Sabotage Foretold: Why the Cyberattack on France’s Supermarket Refrigeration Was Preventable

In a cyberattack on the night of October 11–12, intruders turned the refrigeration in hundreds of French supermarkets into heating, and the stores had to throw out their chilled and frozen food. The damage could have been avoided: most of the affected Danfoss controllers were legacy devices without security updates, and their vulnerabilities had been public for years.

What happened on the night of October 11–12?

The attack on an Intermarché in Gradignan near Bordeaux began around 11 p.m. on Sunday. That is how the store’s operator described it to Le Monde. He only noticed the attack around 4 a.m. and found his storeroom under water. The attack hit hundreds of stores. In around 150 Intermarché branches, the display cases ran at 50 °C for six hours. That is what the parent group Les Mousquetaires said, according to Reuters.

The company later told broadcaster BFMTV that around 300 Intermarché and Netto stores were affected. Carrefour counted 80 affected stores, Monoprix five percent of its roughly 490 branches. Coopérative U also confirmed attacks, and according to media reports E.Leclerc was hit as well.

The Paris prosecutor’s office is investigating and intends to document the damage, including reported fires. Prime Minister Sébastien Lecornu has called in ANSSI, France’s national cybersecurity agency. Intermarché chief Thierry Cotillard puts the nationwide damage in the tens of millions of euros, from a single day.

The attackers abused a function every display case has: defrosting. During operation, moisture from the air builds up as ice on the evaporator, the component that produces the cold. Several times a day, the controller therefore switches off the cooling and briefly heats the evaporator, usually with electric heating elements. According to Le Monde’s reporting, the attackers set the defrost temperature to 50 °C and extended defrosting from one hour to eight.

In some stores, they reportedly also delayed the alarms this way. A central device in each store controls these processes: the system manager. It coordinates the controllers of all display cases and is operated through a web page in the browser. Initial investigations point to system managers made by Danfoss.

Most of the affected devices are legacy AK-SM800 and AK-SC355 systems, the manufacturer told French news site ZATAZ. They have reached the end of their life, and Danfoss no longer provides security updates for them. Affected units of the successor model AK-SM800A were running outdated firmware, the device’s operating software.

Danfoss speaks of a limited number of affected systems. CERT-FR, ANSSI’s computer emergency response team, by contrast reports numerous AK-SM and AK-SC series devices that attackers have broken into. Spain, Portugal, Poland, Germany and Belgium are also affected, an analyst at French security firm Sekoia said, according to Reuters.

As of October 13, there was no confirmation from Germany. Who is behind the attack remains unclear. No one has claimed responsibility so far.

Could the attack have been prevented?

Yes. There were three levers, and all of them were known long before the attack.

• The first lever is the age of the devices. According to a customer notice, Danfoss took the AK-SC355 off the market in October 2016. The manufacturer planned no new software features for it. In May 2023, French security firm Synacktiv published a vulnerability in the AK-SM800 and the older SC255 and SC355 models. In addition to the password, the devices accepted a daily code that could be calculated from the date alone. They revealed the date without any login. Danfoss acknowledged the report in March 2023 but stated that only the legacy SM800 and SC255 devices were affected. The manufacturer defined protective measures for the network and informed its customers. There was no security update. Danfoss later disputed some of the report’s statements. Anyone running a device without updates has no way to close newly discovered vulnerabilities. Such a device has to go, or it must no longer be connected to the internet.
  
  
• The second lever is network isolation. Danfoss itself demonstrates that such attacks are not just theory. In a publication from October 2025, reported on by the French trade site InformatiqueNews, the manufacturer describes earlier cases. In 2022, at the start of the war in Ukraine, attackers hit 16 supermarkets in Russia that used the AK-SM800. That same year, 40 stores in Israel were hit. According to Danfoss, at least some of these systems lacked adequate protection from a firewall or VPN. A firewall blocks unwanted network traffic; a VPN is an encrypted tunnel into the internal network. Danfoss recommended switching to the newer AK-SM800A.
  
