French Supermarket Fridge Cyberattack Hits Danfoss

Attackers took control of refrigeration controllers at hundreds of French supermarkets overnight on October 11 to 12 and forced them to heat up, and this French supermarket fridge cyberattack left several chains throwing away stock. Les Mousquetaires, which owns Intermarché, said its fridges and freezers were put into defrost and heated to as much as 50°C. The controller is made by Danfoss and, according to The Hacker News, maintenance firms can manage it remotely. The same remote access that saves a technician’s visit is the part now under scrutiny.

What Happened

Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc all reported stores affected. The counts differ by source and by what is being counted. Reports range from about 150 Mousquetaires stores (Reuters) to at least 300 across Intermarché and Netto (AFP), 80 Coopérative U stores out of about 2,000 and 80 Carrefour supermarkets. Coopérative U’s chief executive said the cold chain held in most of its affected stores and only a minority lost goods; Intermarché said its affected stores had to discard the products concerned. Mousquetaires put the damage at several million euros in a statement to TIME, and its chief executive spoke of tens of millions across France on BFMTV. The Paris prosecutor’s office has opened an investigation.

CERT-FR, the French government’s CERT, published alert CERTFR-2026-ALE-012 on October 12 and revised it on October 13. It reports numerous compromises of remote controllers for refrigeration systems: the Danfoss AK-SM and AK-SC series, and also Copeland xweb and Dixell xweb units. It tells operators to remove the internet exposure of the affected units and of any unit reachable on a public IP address. ANSSI’s head called it urgent to take the two Danfoss series off the internet or restrict access tightly. According to The Hacker News, Danfoss said most of the units hit were older models it no longer updates. As of October 13, neither French authorities nor Danfoss have said who carried out the attack or how the attackers got into the controllers, and no ransom demand has been reported. We found no CVE and no Danfoss advisory tied to this campaign.

Why It Matters

Nothing here required stealing data. A controller that sets temperatures, reachable over the internet or through a maintenance provider’s access, was enough to spoil stock and cost money. That makes it an operational technology problem sitting in a retail business, usually owned by facilities rather than IT, and often invisible to the security team’s asset list.

The weak point again sits with the supplier or service provider, not the main network. In our October 9 post on the Danish CPR register, access through a third party was again the route. Here the route is not yet public, so we do not claim it was a maintenance account. Assessment: for DACH retailers and food producers the lesson is the same. Food production and distribution fall under NIS2 as an important sector, so supplier access to cooling and building controls belongs on the risk register. Confirm the legal scope with your advisers.

What You Should Do Now

1. Find out whether you run Danfoss AK-SM or AK-SC controllers, Copeland xweb or Dixell xweb units, or any other refrigeration or building controllers managed by an outside contractor. Ask facilities and the maintenance providers, not only IT.
2. Follow CERT-FR’s advice: remove the internet exposure of the affected units and of any unit on a public IP address. Before you cut the data feed to your refrigeration contractor, check the terms of your insurance contract.
3. Check the full controller configuration, especially the defrost ranges. For a unit that may be compromised, CERT-FR recommends a factory reset and reconfiguration.
4. Restore remote access only through a secure VPN or a protected network. Filtering the contractor’s source IP addresses on a firewall is acceptable as a short-term stopgap, not as a lasting fix. List who can reach the controllers remotely, with which credentials, and switch off any access you cannot justify.
5. Apply the manufacturer’s hardening: update the firmware, set Danfoss units to Strict security mode and change default passwords. Check whether any unit is an end-of-support model that no longer receives updates.
6. Prepare a manual fallback: temperature alarms that do not depend on the same controller, a runbook for store staff, and agreed response times with your refrigeration contractor.

DIESEC Perspective

The question to ask your suppliers is simple: who can change a setpoint on our equipment from outside the building, and how would we know? If nobody can answer, that access is unmanaged exposure, whoever owns the controller.

Want an outside view on OT and supplier access in your stores or plants? Contact DIESEC for an external attack-surface check and a review of third-party remote access.

Sources: The Hacker News | BleepingComputer | CERT-FR | TIME
Published: 2026-10-14 | Category: Supply Chain Security | ~4 min read