Supermarket Refrigeration Cyberattack: Who Is Responsible?

What happened in the French supermarket refrigeration cyberattack

On the night of Sunday 11 October 2026, attackers reached the supervisory controllers that run entire banks of chilled and frozen display cases in French supermarkets. These are not individual fridge thermostats. A store system manager sits above every case controller in the building, and maintenance firms log into it remotely to change setpoints, schedule defrosts and read alarms.

The attackers used exactly that capability. According to reporting from BFM TV and Les Mousquetaires, the cases were forced into defrost and held there, with temperatures climbing as high as 50°C. Staff opening on Monday morning found warm frozen aisles. Several stores also reported equipment starting to catch fire, and the Paris prosecutor's office says its inquiry covers both the food losses and the fires.

By Monday CERT-FR, the incident response arm of the French national cybersecurity agency ANSSI, had published alert CERTFR-2026-ALE-012. It confirms numerous compromises of Danfoss AK-SM and AK-SC series controllers and tells operators to disconnect them or filter access immediately. The Prime Minister asked ANSSI to investigate, and the agency is talking to its European counterparts. Sekoia's threat intelligence team told Reuters that Spain, Portugal, Poland, Germany and Belgium were also affected, though no detail has been published on those cases.

As of 13 October nobody has claimed the attack, and neither ANSSI nor Danfoss has said who did it or exactly how they got in.

Which supermarkets were hit

Every retailer has counted differently, and the numbers moved through Monday as stores checked their plant. This is the best picture from company statements as of 13 October.

Cooling Post put the total at around 500 stores. BFM TV reported 250 to 350. The honest answer is that nobody has a final count yet, and the Paris inquiry has been tasked with establishing one.

What the attack cost

Thierry Cotillard, who heads Les Mousquetaires, told BFM TV he expects losses of tens of millions of euros nationwide from a single night. To put a single store in context, BFM reported that one Leclerc in Wasselonne had to destroy around €220,000 of frozen and fresh product.

The food is only the visible line. Behind it sit the costs nobody has totalled yet:

• Stock destruction and disposal, including the labour of emptying and cleaning every case.
• Lost sales while aisles were closed and restocked.
• Engineer call-outs across hundreds of sites on the same day, which in practice means waiting.
• Equipment damage where cases overheated or started to burn.
• Remediation: factory resets, firmware work and, for end-of-life units, replacement hardware.
• Insurance and legal work to decide who pays, which leads straight into the responsibility question below.

Coopérative U's experience is the useful counterpoint. Its CEO said the cold chain held in most of its affected stores because staff and refrigeration contractors reacted quickly. Detection and response time made the difference between an alarm and a skip full of food.

The Danfoss controllers involved

In a statement to Cooling Post, Danfoss said most of the affected units were legacy products, and that the current-generation units involved were running outdated firmware. It named the models.

Danfoss also told Reuters it was aware of incidents in France affecting "a limited number of refrigeration management systems", and says it is working with customers on firmware updates where available, stronger network protection and removing direct internet exposure.

Two details matter for anyone who has to act on this. First, upgrading an AK-SM 800A is not a one-click job: according to the package readme, a unit on 3.x has to move to 4.x first, and once on 5.3.x it cannot be downgraded. Second, from version 4.0 a setting called Strict Session Control is on by default and makes HTTPS mandatory. In other words, a unit stuck on old firmware is also likely running a weaker login and session model.

How the attackers likely got in

This is where I want to be careful, because the official position is that the entry route is not established. CERT-FR has named no CVE, no firmware version and no method. What we do know builds a fairly clear picture.

The controllers were reachable from the internet

On Monday, Predicta Lab's Baptiste Robert counted 2,752 Danfoss systems exposed online, 1,590 of them in France. BleepingComputer noted that Shodan was tracking more than 4,500 internet-reachable Danfoss devices. CERT-FR's alert says plainly that exposing a management interface to the internet goes against good practice. You do not need a zero-day when the front door is on a search engine.

The end-of-life units cannot be fixed

Most of the hit units, by Danfoss's own account, were AK-SM 800 and AK-SC 355 systems that stopped receiving security updates years ago. Whatever weakness was used against those, there is no patch coming.

Known flaws in the newer model

For the AK-SM 800A, there is a public trail. CISA bulletins in May and August 2025 covered an authentication bypass (CVE-2025-41450) and a command injection flaw (CVE-2025-41451) in the AK-SM 8xxA series. Claroty's Team82 published its detailed research on 9 August 2026, describing a hidden "code-of-the-day" login mechanism derived from the date, and reporting thousands of AK-SM 800A interfaces reachable online. Danfoss fixed those flaws in firmware R4.3.1. Neither ANSSI nor Danfoss has linked them to this attack, but a published bypass plus thousands of exposed, unpatched units is the textbook setup.

This has happened before, on a smaller scale

Danfoss's own October 2025 customer newsletter recorded earlier attacks on the AK-SM 800: 16 Russian supermarkets in 2022, and 40 Israeli stores the same year, all of which lacked proper firewall or VPN protection. The warning was on paper a year before France.

Who is responsible?

Read the statements side by side and you can see the argument forming. Danfoss says it has long advised customers to keep firmware current and to replace legacy systems. Les Mousquetaires told Bloomberg the refrigeration systems were under Danfoss's management and that filing a complaint would fall to the supplier. Coopérative U's CEO said his stores do not buy from Danfoss directly but from refrigeration contractors who supply the Danfoss system. Leclerc said one of its refrigeration equipment suppliers had been attacked.

