Hackers force French supermarket refrigeration into defrost; CERT-FR names Danfoss, Copeland, Dixell

Supermarket cooling forced into defrost

On October 12, Dominique Schelcher, head of French retailer Coopérative U, confirmed that a cyberattack had disrupted cold-production equipment at several stores since the previous night, with teams working with refrigeration specialists to restore service. Reuters, whose report was republished by ABC, adds a more specific account from Les Mousquetaires, the company behind Intermarché: fridges at about 150 stores were heated to 50°C and kept there for six hours overnight. An Intermarché spokesperson said staff discarded affected food to eliminate health risks, and a witness in Paris described carts of thawed goods and melted ice cream ending up on the street. Store counts and loss estimates vary between reports, and the coverage reviewed in a dev.to analysis sets no settled industry-wide damage total.

A maintenance cycle turned into the attack

Defrost is an ordinary function: ice accumulates on cooling elements and blocks airflow, so controllers periodically warm them to clear it before cooling resumes. Danfoss's own documentation on adaptive defrost notes that too-frequent or over-long cycles harm food quality — historical manufacturer background about the mechanism, not incident-specific evidence. The attack needed no exploit against the cooling machinery itself. Whoever held the controls simply kept a legitimate heating cycle running far beyond its normal length, changing the conditions stores depend on to keep stock safe. Access to the controller therefore carries consequences well beyond a dashboard: the equipment is attached to inventory that must be inspected, discarded and replaced once the cold chain breaks.

Remote maintenance as the control boundary

Reuters describes refrigeration control panels with remote maintenance adjustments, which let service companies manage equipment without sending a technician to every shop. The attacker's exact entry path has not been reconstructed. CERT-FR's alert names no specific password, vulnerability or exploit chain, and manufacturer statements about old firmware, along with reporting on earlier security research, remain context rather than proof of cause. For anyone building connected equipment, the practical questions are who can reach the management function and what authority they gain once there.

CERT-FR names three controller families

The French CERT's October 13 alert lists Copeland xweb, Danfoss AK-SC and AK-SM series, and Dixell xweb controllers, and its revision history shows other targeted equipment was added as the alert evolved — a reason for caution when early coverage framed the story around a single manufacturer. The geographic scope stays narrow too: Dutch retailer Ahold Delhaize reported a separate disruption but told Reuters there was no reason to link it to the French incidents. The evidence supports an attack on French refrigeration, not a confirmed single campaign behind every retail incident reported in Europe.

Why a factory reset is not full recovery

CERT-FR advises operators not to expose management interfaces directly to the public internet. Its recovery guidance covers removing that exposure, checking configuration — specifically including defrost windows — and restoring access through a secure VPN or protected network. For compromised devices, the alert describes resetting and reconfiguring them as part of the response, but its strongest warning concerns an internet-exposed, end-of-life device with no security patch available. In that situation a factory reset removes attacker changes or persistence, yet repairs neither the underlying vulnerability nor the exposed access arrangement, leaving the door open to a repeat compromise. The alert also tells operators to coordinate with their refrigeration contractor and check insurance-contract conditions before cutting internet reporting, because disconnection can affect required monitoring.

Why it matters

The incident is a concrete demonstration that compromising connected controllers produces physical and financial damage, not just data loss. A routine maintenance feature, reachable through a management interface, was enough to spoil stock at scale — no destructive payload required, just a legitimate command held on too long. For operators, the lesson is that recovery does not end at a clean configuration restore: a device's support status, its patch availability and the management boundary around it decide whether the same attack can happen again. For vendors and integrators, it underlines that end-of-life industrial controllers exposed to the internet remain a live liability long after their commercial life ends.