  
• The third lever is updates for the newer devices. The AK-SM800A also contained a vulnerability, which Danfoss fixed in March 2025 with firmware R4.2. In May 2025, the US cybersecurity agency CISA issued a public warning: the device generated a password from the date and time, which could allow attackers to bypass the login. CISA also advised keeping such controllers off the internet. In August 2025, Danfoss closed two further vulnerabilities with R4.3.1.

In August 2026, researchers at security firm Claroty published the technical details. They describe a hidden login path that calculates a new password from the date every day. It was probably intended for support and maintenance. Anyone who knows the calculation can log in as administrator without the password set by the operator. The researchers counted 2,765 AK-SM800A units that were reachable from the internet.

To do so, they used Censys, a search engine for networked devices. The daily code derived from the date was therefore present in both device generations. Kévin Tellier of Synacktiv considers the attack to have been predictable. The problem had been known for years, he told InformatiqueNews. A few weeks earlier, his team had audited security at supermarket chains. In the process, it came across another manufacturer’s user interface. It could be opened with an empty username and an empty password. The authorities have not disclosed which vulnerability the attackers exploited in France. According to sources close to the prime minister, ANSSI has found a vulnerability in Danfoss software. Neither the authorities nor Danfoss have so far linked the known vulnerabilities to the attack.

For the question of whether the attack was preventable, that is secondary. Each of the three levers would have significantly reduced the attack surface.

Why were the systems reachable over the internet?

Because remote maintenance is routine in food retail. Refrigeration contractors monitor their customers’ systems remotely. They receive alarms, check temperatures and change settings in the browser without having to drive out at night. That saves time and money. How well this access is protected varies from store to store. Some operators and service providers put the web interface directly on the internet. Others use a VPN or a dedicated maintenance platform.

For CERT-FR, a management interface that is reachable from the internet runs counter to good practice. Danfoss says it is working with affected customers to cut direct internet connections where they exist. This suggests that at least some of the affected devices were openly reachable. That systems stayed unprotected for so long is also down to how the sector is organized. Intermarché, E.Leclerc and Coopérative U are networks of independent retailers.

The refrigeration system usually belongs to the individual store owner. Maintenance is mostly handled by refrigeration contractors, some of them with permanent remote access. Refrigeration counts as building services and does not always appear in the IT department’s asset inventory. Then there is the effort involved. Some systems are hard to update because a technician has to come on site with a USB stick, Tellier reports. Replacing a system manager means installing it, transferring the settings and testing everything. And who replaces a device that still keeps things reliably cold?

A VPN alone would not have solved the problem. A refrigeration contractor with access to hundreds of stores would itself be a master key. The case of US retailer Target showed in 2013 how risky access by service providers can be. According to a US Senate report, attackers stole the credentials of Fazio Mechanical, a refrigeration contractor for supermarkets. Fazio had access to Target’s network to handle billing and projects. From there, according to the report, the attackers likely made their way to the point-of-sale systems. In the end, they stole data on up to 110 million customers. Whether the attackers in France went after directly reachable devices or hijacked a maintenance connection is still unclear.

What needs to change?

The lessons are not new. They concern everyone involved.

• Store operators: They need an inventory of every device with a web interface, from refrigeration controllers to cameras: model, firmware version, end of updates, responsible maintenance firm. Devices without updates should be replaced or completely disconnected from the internet. No user interface should be directly reachable from the internet. Where remote maintenance is indispensable, CERT-FR advises restricting access to trusted IP addresses.
  
  
• Maintenance firms: Every technician needs a personal account with two-factor authentication, meaning a second proof of identity besides the password, such as a code on a smartphone. Remote access should only be open when needed and for a limited time. Every intervention should be logged.
  
  
• Contracts: Maintenance contracts must specify who tracks security vulnerabilities, who installs updates and who decides that a legacy device has to go.
  
  
• Manufacturers: Hidden login paths with predictable passwords must be abolished. Danfoss is not alone in this. Researchers at security firm Armis found an administrator account named ONEDAY in the E3 refrigeration and building controller made by Copeland. Its password was regenerated every day and was predictable. The account could not be deleted or changed. Copeland has since fixed the vulnerability.
  
  
• Independent safeguards: Alarms must not run solely through the device that attackers can take over. A simple addition is wireless temperature sensors with their own connection that raise the alarm themselves when readings deviate. The defrost heating also needs limits that cannot be lifted remotely.

