Key points
- Temperatures in French supermarket cold rooms rose to 50 degrees Celsius during the attack.
- Major chains including Intermarché, Carrefour and Coopérative U confirmed stock spoilage.
- Danfoss states affected devices were running outdated firmware with known authentication flaws.
The short version
- Cyberattacks disrupted refrigeration systems across hundreds of French retail locations in early October 2026.
- Attackers manipulated temperature controls and defrost cycles, causing food spoilage and potential fire risks.
- The incident highlights risks associated with unpatched industrial control software and remote access vulnerabilities.
The details
Cyberattacks targeted refrigeration systems in French supermarkets, raising internal temperatures to 50 degrees Celsius and forcing the disposal of perishable stock. According to Industrial Cyber, the incident affected approximately 300 Intermarché and Netto stores, 100 Coopérative U outlets, 80 Carrefour locations and 30 Monoprix sites. Some E.Leclerc stores were also impacted. Attackers manipulated defrost settings, extending cycles from one hour to eight hours to delay alarms. At one location, temperatures reportedly reached 80 degrees Celsius, creating fire hazards. Staff at some stores temporarily closed locations to clear spoiled products and mitigate food safety risks.
Danfoss, the Danish manufacturer of the affected refrigeration controllers, stated that the equipment in compromised stores was running outdated firmware. The company noted it had consistently advocated for system updates. The affected hardware included the Copeland xweb, Danfoss AK-SC series, Danfoss AK-SM series and Dixell xweb controllers. According to Industrial Cyber, some of these units were obsolete and no longer received software or security updates. France’s National Cybersecurity Agency (ANSSI) opened an investigation into the incident.
The context
Researchers from Claroty previously disclosed vulnerabilities in Danfoss systems in March and August 2025. They identified a hidden authentication mechanism in the AK-SM 800A platform that accepted codes generated from the device's current date. This allowed attackers to bypass configured administrator passwords using a predictable algorithm. Security professional Kevin Beaumont described the exploit as requiring zero skill, noting he wrote a bash script to demonstrate the attack. Authorities have not confirmed whether these specific vulnerabilities were exploited in the French supermarket attacks.
What to watch
- ANSSI investigation results regarding the entry point and specific vulnerabilities exploited.
- Danfoss statements on whether additional firmware updates or patches are available for older systems.
- Potential regulatory changes regarding remote access controls for critical infrastructure in retail.
- Reports of similar attacks targeting other retail or industrial sectors using legacy control systems.
What it means for organisations
Organisations must review their supply chain security posture, particularly for critical operational technology. Teams usually need to verify that all connected devices receive timely security updates. Check whether remote access protocols for industrial controllers are adequately secured against unauthorized entry. Ensure that incident response plans include procedures for physical safety risks, such as fire or food spoilage. Communicate clearly with suppliers about firmware support lifecycles and end-of-life notifications. Involve operations, IT security and legal teams in assessing contractual liabilities related to equipment failures or cyber incidents.
Background: Supply chain attacks
A supply chain attack targets the software or hardware you use before it reaches you. By compromising a trusted vendor, attackers insert malicious code that installs automatically on your systems when you update or deploy the product. This bypasses perimeter defenses because the malicious payload arrives with a valid digital signature.
Read the full guide: Supply Chain Attacks: How Trust Becomes Your Biggest Security Risk
What to do and how to stay safe: Danfoss
- Audit all industrial control systems for outdated firmware and apply available security patches immediately.
- Restrict remote access to critical infrastructure using secure VPNs or protected networks rather than direct internet exposure.
- Monitor system logs for unusual changes in temperature settings or defrost cycle durations.
- Verify contractual insurance coverage for cyber incidents that result in physical damage or product loss.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which supermarket chains were affected by the refrigeration cyberattacks?
Intermarché, Netto, Coopérative U, Carrefour, Monoprix and some E.Leclerc stores were affected.
Did attackers exploit the known Danfoss vulnerabilities?
Authorities have not confirmed whether the previously disclosed Claroty vulnerabilities were used in these attacks.
What did Danfoss say about the affected equipment?
Danfoss stated that the affected stores were running outdated firmware and that some units were obsolete.
