Overnight between Sunday, October 11 and Monday, October 12, 2026, attackers reached into the refrigeration controllers of hundreds of French supermarkets and forced display cases into a continuous defrost cycle, pushing temperatures as high as 50°C (122°F). Intermarché and Netto, E.Leclerc, Carrefour, Monoprix and Coopérative U stores all reported disruption, perishable stock had to be thrown out, and Paris prosecutors confirmed the incident also sparked fires. The common thread so far is internet-exposed building management gear, chiefly legacy Danfoss AK-SM and AK-SC refrigeration controllers. Here’s what happened, how it was possible, and what IT and facilities teams should be checking this week.
The Attack: Defrost on Command
According to Thierry Cotillard, president of Intermarché parent Groupement Les Mousquetaires, “The attack triggered the defrost cycle on all our refrigerated display cases,” calling the experience “a disaster, it’s unprecedented, never seen before on this scale.” He warned industry losses could reach “tens of millions of euros.” Store counts are still moving: Les Mousquetaires has cited figures ranging from about 150 to 300 Intermarché and Netto locations, Carrefour confirmed around 80 stores, Monoprix said roughly 5% of its 490 stores were affected, and Coopérative U reported 80 of its 2,000 stores. Trade outlet Cooling Post puts the total at around 500 stores.
Paris prosecutors have opened an investigation into what they described as a “large-scale cyberattack affecting the refrigerators of several major food retail chains across France.” EU food commissioner Christophe Hansen condemned the attack, stating that “the weaponisation of food has become a reality.” No group has claimed responsibility, and no attribution has been made public.
The Technology Behind the Breach
Danfoss, the Danish refrigeration manufacturer, confirmed that most affected units were legacy products or current products running outdated firmware:
- AK-SM800: Declared end-of-life in 2021 and no longer receiving software or security updates.
- AK-SC355: Phased out in 2016, also without updates.
- AK-SM800A: A current, supported system, but affected units were running outdated firmware.
These supervisory controllers manage case temperatures, defrost schedules and alarms through an embedded web management interface. Security firm Claroty’s Team82 previously disclosed multiple vulnerabilities in the AK-SM800A web interface, and Danfoss shipped fixed firmware in August 2025. Authorities have not yet confirmed the entry point or whether those specific flaws were exploited. Exposure, however, is not in doubt: Shodan searches cited by The Register found more than 4,500 internet-facing Danfoss controller interfaces as of Monday, more than half of them in France.
The scope is also wider than one vendor. On October 13, CERT-FR expanded its advisory to cover Copeland XWEB and Dixell XWEB monitoring platforms, saying it is aware of numerous compromises involving them alongside the Danfoss systems. Notably, Coopérative U’s CEO told RTL that the chain is not a Danfoss customer.
Why This Matters for IT Teams
This is the scenario OT security people have warned about for years: low-glamour building systems, often installed and remotely managed by third-party contractors, sitting on the public internet with default-era firmware and nobody in IT owning them. The impact went straight from a web login page to physical damage and fires.
- Shadow OT: Refrigeration, HVAC and BMS controllers are frequently deployed by facilities vendors with their own broadband or port-forwarding rules, outside IT’s asset inventory.
- End-of-life gear: Controllers running for a decade or more will never receive a patch; the only fix is isolation or replacement.
- Physical consequences: A single setpoint or defrost command can destroy inventory and create safety hazards, far beyond a data breach.
- Mass exploitation: Hundreds of sites hit in one night suggests attackers scanned for and automated access to exposed interfaces rather than targeting stores one by one.
What Admins Should Do Now
France’s cybersecurity agency ANSSI urged operators to “disconnect or restrict access to AK-SM and AK-SC instances,” noting that “exposing a management interface to the internet is contrary to best practices.” Whether you run a grocery chain, a restaurant, a warehouse or a clinic with cold storage, the checklist is the same:
- Find your exposure: Scan your public IP ranges (and check Shodan or Censys for your addresses) for Danfoss AK-SM/AK-SC, Copeland XWEB and Dixell XWEB interfaces, and any other BMS web panels.
- Pull it off the internet: Remove direct exposure and port forwards. If remote access is essential, put it behind a VPN with MFA, or as an interim step restrict it to trusted IP addresses as ANSSI recommends.
- Segment: Place OT and building controllers on isolated VLANs with firewall rules that block lateral movement from guest and corporate networks.
- Update or replace: Bring supported units like the AK-SM800A to current firmware and budget to replace end-of-life AK-SM800 and AK-SC355 controllers.
- Rotate credentials: Change default and shared vendor passwords, and audit which contractors hold remote access.
- Review logs and alarms: Look for unexpected logins, setpoint changes or forced defrost commands, and make sure temperature alarms route to someone who will answer at 2 a.m.
Looking Ahead
The French supermarket attack will likely become a reference case for how operational technology in ordinary businesses can be turned against them at scale. Investigators still have to confirm the initial access vector and who was behind it, and CERT-FR’s expansion of the advisory to other vendors suggests the full scope is not yet known.
For IT professionals, the lesson is practical rather than theoretical: every device with a web interface and a public IP is part of your attack surface, whether it runs Windows or a freezer. Now is the time to walk the building, inventory the controllers that facilities vendors installed, and make sure none of them answer to the open internet.
Sources:
- CBS News / AFP, October 12, 2026
- Cooling Post, October 12, 2026
- GovInfoSecurity (ISMG), October 13, 2026
- The Register, October 13, 2026
- Claroty, October 13, 2026
- ANSSI / CERT-FR advisories, October 12–13, 2026
