French supermarket cyberattack: Danfoss fridge controllers forced into defrost, stock spoiled, fires reported

Executive Summary

Overnight on October 11–12, 2026, an unidentified actor remotely sabotaged the refrigeration systems of hundreds of French supermarkets by abusing the legitimate defrost function of their store refrigeration controllers. Rather than deploying malware or demanding a ransom, the attacker changed operating parameters on internet-reachable controllers — made chiefly by the Danish manufacturer Danfoss — forcing cabinets and cold rooms to heat instead of cool. France's national CERT (CERT-FR, part of ANSSI) published alert CERTFR-2026-ALE-012 on October 12, stating it was aware of "numerous compromises" affecting the Danfoss AK-SM and AK-SC controller series, and later added the Copeland xweb and Dixell xweb product lines to the same alert.¹ The Paris prosecutor's office opened a criminal investigation on its own initiative, assigned to its cybercrime section and the anti-cybercrime office OFAC, to count victims and link the compromises to the reported damage, "including the outbreak of fires."²³

The scope spans most of France's major food retailers. Les Mousquetaires (Intermarché, Netto) was the worst hit: the group first reported roughly 150 Intermarché stores, with later tallies reaching at least 300 across both brands.⁴ Coopérative U reported 80 of about 2,000 stores affected; Carrefour reported 80 supermarkets; Monoprix about 30 (roughly 5% of its network); and E.Leclerc "several stores."⁴⁵ Affected cabinets were driven far above safe temperatures — employees described opening fridges that were "an oven inside," with one Intermarché site reporting cases at 32°C against a normal −23°C setting and discarding an entire frozen section of about 2,000 product lines worth roughly €50,000.³⁵ Thierry Cotillard, head of Les Mousquetaires, told BFMTV he expected losses in the "tens of millions of euros" nationwide.⁴

The mechanism is the story. According to reporting by Le Monde carried by L'Usine Digitale and Génération-NT, the attacker raised the controllers' defrost setpoint to around 50°C and extended the defrost cycle from roughly one hour to about eight hours — a change that both heated the stock and delayed the high-temperature alarms that would normally have alerted staff, amplifying the damage and leaving little time to react.⁵⁶ The entry route is not established. ANSSI's director general Vincent Strubel described the events as sabotage attacks causing product loss and fire risk and urged operators to disconnect the controllers from the internet; a person close to Prime Minister Sébastien Lecornu told AFP that ANSSI had identified a vulnerability in the Danish vendor's software and contacted it — but no CVE was named, and it has not been confirmed that any specific flaw was used in the attack.⁴⁵

Why it matters: this is a nation-scale operational-technology (OT) attack whose payload was not data but the physical world — spoiled food, melted equipment and fires — delivered by misusing a device's own documented control function rather than by exploiting a named zero-day. It also exposes a sharp campaign-versus-incident distinction. Claroty's Team82 published research on August 9, 2026 detailing three real vulnerabilities in the current Danfoss AK-SM 800A, and researcher Baptiste Robert (Predicta Lab) counted 2,752 of these systems exposed online, 1,590 of them in France. That context explains why the attack surface was so large, but none of it has been tied to this incident as the confirmed vector; CERT-FR named no vulnerability, firmware version, entry route or indicator of compromise as of October 13, 2026.¹⁷⁶

Verification of Claims

1. Claim: Refrigeration controllers at hundreds of French supermarkets were remotely compromised overnight on October 11–12, 2026. → Verified → CERT-FR's alert CERTFR-2026-ALE-012 confirms "numerous compromises" of Danfoss AK-SM/AK-SC (and later Copeland/Dixell xweb) remote controllers, and multiple retailers confirmed store-level impact.¹⁴⁵

2. Claim: The attacker abused the controllers' defrost function — raising the defrost setpoint to about 50°C and extending the cycle from roughly one hour to about eight hours to delay alarms. → Partially verified → CERT-FR's remediation guidance explicitly tells operators to review "defrost schedules," corroborating that defrost parameters were altered; the specific 50°C setpoint and 1h→8h extension are reported by Le Monde (via L'Usine Digitale and Génération-NT), not stated by a government source.¹⁵⁶

3. Claim: The Paris prosecutor opened a criminal investigation that includes a link to fires. → Verified → The Paris prosecutor's office confirmed to AFP it opened an inquiry into the "large-scale cyberattack," assigned to its cybercrime section and OFAC, covering the link to "the outbreak of fires."²³

4. Claim: The specific vulnerability or entry route used in the attack has been identified. → Unverified → A person close to PM Lecornu told AFP ANSSI "identified a vulnerability" in the vendor's software, but CERT-FR named no CVE, firmware version or entry route and published no IOCs; the Claroty and Synacktiv flaws remain context, not a confirmed vector.¹⁴⁶

5. Claim: No actor has claimed responsibility and there was no ransom demand. → Partially verified → As of October 13, 2026 no group had claimed the attack and no source reports a ransom demand; this is an absence confirmed against current reporting, not a guarantee none exists.⁴⁵⁶

Timeline

Attack Anatomy

The attack required no custom malware and left no ransom note. It is best read as misuse of a control system's own documented functions, reached over the open internet.

