Cyberattack on French supermarkets: hijacked Danfoss refrigeration controllers
On the night of 11 to 12 October 2026, hundreds of French supermarkets had their refrigeration systems hijacked remotely. No tills were blocked and no customer data was stolen: the attackers targeted commercial refrigeration. This article sets out what is confirmed, the breach (which is not yet known), the recommended fixes and what the incident means for your business. It will be updated as the investigation progresses.
Developing story. Figures come from the press (AFP, Reuters, specialist media) and from retailers' statements; they are provisional and differ between sources. We could not consult official statements from Danfoss or ANSSI: their positions are reported by the press.
What is confirmed
| Date | Night of 11–12 October 2026 |
|---|---|
| Target | Refrigeration controllers from Danish maker Danfoss (AK-SM and AK-SC series) installed in supermarkets |
| Effect | Remote defrost of all cold cabinets, with temperatures rising up to 50 °C according to Mousquetaires; the rise lasted about six hours |
| Consequence | Cold chain broken: fresh and frozen goods destroyed |
| Retailers affected | Intermarché/Netto (Mousquetaires), Coopérative U, E.Leclerc (several stores), Carrefour, Monoprix |
| Stores affected (provisional) | Over 400 in early estimates, around 500 per some outlets. AFP: at least 300 Intermarché/Netto, fewer than 100 Coopérative U, 80 Carrefour, about thirty Monoprix. Reuters: about 150 for Intermarché |
| Data stolen | None reported so far |
| Claim of responsibility | None known; the perpetrators are not identified |
| Investigation | Paris prosecutor's office, entrusted to the anti-cybercrime office (OFAC); ANSSI mobilised; CERT-FR alert CERTFR-2026-ALE-012 of 12 October |
| Damage | Several million euros, according to the prosecutor |
How the attack worked
According to available information, the attackers did not "break" the equipment: they abused a legitimate function, defrosting. Triggered on every cabinet at once, it raises the temperature in display cases and cold rooms.
CERT-FR reports "numerous compromises" affecting two Danfoss controller series, the AK-SM and AK-SC. Danfoss says most affected units are obsolete (notably the AK-SM 800 and AK-SC 355) and no longer receive software or security updates.
The breach: what is known and what is not
The entry point has not been publicly identified. Neither Danfoss nor the authorities have said how the attackers got in, and the CERT-FR alert names no vulnerability, firmware version or CVE. Here are the facts and the researchers' hypotheses:
- Internet exposure (established by scans, not tied to the attack). Researcher Baptiste Robert (Predicta Lab) counted 2,752 Danfoss systems exposed online, 1,590 of them in France; Shodan lists over 4,500. These figures come from passive scanning and do not prove those machines were attacked. CERT-FR notes that exposing an administration interface to the internet goes against good practice.
- Known flaws before the attack (hypothesis). Claroty's Team82 researchers had documented flaws in AK-SM 800A controllers in August, including an authentication bypass. Danfoss fixed CVE-2025-41450 (authentication bypass, version 4.2), CVE-2025-41451 (command injection after login) and CVE-2025-41452 (denial of service after login) in 2025, the last two in version 4.3.1. No official source links these CVEs to the attack; the exploited flaw may not have been published.
- Other scenarios mentioned (hypotheses): weak or default credentials on exposed interfaces, compromised maintenance credentials, or a hijacked remote access at a refrigeration contractor.
Recommended fixes
These are the measures given by CERT-FR/ANSSI and Danfoss, as reported by the press:
- Disconnect from the internet or strictly filter access to every AK-SM and AK-SC controller. If remote administration is essential, restrict it to trusted IP addresses (CERT-FR presents this as a temporary measure).
- Replace end-of-life models (AK-SM 800, AK-SC 355): they no longer receive any patch. Otherwise, isolate them on a segmented network.
- Update the firmware of AK-SM 800A units, which are still supported.
- Suspected compromised equipment: updating alone is not enough. CERT-FR prescribes a fuller recovery procedure; see alert CERTFR-2026-ALE-012 on cert.ssi.gouv.fr.
- General measures: change default passwords, remove unnecessary remote maintenance, segment the OT network and log access.
What is not established
- The perpetrators and their motives: no claim, no official attribution.
- The exact access vector: no official link to the CVEs cited; exposed controllers, compromised credentials or a contractor's remote access remain hypotheses.
- The final toll: the number of stores varies by source and retailer.
- Any impact on tills or customer data: several sources say there was none. Reports of paralysed tills are not confirmed.
Lessons for your business
- End-of-life connected equipment is security debt. Hardware that no longer gets patches and is reachable from the internet is a target. Inventory what is connected (refrigeration, HVAC, cameras, printers, kiosks, industrial devices).
- A known flaw stays exploitable for a long time. The gap between a patch being published and deployed is the real attack window. Tracking CVEs affecting your equipment and plugins is the most cost-effective measure.
- An incident without data theft can still be very costly. Here the loss is physical: destroyed stock, disrupted stores. According to the press, the retailers bear these losses without insurance cover. Check what your cyber policy really covers.
- NIS2. If your entity falls within the covered sectors (including food distribution depending on size), check your risk-management and incident-notification obligations.
🔍 What does your exposed attack surface look like?
Our audit analyses what an attacker sees of your website: exposed versions, missing security headers, reachable services and compromise signals, with a report and prioritised action plan delivered by email.
🔍 Audit my site nowSources
Published on 13 October 2026 from press information that is still provisional. Last checked: 13 October 2026.