On the night of 11 to 12 October 2026, at least 350 French supermarkets found their refrigerated cases and freezers warm, according to Reuters. Les Mousquetaires, which owns Intermarché, said temperatures reached 50 °C. The Paris prosecutor’s office opened an inquiry, led by the OFAC cybercrime office.
As of 20 October, the sources we checked show no claim of responsibility and no official account of how the attackers got in. What the attackers did is clear, though, and it is not a French problem. The same controllers run cold rooms and display cases across Europe and beyond, and thousands of them answer on the open internet. The incident is also a live test of how the EU’s new cyber rules apply to a sector that sits partly outside them.
How does a supermarket refrigeration controller work?
Each display case has a small regulator that reads temperature and drives fans, valves and defrost. Above them sits a system manager that coordinates the whole store. In Danfoss’s range the current model is the AK-SM 800A. According to Claroty, a single console lets operators monitor circuits, set temperature thresholds, review alarms, change schedules and manage users and maintenance remotely.
Defrost is one of those schedules. Moisture in the air freezes on the evaporator, the cold part of the system, and cuts its efficiency. The controller periodically pauses cooling and warms the evaporator until the ice melts. Normally the cycle is short and ends when a probe reports the coil is clear, or when a maximum time runs out.
These consoles are online for maintenance. Refrigeration contractors install and service the systems and look after many stores remotely, which Claroty says is what keeps maintenance costs down. Coopérative U does not buy from Danfoss directly: its stores are customers of contractors who supply the system, chief executive Dominique Schelcher said. There is a contractual angle too. France’s CERT-FR tells operators to check their insurance terms before cutting the data feed to the contractor.
How did attackers heat the fridges to 50 °C?
According to BleepingComputer, the attackers took over the controllers and triggered the automatic defrost function built into the system. A routine feature was pushed past its normal duration and temperature limits, overnight, with stores closed.
How they got in has not been established. As of 13 October CERT-FR had named no vulnerability, firmware version or entry point, The Hacker News reported. A person close to Prime Minister Sébastien Lecornu told AFP that ANSSI, France’s cybersecurity agency, had identified a vulnerability in Danfoss software. The statement does not say it was the one used.
| Product | Maker | Status per maker or authorities | Known flaws and fixes |
| AK-SC 355 | Danfoss | Phased out in 2016, no updates | No fix available |
| AK-SM 800 | Danfoss | End of life since May 2021, no updates | No fix available |
| AK-SM 800A | Danfoss | Current model; some units hit were on outdated firmware | CVE-2025-41450 fixed in version 4.2; CVE-2025-41451 and CVE-2025-41452 fixed in R4.3.1. Latest package listed on 13 October: 5.3.x |
| XWEB | Copeland and Dixell | Added to the CERT-FR alert on 13 October; Copeland declined to confirm | For XWEB Pro, Claroty reported 23 flaws in August (21 high severity), fixed in firmware 1.13 |
The best documented flaw is CVE-2025-41450, which Claroty described on 9 August 2026. The AK-SM 800A accepted a “code of the day”, derived from the device’s date, in place of the administrator password. The researchers rebuilt the algorithm from the firmware, so anyone repeating the work could log in with full rights. US agency CISA flagged it in May 2025 and a related command-injection flaw in August 2025, according to BleepingComputer. Neither the authorities nor Danfoss have linked these flaws to the attack, and Claroty only tested the newer model.
How many refrigeration controllers are exposed online?
Thousands, worldwide. The published counts differ, and the reason matters for anyone sizing their own exposure.
| Who counted | When | What | Result |
| SOCRadar (Censys) | 13 October 2026 | Unique hosts in France with the Danfoss StoreView interface | 881 |
| SOCRadar (Shodan) | 13 October 2026 | Results for the StoreView interface | 4,481 worldwide, 2,898 of them in France (about 65%) |
| Reuters (Shodan) | 13 October 2026 | Visible Danfoss interfaces | At least 4,500 |
| Predicta Lab (Baptiste Robert), via BleepingComputer | 12 October 2026 | Exposed Danfoss systems | 2,752, of which 1,590 in France |
| Claroty (Censys) | August 2026 | AK-SM 800A interfaces | 2,765 |
Shodan counts services, so one device answering on several ports appears more than once; Censys counts hosts. SOCRadar’s fair range for France is about 900 devices and 2,900 services. None of these figures says how many devices are vulnerable. French scanning firm Onyphe told Reuters only a small minority appeared to run the latest software. TIME reported that scans also found exposed Danfoss controllers in South Africa, the United States and the United Kingdom.
This has happened before. In an October 2025 newsletter, cited by The Hacker News, Danfoss recorded 2022 attacks on AK-SM 800 systems at 16 Russian supermarkets and 40 Israeli stores, the latter all lacking proper firewall or VPN protection. Ken Munro of Pen Test Partners told Reuters it was “about basic cyber hygiene”.
Does NIS2 cover supermarkets?
Not as shops. Annex II of Directive (EU) 2022/2555 covers food businesses engaged in wholesale distribution and industrial production and processing. The Finnish Food Authority, which supervises NIS2 in the sector, states plainly that retail trade is outside its scope. A retail group’s wholesale arm can still be in scope if it is at least medium-sized: 50 or more staff, or turnover and balance sheet above €10 million. Italy transposed the same perimeter in Legislative Decree 138/2024.
In practice, a store that loses its cold chain to a cyberattack may have no NIS2 reporting duty at all, while the group’s distribution company next door does.
What does the Cyber Resilience Act require from the manufacturers?