Exposure and remote access

Store refrigeration in large French chains is run by a central "system manager" — typically a Danfoss AK-SM 800/800A or an AK-SC 355 — that coordinates case and cold-room controllers and can trigger functions such as defrost. These managers expose an embedded web administration interface (Danfoss "StoreView"), reachable by IP address, and are routinely administered remotely by refrigeration maintenance firms (frigoristes) rather than by the retailer directly.⁵ CERT-FR states plainly that exposing such a management interface to the internet "goes against good practice," and that keeping an end-of-life device without security patches exposed online makes compromise highly likely.¹ Independent scanning quantified the surface: Baptiste Robert of Predicta Lab counted 2,752 Danfoss systems reachable online, 1,590 of them in France, "some without any password," and Shodan tracked over 4,500 reachable Danfoss devices (T0822, T0886).²⁶

Command and parameter manipulation

Once at a controller's management interface, the actor issued commands the device was built to accept — but without authorisation (T1692.001). The core abuse was of the defrost function: the defrost temperature setpoint was reportedly raised to about 50°C (and, in the most critical cases cited by one outlet, as high as 80°C), inverting the cabinet's purpose from cooling to heating (T0836, T0831).⁵⁶ Crucially, the defrost cycle duration was extended from roughly one hour to about eight hours. Because a controller suppresses its high-temperature alarms during a scheduled defrost, lengthening the cycle delayed the alarms that would have warned staff — an alarm-suppression effect achieved not by disabling alarms but by keeping the device in a state where they stay quiet (T0878).⁵⁶ CERT-FR's instruction to review "defrost schedules" as part of remediation corroborates that defrost parameters were the manipulated control.¹

Physical impact

With cooling inverted and alarms delayed through the night, cabinets climbed far above safe temperatures — reported at 32°C to above 40°C in affected cases against normal settings of −18°C to −23°C — spoiling stock across fresh and frozen sections (T0826, T0828). The Paris prosecutor's inquiry explicitly covers reported fires ("départs de feu"), and reporting describes equipment that began to catch fire or melt, moving the impact from spoilage into a safety event (T0880).²³⁵

Entry vector — what is not established

How the actor first reached the controllers is unknown. Experts including the French firm Synacktiv favour an opportunistic model — scanning the internet for exposed systems and exploiting known flaws or weak/default credentials — and Synacktiv noted an authentication bypass it says it reported in 2023 and again in 2025 that "could be linked" to the attack.⁶ Claroty's Team82 separately documented a "code-of-the-day" authentication bypass and a post-authentication command-injection path on the AK-SM 800A.⁷ None of this has been confirmed as the vector used here; CERT-FR named no vulnerability and published no indicators.¹

Threat Actor Profile

Name: Unknown Aliases: None — no persona has surfaced Attribution confidence: None. As of October 13, 2026 no group had claimed responsibility and neither ANSSI/CERT-FR nor the Paris prosecutor had attributed the attack.¹⁴ Motivation: Unknown. ANSSI characterised the events as sabotage (destructive) rather than extortion; no ransom demand has been reported, and the payload was physical disruption rather than data theft or encryption.⁴⁵⁶

The absence of a ransom note, a leak site, or a claim distinguishes this from financially motivated ransomware and points toward sabotage, but the actor's identity, nationality and intent are all unestablished. The scale and simultaneity across many retailers overnight are consistent with an opportunistic, scripted campaign against a large pool of exposed, often end-of-life controllers — the model favoured by Synacktiv — rather than a targeted intrusion into any single victim.⁶ ANSSI said it was in contact with other European cybersecurity agencies, and one analyst reported possible spillover beyond France (see Verification and Impact), but no coordinated-campaign attribution has been published.⁴ Sophistication appears low-to-moderate: the tradecraft is knowledge of a specific vendor's control functions and of how to reach exposed interfaces, not novel exploitation.

MITRE ATT&CK techniques (ICS matrix; IDs verified live on attack.mitre.org):

OPSEC: Unknown. No infrastructure, tooling or indicators have been published; CERT-FR had released no IOCs as of October 13, 2026.¹

