700 (SecurityWeek, Ars Technica, AP), and Dark Reading puts it at "north of 700" based on the companies' own reports. The Register describes "thousands" of systems hit. No group has claimed responsibility, and the motive is still unknown.
What Happened
Most sources put the attack on the night of 11 to 12 October. Dark Reading alone describes it as "overnight on Monday," which looks like a difference in framing, not a different event. The attacker remotely triggered the defrost function on store-wide refrigeration systems. Dark Reading reports, citing French sources, that the attacker extended defrost cycles so the heating would look like routine maintenance to anyone monitoring remotely. By opening time, stock had to be destroyed.
Affected chains: Intermarché, Netto, Coopérative U, E.Leclerc, Super U, Carrefour Market and Monoprix are named across BleepingComputer, The Record and ON2IT. Store counts differ by source:
- 250 to 350 stores, per French outlets cited by BleepingComputer on 12 October.
- About 300 Intermarché and Netto stores and fewer than 100 Coopérative U stores, per BFMTV via The Record.
- About 700 stores, per SecurityWeek, Ars Technica and AP by 14 and 15 October.
- "North of 700", per Dark Reading, citing company reports.
The higher figures appeared later and include more chains, so they probably reflect the fuller tally. Still, no single authoritative count has been published.
Confirmations:
- Coopérative U president Dominique Schelcher called the attack "of extreme gravity and unprecedented."
- An Intermarché spokesperson attributed the outage to an attack "reportedly affecting a service provider that manages refrigeration systems in stores."
- Groupement Mousquetaires, which owns Intermarché and Netto, told Bloomberg that Danfoss managed the affected systems and that it was up to the supplier to file a criminal complaint (via The Record).
- ANSSI said it was mobilised at both national and European level.
- EU agriculture commissioner Christophe Hansen condemned the attack (BleepingComputer).
- AP reports that French Finance Minister Roland Lescure addressed Parliament on the incident.
Spread beyond France: Dark Reading reports that a Sekoia analyst told Reuters that Spain, Portugal, Poland, Germany and Belgium were also affected. These countries have not been independently confirmed in the other sources. AP reports that a major Dutch supermarket chain shut its systems down as a precaution, and that a major grocer took down websites serving customers in Europe and the US.
Vendor position: Danfoss had not confirmed involvement when The Record published. It later told SecurityWeek that most affected devices were end-of-life AK-SM 800 and AK-SC 355 units, along with some current AK-SM 800A controllers running outdated firmware. Copeland first declined to confirm ANSSI's findings, then acknowledged a vulnerability and said it was "working with impacted customers to mitigate the risk."
What Was Taken
No source reports any data theft, encryption or extortion demand. The damage was physical and financial:
- Perishable stock: spoiled in bulk across every affected store. Ars Technica describes "untold tons."
- Equipment: Ars Technica, Dark Reading, The Register and ON2IT all report fires, and Ars says some units' electrical systems caught fire. Dark Reading calls them "small fires" and attributes them to reports.
- Losses: Intermarché CEO Thierry Cotillard put the chain's loss at "tens of millions of euros across the country in one day" (quoted by ON2IT; Dark Reading also reports that Intermarché cited tens of millions). Dark Reading estimates sector-wide losses at "tens, if not hundreds of millions of euros." That figure is the outlet's own estimate, not a confirmed total.
The Register places the incident within a broader trend of ransomware actors using physical disruption as extortion leverage. However, none of the sources reports a ransom demand in this case, so a financial motive is unproven.
Why It Matters
- Scale from one weakness: As ON2IT puts it, the damage "wasn't one fridge." It was the same attack across hundreds of stores in one night. That pattern points to centrally reachable, uniformly configured devices, probably accessed through internet exposure or a shared management channel.
- Tampering hidden as normal behaviour: Running heat through a legitimate defrost function is a living-off-the-land technique for operational technology (OT). Monitoring that looks only for out-of-range commands would not have flagged it.