What comparable cases have there been?

The French case is not an isolated one. A selection:

• US military supermarkets, August 2026: In late August, the refrigeration failed at several commissaries, as the supermarkets on US military bases are called. Affected sites included Fort Irwin in California and Naval Station Newport in Rhode Island. At Fort Huachuca, Arizona, all freezers went into defrost mode overnight, according to the base, and the entire frozen stock spoiled. The US Department of Defense acknowledged a possible disruption but did not comment on the cause. Army and Air Force investigators are looking into the outages. A cyberattack has not been confirmed, and neither has a link to France.
• Water utilities in the US, November 2023: US authorities consider the group CyberAv3ngers to be affiliated with Iran’s Islamic Revolutionary Guard Corps. It broke into controllers made by Israeli manufacturer Unitronics at several US water facilities, including in Aliquippa, Pennsylvania. According to the authorities, default passwords on devices reachable from the internet were probably all it took.
  
  
• Pro-Russian groups, since 2024: In January 2024, the group Cyber Army of Russia Reborn (CARR) caused a water tank to overflow in Muleshoe, Texas. Google subsidiary Mandiant believes CARR is backed by Sandworm, a unit of Russia’s GRU military intelligence service. According to Mandiant, Sandworm was likely also behind attacks on water utilities in Poland and on a small water mill in France. Mandiant left open whether the unit directs CARR or whether the group merely reports to it after attacks. In April 2025, attackers opened an outlet at a dam in Bremanger, Norway, releasing 500 liters of water per second for four hours. Norway’s domestic intelligence service PST blamed pro-Russian actors. In December 2025, the FBI, CISA, NSA and partner agencies warned about CARR and three other groups. According to the agencies, GRU unit 74455 likely supported the creation of CARR. The groups look for poorly secured user interfaces that are reachable from the internet via the remote-access software VNC. They change setpoints, meaning target values for parameters such as fill levels or pressures, and clear alarms. According to the agencies, their targets also include the food and agriculture sector.

The method resembles the French case: reachable controllers, altered setpoints, delayed or cleared alarms. One difference remains: the pro-Russian groups often publish their attacks as videos or screenshots to attract attention. As of October 13, no one had claimed responsibility for the attack on the French supermarkets. There is no attribution.

Conclusion

Based on everything known so far, the attackers needed little: a defrost function, controllers with known weaknesses and devices without updates. Both generations of Danfoss devices contained login paths with daily codes derived from the date. And in many stores, discontinued devices kept running for years. Supermarket refrigeration is part of the food supply. So far, many have treated it like an ordinary fridge. 

How were hackers able to manipulate the refrigeration in French supermarkets?

The attackers broke into system managers made by Danfoss, which control all the refrigerated display cases in a store. According to media reports, they set defrosting to 50 °C and extended it to up to eight hours. French authorities have not yet disclosed which vulnerability they exploited.

Which Danfoss devices are affected by the attack?

According to Danfoss, mainly the legacy AK-SM800 and AK-SC355 systems, for which there are no more security updates. AK-SM800A devices running outdated firmware were also hit. Updates are available for the AK-SM800A, including version R4.3.1 from August 2025.

Are supermarkets in other European countries affected?

According to Reuters, an analyst at the security firm Sekoia named Germany, Spain, Portugal, Poland and Belgium in addition to France. As of October 13, 2026, there was no confirmation from German authorities or retailers. Operators of Danfoss refrigeration controllers should check their devices regardless.

Who is behind the cyberattack on the supermarket refrigeration systems?

That is still unknown. As of October 13, 2026, no one had claimed responsibility for the attack; the Paris prosecutor’s office and the cybersecurity agency ANSSI are investigating. The method resembles earlier attacks on industrial controllers, but there is no attribution.

How can operators protect networked refrigeration systems from cyberattacks?

Refrigeration controllers should not be directly reachable from the internet. France’s CERT-FR advises cutting or filtering access and allowing remote maintenance only from trusted IP addresses. Devices without security updates should be replaced, and remote maintenance should run through personal accounts with two-factor authentication. Temperature alarms that work independently of the controller also help.

- Advertisement -