On the morning of October 12, 2026, staff opening Intermarché, Coopérative U and E.Leclerc stores across France found their freezers warm. Overnight someone had reached the controllers that run supermarket refrigeration and put the cabinets into defrost at 50 degrees Celsius. By October 13 the finance minister was telling Parliament that about 700 of the country’s 10,000 supermarkets had been hit. Nobody has claimed it and nobody asked for money, so the lesson is not a Danfoss bug story. The French supermarket cyber attack is a supply chain attack on the cold chain, delivered through the contractors and the ageing equipment that rival chains all share.
“We opened the fridge door, it was an oven inside,” one store manager told AFP. Keep that door in mind, because most organizations with contractor-managed building controls have one like it and have never checked who holds the key.
What happened in the French supermarket cyber attack
The sequence is short, and every step of it came from the companies involved rather than from the attackers.
- October 11, 2026, overnight into October 12. BFM TV, which broke the story, reported that attackers triggered forced defrosting with the setpoint at 50 degrees, and Le Monde added that some defrost cycles were stretched from one hour to eight to delay the alarms. Les Mousquetaires, owner of Intermarché and Netto, said cabinets in about 150 stores sat at 50 degrees for six hours.
- October 12, 2026. The Paris prosecutor opens an investigation and the prime minister hands the technical side to ANSSI, the national cybersecurity agency. Its response team, CERT-FR, publishes alert CERTFR-2026-ALE-012, which says it is aware of numerous compromises of Danfoss AK-SM and AK-SC controllers and tells operators to take them off the internet.
- October 13, 2026. CERT-FR adds Copeland xweb and Dixell xweb units to the alert as ANSSI confirms that Copeland and Dixell systems were also hacked. Copeland later acknowledges a vulnerability in a discontinued, end-of-life generation of controllers. Félix Aimé of Sekoia tells Reuters that Spain, Portugal, Poland, Germany and Belgium were affected as well.
- October 14, 2026. Still no claim of responsibility and no ransom demand, which a source inside the investigation told Reuters was puzzling.
The attackers did not break the fridges, they ran a feature
Defrost is maintenance. Every cold cabinet warms itself on a schedule to clear ice from the coils, and the controller decides when, for how long and to what temperature. Whoever got in changed those three numbers across hundreds of sites in one night, which is why Aimé told CNN the perpetrators do not appear to have used malicious code on the controllers at all. Joshua Steinman of Galvanick put it plainly to Industrial Cyber. Defrost is not an exploit, it is functionality, and there is no attack signature for a feature doing what it was designed to do.
These systems were designed for reliability and cost control rather than for defence, Antoine Hautin of the consultancy Almond told AFP, because for most of their history nobody could reach them remotely. Then the controller grew a web interface and a public IP address so a technician could service it from a van. That change is the supply chain.
Why the French supermarket cyber attack is a supply chain attack
Coopérative U’s chief executive, Dominique Schelcher, said the quiet part on RTL on October 13. His stores are not direct customers of Danfoss. They buy from refrigeration contractors who install the Danfoss system and keep it running. E.Leclerc described the event the same way, as a cyberattack that affected one of its refrigeration equipment suppliers. Count the parties in that sentence and you have the attack surface. The retailer owns the food. The contractor owns the controller’s configuration, its credentials and the remote access it uses for maintenance. The vendor shipped the box, declared the AK-SM 800 end-of-life in May 2021 and the AK-SC 355 in 2016, and fixed the current AK-SM 800A twice in 2025. The insurer wrote a policy that, according to Intermarché, does not cover this type of incident.
CERT-FR’s alert contains a line that only makes sense inside that tangle. Before you cut the internet feed from your controllers to your refrigeration contractor, it says, check the terms of your insurance contract. The national response team had to warn victims that the fix for the attack might void the policy meant to pay for it.
Ken Munro of Pen Test Partners told CNN there was no business need for the fridge controllers to be reachable from the public internet. Their management, he said, was likely outsourced to a third party that gave little thought to securing them. The exposure was no secret. A Censys scan in Claroty’s August research found 2,765 Danfoss AK-SM 800A interfaces on the open internet, and a Reuters scan on October 13 still found at least 4,500, many on outdated versions according to the scanning firm Onyphe.
Our position is that none of those retailers lost food because of a missing patch. They lost it because the question “who can reach our cold rooms from the internet” had an answer, and nobody on the retailer’s side had asked it. We drew the same lesson from the Check Point management interfaces exploited in September. A device a contractor can reach from the internet is part of your attack surface, whoever’s name is on the service contract.
