Hackers Triggered Defrost Mode in French Supermarket Fridges, Causing Fires
Attackers forced refrigeration units into heating mode across hundreds of French stores, damaging equipment and destroying food inventory.
Key points
- Hundreds of French supermarkets suffered equipment damage when attackers forced fridges into defrost mode on the night of October 11-12, 2026.
- IPinfo data showed France had 1,331 exposed fridge dashboards before the attack, with 85% running software containing known security flaws.
- Major retailers including Carrefour, Intermarché, Netto, and Monoprix confirmed impacts, with Danfoss identifying legacy controllers as the primary vector.
On the night of October 11 to 12, 2026, cyber attackers manipulated refrigeration systems in hundreds of French supermarkets, forcing units into automatic defrost mode. This action heated the cooling components to melt ice, causing some equipment to reach 50°C (122°F) and start fires, according to the Paris prosecutor. Stores were forced to discard fresh and frozen food due to the temperature spikes.
The attack targeted controllers made by Danfoss, a Danish industrial company. IPinfo, which scans internet-connected devices, found that France had more exposed fridge dashboards than the rest of the world combined before the incident. Specifically, 1,331 dashboards were exposed in France, compared to 1,197 across 72 other countries and territories. Of the French systems, 85% ran software with known security flaws, including 527 older controllers that Danfoss no longer supports.
Context and Background
Most of the exposed systems in France had been accessible online for at least six months prior to the attack. IPinfo noted that 1,019 of the French dashboards were at the same address on March 30, 2026. During that period, the share of fully updated systems rose only from 14% to 24%. The exposure rate in France was not significantly worse than in other countries, where the flawed share was nearly identical at 84%. However, the sheer volume of exposed systems in France made it a primary target.
Following the attack, most of the targeted dashboards went offline. By October 14, 2026, only 316 of the original 1,331 systems remained online. CERT-FR, France’s cybersecurity agency, confirmed it was aware of numerous compromises involving AK-SM and AK-SC controllers. Danfoss stated that most of the affected equipment was legacy hardware, specifically naming the AK-SM 800 and AK-SC 355 models as the vulnerable devices.
Who Is Affected
The number of affected stores continued to grow in the days following the breach. Futura-Sciences reported that more than 400 stores were hit in total, with potential losses reaching several million euros. Carrefour confirmed that 80 of its stores were impacted. Intermarché and Netto, both part of the Les Mousquetaires retail group, reported more than 300 affected locations. Monoprix stated that approximately 5% of its stores were affected by the incident.
Leclerc and Coopérative U also confirmed they were targeted. Dominique Schelcher, CEO of Coopérative U, told RTL that 80 of its 2,000 stores were hit. He clarified that the stores do not purchase Danfoss systems directly but use them via refrigeration contractors. This supply chain detail highlights how legacy industrial controls can remain exposed even when managed by third-party vendors, leaving retail infrastructure vulnerable to remote manipulation.
What should you do?
Security professionals should monitor for unusual temperature readings or power consumption spikes in industrial control systems. Organizations using legacy hardware should prioritize network segmentation to isolate critical infrastructure from public internet access. Regular audits of exposed dashboards and admin panels are essential to identify unauthorized access points.
What to do and how to stay safe: Danfoss
- Audit all internet-facing industrial control system dashboards and remove any that are not strictly necessary for remote management.
- Verify that all refrigeration controllers and similar IoT devices are running the latest available firmware versions provided by the vendor.
- Implement strict network segmentation to ensure that operational technology networks cannot be accessed directly from the corporate or public internet.
- Monitor system logs for unauthorized commands, particularly those related to temperature control or defrost cycles, to detect early signs of compromise.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Danfoss controllers were identified as vulnerable in this attack?
Danfoss identified the AK-SM 800 and AK-SC 355 as the legacy controller models most commonly affected by the compromise.
How many exposed fridge dashboards were found in France before the attack?
IPinfo scans revealed 1,331 exposed fridge dashboards in France, which was more than the rest of the world combined.
Did the attack result in physical damage to the supermarket equipment?
Yes, the Paris prosecutor reported that some equipment started to catch fire after reaching temperatures of 50°C (122°F) during the forced defrost cycle.