- Unmanaged third-party risk: Dark Reading and ON2IT both stress that grocers contracted these systems out. Retailers' own statements point to a service provider managing the controllers. Facilities and OT contracts often sit outside the security team's view, and supplier "monitoring" access often includes full control.
- End-of-life devices left online: Danfoss stopped supporting the AK-SM 800 in May 2021 and discontinued the AK-SC 355 in 2016 (SecurityWeek). These devices will never be patched, yet they were still reachable from the internet.
- Same risk in building systems: The Register links this incident to the August ransomware attack on a Canadian hospital that disrupted door access, HVAC monitoring and staff badge issuance, and to the 2023 Las Vegas casino attacks. ServiceNow's Armis Labs reports increasing use of physical consequences as ransomware leverage. Building automation systems (BAS) carry the same risk as refrigeration controllers.
The Attack Technique
How the attacker got in has not been confirmed. According to SecurityWeek, the CERT-FR alert does not tie the compromises to any specific vulnerability, and neither Danfoss nor French authorities have linked them to recently disclosed flaws. What the sources do establish:
- Targeted products (CERT-FR, via SecurityWeek): Danfoss AK-SM and AK-SC series (alert of 12 October), plus Copeland XWEB and Dixell XWEB (added 13 October).
- Known vulnerabilities:
- This summer, Claroty disclosed flaws in the Danfoss AK-SM 800A and 23 vulnerabilities in Copeland's XWEB Pro. Copeland has since patched them in firmware.
- CISA published an advisory on Danfoss refrigeration controllers last year (The Record).
- Ars Technica reports that all three controller families had critical flaws allowing remote login with administrator rights. It says Danfoss controllers until recently used a daily rotating credential generated from the date by logic in publicly available firmware, so anyone who reverse-engineers the firmware can compute the password for any device.
- Exposure: Ars Technica's headline conclusion is that the attacker exploited "outdated devices exposed to the Internet." CERT-FR's remediation guidance, which centres on taking devices off the open internet, points the same way.
- Action on objective: The attacker triggered or extended defrost cycles, so heating looked like scheduled maintenance (Dark Reading).
Whether access came through direct internet exposure, a compromised service provider's management platform, or both is still an open question. Retailers' statements about a "service provider" leave the supply-chain route plausible.
What Organizations Should Do
- Take OT controllers off the public internet now. CERT-FR's guidance is to disconnect affected Danfoss, Copeland and Dixell controllers and restore remote access only through a secure VPN or a protected network. IP allowlisting is acceptable only as a temporary emergency measure.
- Replace end-of-life devices; don't just reset them. CERT-FR warns that a factory reset of a compromised end-of-life controller is not enough, because it stays vulnerable and will probably be compromised again if still exposed. Inventory AK-SM 800, AK-SC 355 and similar unsupported units and plan replacement.
- Update supported firmware. Apply current Danfoss AK-SM 800A firmware and the Copeland XWEB Pro update that fixes the Claroty-disclosed flaws. Check that vendor-default or algorithmically derived credentials have been retired.
- Separate monitoring from control for third parties. Following ON2IT's recommendation, give suppliers read-only telemetry by default and enable control access only when needed, on a time-limited basis, with logging. Bring facilities and OT contracts into the security team's vendor-risk process.
- Alert on process behaviour, not just commands. Watch for defrost cycles that run longer than usual, configuration changes made outside maintenance windows, and fleet-wide setpoint changes. Back these up with independent temperature sensors that don't depend on the controller.
- Extend the review to building automation. Apply the same exposure audit to HVAC, door-access and badge systems, which The Register and Armis Labs identify as growing targets for physically disruptive extortion.
Sources: Cybercrims go beyond stealing data to attack physical ... | Cyberattack shuts down refrigerators at French supermarkets | Cyberattack disrupts refrigeration at hundreds of French supermarke... | Supermarket Refrigeration Attack Widens to Copeland, Dixell Control... | Fridge hack costing millions and sparking fires stemmed from poor s... | EU Grocers Pay a Steep Price for Unpatched Fridge Firmware | Cyberattacks hit European supermarket chains and disrupt refrigerat... | Supermarket fridge hack: third-party remote access in OT