Hundreds of French Supermarkets Lose Frozen Stock After Hackers Target Danfoss Refrigeration Systems

Overnight from Sunday October 11 to Monday October 12, 2026, attackers took remote control of the refrigeration management systems of hundreds of French supermarkets and turned fridges and freezers into heaters. The targeted devices are supervisory controllers made by Danish refrigeration giant Danfoss. A single controller coordinates every refrigerated display, freezer and cold room in a store, and refrigeration contractors can manage it remotely. The attackers forced the equipment into a continuous defrost cycle with setpoints pushed as high as 50°C, destroying fresh and frozen stock before store teams arrived in the morning.

Les Mousquetaires, the group behind Intermarché and Netto, said its units were heated to 50°C for about six hours during the night. Refrigeration technicians quoted in French media described defrost cycles stretched to 180 or 360 minutes and repeated several times. Night crews and early morning staff found abnormally hot cabinets, thawed products and, in some stores, damaged equipment. The Paris prosecutor's office said the attack also caused equipment to start catching fire in some locations.

Haguenau, in the Bas-Rhin department of Alsace, became one of the most visible examples of the damage. The manager of the local Intermarché told Le Figaro that the attackers had programmed hot air at 50°C, which sent the temperature of her refrigerated displays up to 36°C. She estimated the losses for her store alone at around 50,000 euros and said she had never faced anything similar in 25 years in food retail. Two supermarkets in the area reportedly lost about 270,000 euros of goods combined.

Les Mousquetaires first reported about 150 Intermarché stores, then confirmed to AFP that at least 300 Intermarché and Netto outlets were hit. Coopérative U chief executive Dominique Schelcher said on October 13 that 80 of the group's roughly 2,000 stores were reached, adding that the cold chain held in most of them thanks to the fast reaction of staff and refrigeration contractors. Carrefour reported 80 affected supermarkets out of about 6,000 stores, Monoprix said around 5% of its network was concerned, and E.Leclerc confirmed that an attack on one of its refrigeration equipment suppliers had hit several of its stores. In total, roughly 400 to 500 supermarkets appear to have been affected across France.

The financial impact is significant. Les Mousquetaires chief executive Thierry Cotillard told broadcaster BFMTV that the attack would cause losses of tens of millions of euros nationwide in a single day. Intermarché said all affected fresh and frozen products had to be thrown away to remove any health risk, which means tons of food wasted. French media also report that retailers may find themselves without insurance coverage for this type of incident. Beyond the destroyed stock, stores face the cost of equipment repairs, emergency interventions by contractors, empty shelves and lost sales during restocking.

The Paris prosecutor's office opened an investigation on its own initiative, led by its cybercrime section and assigned to the national anti-cybercrime office (OFAC). The inquiry must identify the victims and establish the link between the attack and the damage reported. Prime Minister Sébastien Lecornu asked the national cybersecurity agency ANSSI to take up the case. On October 12, CERT-FR, the government's computer emergency response team, issued an alert stating that it was aware of numerous compromises of Danfoss AK-SM and AK-SC controllers. It urged operators to disconnect these devices from the internet or strictly filter access to them, and listed recovery steps for compromised units: restrict access to service providers, perform a factory reset, apply security fixes, change passwords, review user accounts and fully reconfigure the device.

A source close to the Prime Minister said ANSSI had identified a vulnerability in software supplied by Danfoss and had contacted the company. Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems. According to the manufacturer, most of the units hit were older products that no longer receive software or security updates, namely the AK-SM 800, declared end of life in May 2021, and the AK-SC 355, phased out in 2016. Some units of the current AK-SM 800A model were also compromised because they were running outdated firmware. Danfoss said it is working with customers on firmware updates, stronger network protection and the removal of direct internet exposure.

The trade federation FCD called on Danfoss for full transparency and said some stores were already back to normal operations on October 12. As of October 13, many stores have disconnected their controllers and switched their refrigeration to local manual control while they restock. However, the full remediation will take much longer. Factory resets, firmware upgrades and the replacement of obsolete controllers must be carried out by refrigeration contractors, store by store, and owners of end-of-life models have no security fix available at all. CERT-FR has not yet published indicators of compromise, and the exact entry point remains unknown.

