French supermarket fridge attack followed months of exposed, unpatched Danfoss controllers

What happened

On the night of 11 to 12 October 2026, attackers switched supermarket refrigeration systems across France into defrost mode, a cycle that heats cooling components to clear ice buildup. According to the Paris prosecutor, some units reached 50°C and some equipment caught fire. Stores discarded fresh and frozen stock as a result. Futura-Sciences reports that more than 400 stores were hit in total, with losses that could reach several million euros.

Carrefour said 80 of its stores were affected, and Intermarché and Netto, both part of the Les Mousquetaires group, reported over 300 affected locations. Monoprix put its share at roughly 5% of stores, and Leclerc and Coopérative U also confirmed incidents. Coopérative U's CEO, Dominique Schelcher, told RTL that 80 of the group's 2,000 stores were struck, adding that stores do not buy from Danfoss directly — the controllers arrive through their refrigeration contractors.

Danfoss, the Danish maker of the refrigeration controllers involved, said most affected equipment was legacy, naming the AK-SM 800 and AK-SC 355 models. France's cybersecurity agency CERT-FR said it knew of numerous compromises of AK-SM and AK-SC controllers and urged operators to disconnect them or restrict who can reach them; on 13 October it widened the alert to include XWEB supervisors from Copeland and its Italian brand Dixell. The agency believes attack campaigns are probably still under way. The Paris prosecutor's office has opened an investigation, and nobody has said publicly who was behind the attack or how they got in.

The exposure was visible for months

Internet-scanning company IPinfo, which sweeps the IPv4 internet weekly, found 2,528 addresses serving a Danfoss StoreView dashboard in its 6–7 October scan, five days before the attack. That is the web interface stores and technicians use to watch and manage the controllers — and anyone who knew the address could open it. France accounted for 1,331 of them, 53%, more than the other 72 countries and territories combined, which had 1,197. Poland followed with 179, then the United States (101), Portugal (92) and Belgium (85).

IPinfo's data cannot explain why France hosted so many, but it rules out worse maintenance: French dashboards ran the same mix of software versions as everywhere else, and almost all connected through ordinary telecom networks rather than data centres — consistent with controllers sitting on each store's own internet line, with access opened for a technician or head office. CERT-FR's guidance hints at why stores keep them connected: it warns operators to check their insurance terms before cutting the data their controllers send to refrigeration contractors.

Old software, slow patching

According to IPinfo, 85% of the French dashboards (1,136 of 1,331) ran software with known vulnerabilities, nearly identical to the 84% seen abroad. That figure includes 527 controllers Danfoss declared end of life in 2023 — the same year security firm Synacktiv published a login bypass for them — plus 280 units missing three 2023 fixes, one rated critical, and 329 missing 2025 fixes, among them another login bypass. Only 195 had every known patch.

The exposure was not new. Weekly scans from late March 2026 onward consistently found roughly 2,500 dashboards, about half in France, and 1,019 of the French dashboards seen on 6 October sat at the very same addresses on 30 March. Over those six months, the share of newer controllers carrying all known fixes rose only from 14% to 24%.

Stores disconnected en masse

After the attack, IPinfo's 14 October scan found just 316 of the 1,331 French dashboards still online — a 76% drop, against a normal weekly disappearance rate of 3–7%. End-of-life controllers fell from 527 to 64, and fully patched units from 195 to 54, pointing to stores pulling the plug rather than updating. Censys, another internet scanning company, recorded a similar 71% decline in France between 11 and 14 October. Claroty, the security firm that found the 2025 flaws, told Tom's Guide that some exposed controllers remained online anyway.

Flawed dashboards were also open in 69 other countries, led by Poland, the United States and Portugal, and an analyst quoted by Australia's ABC suggested other European countries may have been hit too.

Why it matters

This incident shows the physical stakes of insecure connected devices: a network intrusion translated directly into heat, fire and tonnes of destroyed food. It also shows how long-known problems fester — the vulnerable dashboards were publicly visible for at least six months, most ran outdated or unsupported software with documented flaws, and decisive action came only after the damage was done. Finally, the response — mass disconnection rather than patching — underlines that many operators of industrial control systems have no easy upgrade path, and that insurance requirements and contractor relationships can keep risky internet connections alive. Comparable exposures remain online in dozens of other countries.