So everyone is pointing at someone else. Having spent around twenty years putting connected kit into buildings, I think each of them is partly right, and that is the actual problem.

The manufacturer

Danfoss did the textbook things on the newer platform: coordinated disclosure, fixed firmware, published advisories. It declared the AK-SM 800 end-of-life in 2021 and warned customers in writing. That counts. But end-of-life is a sales decision, not a physical event. A controller does not switch itself off when its support ends, and a vendor that knows thousands of its units are still internet-facing has more options than a newsletter. A hidden date-based login in a current product, which is what Claroty found, is also a design choice rather than a slip.

The installer and maintenance contractor

This is the party I think is least discussed and most central. Supermarkets do not commission plant room controllers themselves. A refrigeration contractor installs the system, decides how it connects for remote support, and holds the service agreement. If a controller was put directly on the internet so an engineer could dial in from a van, that was a connectivity decision made by whoever installed it. If firmware was never updated, the contractor is usually the only party with the access and the knowledge to do it.

The retailer

The retailer owns the asset, the stock and the customer. Food safety is its legal duty whoever wrote the contract. A business that runs hundreds of stores on refrigeration it cannot see, cannot patch and has not inventoried has outsourced the work but not the risk.

The regulatory gap

One reason this could happen at scale is that store refrigeration falls between the main cyber regimes.

• EU NIS2 covers food businesses engaged in wholesale distribution and industrial production and processing. Retail trade is not in that list, so the supermarket floor and its plant room are generally outside it. Distribution centres may be in scope.
• EU Cyber Resilience Act: manufacturers must report actively exploited vulnerabilities and serious incidents from 11 September 2026, including for products already on the market, with full obligations from 11 December 2027. That pushes vendors towards faster disclosure, but it does not reach back and fix a controller declared end-of-life in 2021.
• UK PSTI regime applies to consumer connectable products, not commercial refrigeration controllers.
• UK NIS Regulations cover energy, transport, health, drinking water and digital infrastructure, not food retail. The Cyber Security and Resilience Bill, now in the House of Lords with Royal Assent expected late in 2026, adds medium and large managed service providers. Whether a refrigeration contractor with remote access to hundreds of stores would count is not obvious from a definition written around IT outsourcing, and I would like to see that question asked in the Lords.

EU agriculture and food commissioner Christophe Hansen condemned the attack, warning that "the weaponisation of food has become a reality". Expect this incident to be cited when the scope of these laws is next reviewed.

How this could affect your business

None of the reporting I have seen mentions UK stores, but Danfoss controllers are common in UK food retail, cold storage and commercial buildings, and the pattern here is not specific to one brand or one country. If you run anything where a remotely managed controller sits between the internet and a physical process, this applies to you.

• Food retail, convenience and forecourts: the direct parallel. Remember that in England, Wales and Northern Ireland most chilled food must legally be held at 8°C or below, so a few hours of forced defrost is a disposal event, not an inconvenience.
• Cold stores and food logistics: larger volumes per site, and closer to NIS2 scope in the EU.
• Pharmacy and healthcare storage: temperature excursions mean quarantine and write-off.
• Building management, HVAC and EV charging: the same supervisory controller model, the same contractor remote access.
• Integrators and maintenance firms: you may be the party holding the access, and in future the party holding the liability.

The commercial questions are as important as the technical ones. Does your insurance treat a deliberate defrost as a cyber event or a refrigeration failure? Does your service contract name who is responsible for firmware and remote access security? If your contractor's remote access platform were compromised, how many of your sites would it reach at once?

The connectivity layer: where most of these go wrong

This is the part IoTPortal readers can actually fix, so it is worth being specific. In my experience a plant room controller usually ends up exposed in one of three ways:

1. A port forward on the store broadband router, set up years ago for an engineer and never removed.
2. A 4G or 5G router on a public IP SIM, fitted because the store network was off limits to the contractor, with the controller's web interface published straight through.
3. A dynamic DNS name with open ports, so the contractor can find the site when its address changes.

All three put the controller's login page on the internet, where scanners index it within hours. We explain how that indexing works in our guide to what Shodan can see.

The fix is not exotic. Remote access should run over an outbound VPN tunnel or a private APN, with the controller on a private address that cannot be reached from the internet at all. The router's own management interface should be off the WAN side. Access should go through one managed entry point with named accounts, which is also what Danfoss's own guidance recommends. We cover the addressing trade-off in private vs public IP for cellular IoT, and the router baseline in our cellular router security hardening guide.

What to check this week

If you own, install or maintain connected refrigeration or building plant, these are the checks I would run now, in this order.

Item 8 deserves a second look. An attacker who controls the supervisory controller may also control its alarms. A cheap independent temperature sensor on a separate cellular or LoRaWAN link, reporting to someone who is awake, is a very good return on investment after this week.

If you think a controller is compromised

CERT-FR's alert sets out six remediation steps for AK-SM and AK-SC units. They are a sound template for any compromised building controller.

1. Restrict network access to the controller so only your service providers can reach it.
2. Perform a factory reset.
3. Apply every available security update.
4. Rotate all secrets, including passwords and keys.
5. Review the existing user accounts.
6. Reconfigure the device completely rather than restoring an old configuration wholesale.

For the two end-of-life models, step three offers nothing, which is why replacement is the only lasting fix. Before you reset, export the logs and configuration if you can, so your insurer and investigators have something to work with. Our guide to OT backup and recovery covers keeping clean, known-good configurations on file before you need them.

Related reading