The flaws were public since August, the fixes since 2025
Claroty published its Danfoss research on August 9, 2026. The headline finding was a hidden “code of the day” login in the AK-SM 800A web interface, a maintenance password generated from the device’s date that anyone who reproduced the algorithm could use for a full administrative session. Behind it sat a command injection that gave remote code execution. Danfoss had already shipped the fixes, version 4.2 for the authentication bypass and 4.3.1 for the command injection.
The pattern repeats across vendors. Claroty also found an authentication bypass in Copeland’s XWEB Pro controllers up to version 1.12.1, and in September 2025 Armis reported ten flaws in Copeland’s E2 and E3 controllers that together gave unauthenticated remote code execution, fixed in firmware 2.31F01. All of it was patched and all of it kept running unpatched in stores, because patching a controller means a technician visit and a cold cabinet offline. Nor was this the first time. Danfoss’s own October 2025 newsletter, as The Hacker News reported, records 16 Russian and 40 Israeli supermarkets whose AK-SM 800 units were attacked in 2022, the Israeli ones all without firewall or VPN protection.
What nobody has published is the path used in France. CERT-FR’s alert names no vulnerability and no firmware version. Danfoss says the affected units were legacy products or current products on outdated firmware. A person close to the prime minister told AFP that ANSSI had found a vulnerability in the Danish vendor’s software, without saying it was the one used. We treat the entry point as unknown. What is known is enough to act on, which is units that cannot be patched, sitting on public addresses, with maintenance logins that follow a calendar.
Who was hit, and what one morning cost
The counts moved as the chains checked their sites. AFP’s October 13 tally was at least 300 Intermarché and Netto stores, under a hundred Coopérative U, 80 Carrefour out of 6,000, around thirty Monoprix and several E.Leclerc, against the finance minister’s 700 of France’s 10,000 supermarkets.
| Period | Value |
|---|---|
| Supermarkets hit | 700 |
| Supermarkets in France | 10,000 |
The most useful number in the story is the split inside Coopérative U. Schelcher said 80 of his 2,000 stores were hit and that the great majority countered the attack in time, thanks to store owners, their teams and their refrigeration contractors. Only a minority broke the cold chain and threw goods away. Intermarché, by contrast, told AFP its affected stores had to throw away all of the products that were fresh or frozen, and its chief executive expected tens of millions of euros of losses nationwide from a single morning. Same attack, same equipment, very different mornings, and the difference was whether a human noticed a setpoint change at night and whether a contractor answered the phone.
That is the detection story for an incident with no malware. The signals were a defrost schedule changed outside any maintenance window, a setpoint moved by tens of degrees, and controller logins from addresses that belonged to no contractor. Ordinary alarms and ordinary log lines, and the stores that kept their food were the ones where somebody was awake to them.
The campaign may not be over
CERT-FR’s October 13 update says attack campaigns against these controllers are probably still ongoing, and it is explicit about end-of-life units. An unpatchable device left on the internet faces a very high probability of compromise, and a factory reset on its own is useless because the unit stays vulnerable and will be taken again. The prescription is to remove every controller from public addresses, bring access back through a VPN or a protected network, treat firewall filtering of contractor IPs as a stopgap, and then re-check the whole configuration, defrost ranges included.
What to ask your team this week
These are third party risk management questions, and they apply to any organization whose refrigeration, heating, access control or building management is run by a contractor.
- Which building controls does a contractor manage for us, and which of them answer on a public IP address? If nobody can produce that list this week, your contractor has it and you do not.
- Who holds the credentials for those devices, and are any of them vendor defaults or date-derived maintenance codes?
- Which of those devices has the vendor stopped patching, and what is the replacement date? A controller declared end-of-life in 2021 is not a maintenance item, it is an open door.
- What does the contract say about security, remote access and incident notification? Munro’s question for boards was who held contractual oversight for the security of these fridges.
- Does the insurance policy name this scenario in writing? Intermarché found out on the day that its policy did not.
- Would anyone be paged for a setpoint change at two in the morning? Alarm thresholds, who receives them, and whether a defrost change outside a maintenance window opens a ticket.
The first three are inventory and exposure work, the unglamorous half of what we do in security engineering. In our experience the list of contractor-managed devices on public addresses is longer than the person who signed the contract believes.
Bottom line
Treat every contractor-managed controller as part of your attack surface. Get it off public addresses this week, behind a VPN the contractor uses, on firmware the vendor still supports, and replace the units it does not. Then read the service contract and the insurance policy, because the French retailers learned on October 12 that neither covered the night a feature ran exactly as designed.