The attack is not limited to France. ANSSI is in contact with its European counterparts, and an analyst at threat intelligence firm Sekoia said Spain, Portugal, Poland, Germany and Belgium had also been affected, although France remains by far the most heavily hit country. No group has claimed the attack and no attribution has been made. Some commentators quickly pointed to Russia, but several independent security researchers warn that this is speculation without evidence. They note that the concentration of victims in France could also reflect the size of the Danfoss installed base in the country, a shared contractor or remote access channel, or a deliberate choice of target. Danfoss itself documented earlier attacks on the AK-SM 800, with 16 Russian supermarkets targeted in 2022 and 40 Israeli stores hacked the same year.

For supply chain managers, the most useful question is not who did it but which mistakes made it possible. Investigators have not yet confirmed the intrusion path, so the points below are the most probable failures based on what Danfoss, CERT-FR and security researchers have disclosed so far.

Mistake 1, running end-of-life equipment. The AK-SM 800 has been out of support since 2021 and the AK-SC 355 since 2016, yet both were still controlling the cold chain of hundreds of stores. Danfoss had warned in an October 2025 newsletter that it would end all services for these products and urged customers to plan replacements. A device that can no longer be patched should be treated as a known risk with a replacement date, not as an asset that works fine.

Mistake 2, accumulating patch debt. For the current AK-SM 800A, Danfoss fixed an authentication bypass affecting versions earlier than 4.2 and two other flaws in version 4.3.1, all in 2025. Researchers at Claroty publicly described how these weaknesses could be chained on August 9, 2026. Neither the authorities nor Danfoss have linked these flaws to the attack, but Danfoss confirmed that the compromised AK-SM 800A units ran outdated firmware. If confirmed, this would not be an unknown zero-day attack but the consequence of updates that were available and never installed.

Mistake 3, exposing management interfaces to the internet. On October 12, a security researcher counted 2,752 Danfoss systems reachable online, 1,590 of them in France, while the Shodan search engine tracks more than 4,500. CERT-FR states clearly that exposing a management interface directly to the internet goes against good practice. Remote maintenance is legitimate, but it should go through a VPN or a single controlled gateway restricted to known addresses.

Mistake 4, letting connections bypass the IT department. A cybersecurity manager at a major French retailer, quoted by a security researcher, said the controllers are not connected to the retailer's own network but to 3G cards installed by refrigeration contractors, outside the oversight of IT teams, so as not to slow down operations. This account has not been officially confirmed. France still operates 3G networks while several other countries have shut them down, which some analysts see as a possible reason for the French concentration, although there is no evidence yet that the mobile network was used to get in. Coopérative U confirmed that its stores buy the Danfoss systems through refrigeration contractors, not from the manufacturer, which illustrates how this equipment can escape central IT governance.

Mistake 5, weak access control. Danfoss's own security guidance asks operators to change default passwords at installation and to require remote users to log in through a single managed entry point. In the 2022 Israeli case, all 40 hacked stores lacked a proper firewall or VPN. Shared contractor accounts, unchanged passwords and the absence of two-factor authentication are classic weaknesses in operational technology, and the investigation will have to check whether maintenance accounts were compromised.

Mistake 6, no safety limits and no effective night monitoring. The controllers accepted a defrost setpoint of 50°C and cycles lasting several hours, values that make no sense for a freezer. Configuring hard limits on critical settings would have reduced the damage. In many stores, the problem was only discovered in the morning, which suggests that temperature alarms were either not routed to an on-call person or were managed by the same compromised system. Independent temperature sensors with their own alert channel are a simple safeguard.

Mistake 7, ignoring early warnings. The 2022 attacks in Russia and Israel, the Danfoss end-of-life notice in 2025, the Claroty research in August 2026 and a similar disruption reported at about a dozen US military commissaries in late August were all signals that refrigeration controllers had become a target. The same retail cybersecurity manager claimed that the weakness was known since July without customers being warned, a claim that has not been verified.

Mistake 8, missing supply chain governance. Refrigeration is often left out of cyber risk mapping because it belongs to facilities management and is run by third-party contractors. Without an inventory of connected equipment, cybersecurity clauses in maintenance contracts and a tested manual fallback procedure, retailers discovered the exposure of their own cold chain on the morning of the attack. For supply chain leaders, the lesson is clear: every connected device that protects inventory, from refrigeration controllers to warehouse automation, must be included in supplier audits, patch plans and crisis exercises.