Technical Indicators

network_iocs: none disclosed
file_hashes: none disclosed
note: >
  As of October 13, 2026 no network indicators, malware hashes, firmware
  versions, or entry vector had been published by CERT-FR, Danfoss, or the
  Paris prosecutor. The relevant defensive surface is exposure and
  configuration, not signatures.
exposure_surface:
  - 'Internet-facing Danfoss AK-SM 800 / AK-SM 800A / AK-SC 355 system managers (StoreView web interface)'
  - 'Also named by CERT-FR: Danfoss AK-SM / AK-SC series, Copeland xweb, Dixell xweb'
  - 'Remote administration by maintenance firms (frigoristes) over the open internet'
exposure_scale:
  - '2,752 Danfoss systems internet-exposed, 1,590 in France (Baptiste Robert / Predicta Lab, scan of Oct 12, 2026)'
  - 'Over 4,500 reachable Danfoss devices tracked by Shodan'
  - '~2,765 AK-SM 800A interfaces seen by Claroty Team82 via Censys/Shodan (Aug 2026 research, context only)'
abuse_technique:
  - 'Defrost setpoint raised to ~50C (reported up to 80C in worst cases)'
  - 'Defrost cycle extended from ~1h to ~8h, delaying high-temperature alarms'
context_cves:
  - 'CVE-2025-41450 (CVSS 8.2) AK-SM 800A code-of-the-day authentication bypass; fixed ~v4.2'
  - 'CVE-2025-41451 (CVSS 7.6) AK-SM 800A SMTP command injection to RCE (post-auth); fixed R4.3.1'
  - 'CVE-2025-41452 (CVSS 5.4) AK-SM 800A nginx config injection to DoS (post-auth); fixed R4.3.1'
  - 'NOTE: these are documented 2025/2026 flaws in the current model, NOT confirmed as used in this attack'

Legal and Regulatory Response

The Paris prosecutor's office (parquet de Paris) opened a criminal investigation on its own initiative on October 12, 2026, led by its cybercrime section and assigned to the anti-cybercrime office OFAC; the stated aims are to identify victims and establish the link between the compromises and the damage, including reported fires.²³ CERT-FR (ANSSI) issued alert CERTFR-2026-ALE-012 on October 12 (updated October 13), recommending that operators remove internet exposure of the affected controllers, perform a factory reset where a device is compromised and reconfigure before returning it to service, restore access only via VPN or a protected network, and apply vendor hardening (for Danfoss: set the security level to Strict and change default passwords); it warned that attack campaigns were probably still ongoing and that a factory reset alone is insufficient against reinfection.¹ ANSSI, tasked by Matignon (the prime minister's office), said it was coordinating with other European cybersecurity agencies.⁴ Danfoss told Reuters it was "aware of incidents in France affecting a limited number of refrigeration management systems" and told the trade outlet Cooling Post it was working with customers on firmware updates, stronger network protections and removing direct internet exposure; its public security-advisories page carried no advisory on the attack as of October 13, 2026.⁴ No charges, arrests, sanctions or regulatory penalties had been announced as of October 13, 2026.

Impact Assessment

• Confirmed: Numerous refrigeration controllers compromised across the AK-SM/AK-SC (and Copeland/Dixell xweb) families, per CERT-FR.¹
• Confirmed: Store-level impact at multiple national chains — Les Mousquetaires (Intermarché/Netto), Coopérative U, Carrefour, Monoprix and E.Leclerc — with spoiled stock discarded for food-safety reasons.⁴³⁵
• Reported, not independently confirmed: Store counts — at least 300 Intermarché/Netto (AFP tally; ~150 in early/Reuters figures), 80 of ~2,000 Coopérative U, 80 Carrefour, ~30 Monoprix (~5% of network), E.Leclerc "several."⁴⁵
• Reported, not independently confirmed: Fires ("départs de feu") and melted/overheating equipment, per the prosecutor and reporting.²⁵
• Reported, not independently confirmed: Per-site losses — one Intermarché frozen section ~€50,000 (≈2,000 product lines); an Issy-les-Moulineaux store ~€55,000; one Coopérative U hypermarket up to €180,000–200,000.³⁵
• Estimated: Nationwide losses in the "tens of millions of euros," per Les Mousquetaires head Thierry Cotillard to BFMTV.⁴
• Weak / single-source: Possible impact outside France (Spain, Portugal, Poland, Germany, Belgium), per analyst Félix Aimé (Sekoia) to Reuters, with no detail.⁴
• Unknown: Total number of stores and controllers affected, the entry vector, the actor, and whether any data was accessed.¹⁴

Lessons and Defensive Recommendations

For OT/ICS operators and retailers:

• Remove refrigeration system managers (Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb and equivalents) from direct internet exposure; restore remote access only via VPN or a protected network, per CERT-FR.¹
• Treat maintenance-firm remote access as part of your attack surface: inventory who can reach controllers, over what path, and whether default or shared credentials are in use.¹⁶
• Monitor and alarm on parameter changes themselves — a defrost setpoint near 50°C or a defrost cycle of several hours is an attack signature, not a legitimate setting; do not rely only on temperature-threshold alarms that an extended defrost suppresses.⁵⁶

For SOC/defenders:

• There are no published IOCs; hunt on exposure and configuration drift (internet-reachable management interfaces, unexpected defrost schedule or setpoint changes, new admin sessions) rather than signatures.¹
• Factory reset is not remediation on its own — CERT-FR warns an exposed, unpatched end-of-life device will be reinfected; reset, reconfigure, and remove exposure together.¹

For leadership:

• End-of-life OT that runs physical safety functions is a board-level risk: the AK-SM 800 (EOL 2021) and AK-SC 355 (phased out 2016) receive no security updates, yet still run cold chains. Budget for replacement, not just patching.⁴⁵
• Do not wait for a named CVE to act. The damage here came from misuse of a documented function over an exposed interface; the control that failed was network exposure and configuration governance, which you own regardless of vendor firmware.¹⁷

Sources