Attackers spike French supermarket fridge temps to 50C, spoiling stock at hundreds of stores
Cyberattackers manipulated refrigeration controls across major French chains, forcing retailers to discard perishable goods after temperatures rose to unsafe levels.
Key points
- Attackers raised temperatures in French supermarket cold rooms to as high as 50°C, spoiling food and triggering fires in some locations.
- The incident affected roughly 500 stores across chains like Intermarché, Carrefour, and Coopérative U, with losses estimated in the millions of euros.
- Manufacturer Danfoss stated the targeted systems were running outdated firmware, though officials have not confirmed the specific entry point used by attackers.
Cyberattackers manipulated refrigeration controls across hundreds of French supermarkets overnight from October 11 to 12, 2026, raising temperatures in cold storage units to as high as 50°C (122°F) and extending defrost cycles to eight hours to delay alarms, according to reports from Industrial Cyber. The attack forced retailers to discard perishable food and temporarily close some locations to prevent food safety risks.
Major chains including Intermarché, Coopérative U, Carrefour, Monoprix, and E.Leclerc were impacted, with approximately 300 Intermarché and Netto stores, 100 Coopérative U outlets, 80 Carrefour stores, and 30 Monoprix locations affected, according to Industrial Cyber. At one Intermarché in Gradignan, losses reached €21,000 at purchase value, while nationwide damages are expected to total several million euros or potentially tens of millions, the outlet reported. Some stores experienced temperatures reaching 80°C, and in certain cases, the heat started fires, according to The Register.
Technical context and vulnerabilities
The affected equipment includes refrigeration controllers produced by Danish manufacturer Danfoss, specifically the AK-SC and AK-SM series, as well as Copeland xweb and Dixell xweb systems, according to Industrial Cyber. Danfoss told reporters that the French supermarkets hit by the attacks were running outdated firmware and that the company has consistently advocated for keeping systems updated, according to The Register. Some of the compromised units were obsolete and no longer receive software or security updates, Industrial Cyber reported.
Security researchers from Claroty had previously disclosed vulnerabilities in the Danfoss AK-SM 800A platform in March and August 2025, which could allow attackers to take control of refrigeration systems, according to Industrial Cyber. Claroty identified a hidden authentication mechanism that accepted a code generated from the device's current date, bypassing the configured administrator password, according to The Register. Experts noted these flaws were easily scriptable and relied on a predictable authentication method, with one security professional stating it was a "zero-skill thing to pull off," according to The Register.
Investigation and response
France’s National Cybersecurity Agency (ANSSI) opened an investigation into the incident targeting the remote controllers of refrigeration systems, according to Industrial Cyber. The agency did not specify the risk level or confirm the exact exploitation method used in the October attacks, the outlet noted. Authorities have not confirmed whether the vulnerabilities disclosed by Claroty were exploited in this specific campaign, according to The Register. As a precaution against further attacks, affected supermarkets disconnected their refrigeration systems from networks, Industrial Cyber reported.
What should you do?
Security professionals should review their industrial control system configurations, particularly for legacy devices that may no longer receive updates. Organizations should verify that remote access to critical infrastructure is secured through protected networks or secure VPNs rather than public IP exposure. It is also advisable to check contractual insurance conditions before cutting off data transmission to service providers, according to Industrial Cyber.
What to do and how to stay safe: Danfoss
- Remove internet exposure for affected industrial control units and any devices accessible via public IP addresses to limit remote attack surfaces.
- Verify all configuration settings, including defrosting ranges and alarm thresholds, to ensure they have not been altered by unauthorized actors.
- Restore network access only through secure, protected channels such as a VPN rather than direct internet connections to prevent further compromise.
- Consult legal and insurance teams before disconnecting critical systems from service provider networks to understand contractual obligations and coverage implications.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which French supermarket chains were affected by the refrigeration cyberattack?
The attack affected hundreds of stores across major chains including Intermarché, Coopérative U, Carrefour, Monoprix, and E.Leclerc, according to Industrial Cyber.
Did attackers exploit the Danfoss vulnerabilities disclosed by Claroty?
Authorities have not confirmed the entry point or whether the previously disclosed Claroty vulnerabilities were exploited in this specific incident, according to The Register.
What specific equipment was targeted in the French supermarket attack?
The attack targeted refrigeration controllers including Danfoss AK-SC and AK-SM series, Copeland xweb, and Dixell xweb systems, according to Industrial Cyber.