The Cyber Resilience Act, Regulation (EU) 2024/2847, applies in full from 11 December 2027, but Article 14 has applied since 11 September 2026. Manufacturers of products with digital elements must report actively exploited vulnerabilities: an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report within 14 days of a fix being available. Under Article 69(3) the duty also covers products placed on the EU market before December 2027. We covered the details in our guide to CRA Article 14.
The trigger is reliable evidence that a malicious actor exploited a vulnerability in the product. The investigation has not named one. If it turns out to be in a Danfoss or Copeland product, the manufacturer would have to report through ENISA’s single reporting platform; whether either has done so is not public. One question stays open: whether the duty reaches devices the maker declared unsupported years ago, such as the AK-SC 355. We found no authority’s position on that point.
| Rule | Who it binds | What it requires | In this case |
| NIS2: Directive (EU) 2022/2555 | Food wholesale and industrial production or processing above size thresholds; not retail | Security measures, reporting of significant incidents | Applies to a group’s wholesale company, not the individual store |
| Cyber Resilience Act: Regulation (EU) 2024/2847, Art. 14 | Manufacturers of products with digital elements | Early warning in 24 hours, notification in 72 hours, final report 14 days after a fix | Only if a product vulnerability is shown to have been exploited |
| Regulation (EC) No 852/2004 | Food business operators | The cold chain must not be interrupted | Exposed goods assessed and discarded if unsafe |
What should operators of connected refrigeration do now?
CERT-FR’s alert, last updated on 16 October, gives the order:
- Remove internet exposure for the controllers and any other unit on a public IP address, after checking insurance and contractor terms.
- Check the full configuration, starting with defrost schedules.
- Restore remote access only through a secure VPN or protected network. Filtering contractor IP addresses is an emergency step, not a fix.
- Update firmware, change default passwords and, on Danfoss systems, set the security level to Strict.
- Replace end-of-life units: on these, CERT-FR warns, a factory reset removes the intrusion but leaves the flaw.
SOCRadar adds one more: independent temperature alarms, because a compromised controller can misreport what it is doing. For background on how sensors and plant equipment connect to networks, see our guides to the Internet of Things and Industry 4.0.
Is there an Italian link?
Yes, on the supplier side. Dixell electronics, including the XWEB family named by CERT-FR, are made by Copeland Controls S.r.l., the former Dixell, based in Alpago in the province of Belluno, according to its company profile on Expoclima. On 13 October Italy’s cybersecurity agency ACN issued bulletin AL04/261013/CSIRT-ITA, asking food retailers, food logistics, industrial refrigeration firms and maintenance providers to remove internet exposure and check operating parameters. No Italian incident had been confirmed in the public sources we checked as of 20 October.
What is still unknown?
- Who did it. No claim and no ransom demand, which a source close to the probe told Reuters had puzzled investigators.
- How they got in. No vulnerability has been officially linked to the attack.
- The cost. Only estimates from the affected chains: Les Mousquetaires’ chief executive told BFMTV he expected losses of tens of millions of euros, according to Reuters.
- Whether other countries were hit. Félix Aimé of Sekoia told Reuters that Spain, Portugal, Poland, Germany and Belgium were affected; retailers there had not confirmed it.
- Links to other incidents. The Dutch NCSC said it saw no connection with the incident at Ahold Delhaize the same weekend, Reuters reported.
Frequently asked questions
What happened to French supermarket fridges in October 2026? Overnight on 11 to 12 October 2026, attackers took control of the systems that manage refrigerated cases and freezers in no fewer than 350 French supermarkets and forced them into defrost, with temperatures up to 50 °C. The Paris prosecutor is investigating.
How did hackers heat the fridges? They used internet-reachable refrigeration controllers to run the defrost cycle, a normal function, beyond its usual duration and temperature. How they accessed the controllers has not been established.
Which systems were affected? According to CERT-FR, Danfoss AK-SM and AK-SC series controllers and Copeland and Dixell XWEB supervisors. Danfoss said most affected units were models it no longer supports.
Does NIS2 apply to supermarkets? Not to retail as such. The NIS2 food sector covers wholesale distribution and industrial production or processing above medium-enterprise thresholds, so a retail group’s wholesale company can be in scope.
Do manufacturers have to report this under the Cyber Resilience Act? Only if a vulnerability in their product is shown to have been actively exploited. Since 11 September 2026 that triggers a 24-hour early warning to ENISA’s single reporting platform.
Sources
- CERT-FR (ANSSI), Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, CERTFR-2026-ALE-012, 12 October 2026, updated 13 and 16 October
- ACN, CSIRT Italia, bulletin AL04/261013/CSIRT-ITA, 13 October 2026
- Claroty Team82, Amir Zaltzman, Freeze the Controller, Defrost the Food, 9 August 2026
- Reuters, Raphael Satter and Gabriel Stargardter, Investigators hunt French supermarket fridge hackers, no claim of responsibility, 13 October 2026 (via Internazionale)
- The Hacker News, Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers, 13 October 2026
- BleepingComputer, Cyberattack shuts down refrigerators at French supermarkets, 12 October 2026
- SOCRadar, French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply, 13 October 2026
- TIME, ‘Unprecedented’ Cyberattack Targets French Supermarket Fridges, 13 October 2026
- SecurityBrief Australia, Refrigeration controller flaws threaten cold chains, 11 August 2026
- Finnish Food Authority (Ruokavirasto), NIS2 in the food sector, accessed 20 October 2026
- Directive (EU) 2022/2555 (NIS2), Annex II
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 3, 14, 69 and 71; Hogan Lovells, Preparing for Vulnerability and Incident Reporting, 2026
- Expoclima, Copeland Controls S.r.l. company profile, accessed 20 October 2026
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs, Annex II, Chapter IX
