Overnight on 11 to 12 October, attackers remotely forced refrigeration controllers at hundreds of French supermarkets into defrost cycles, heating fridges and freezers to as much as 50°C. French authorities say two series of Danfoss controllers were compromised. Danfoss says the affected units were running outdated firmware. How the attackers got in has not been made public.

What happened in France

Les Mousquetaires, the group behind Intermarché and Netto, said fridges at around 150 of its stores were heated to as much as 50°C for six hours overnight, according to Reuters reporting carried by CNN. Later counts are higher. The group told TIME about 180 Intermarché and Netto stores, and BFM-TV reported 300.

Carrefour said 80 of its supermarkets were hit. TIME reported at least 100 Coopérative U stores and about 30 Monoprix stores. Monoprix told Reuters 5% of its stores were affected. The attack caused fires and spoiled food, and supermarket owners described throwing out large amounts of frozen stock.

Estimates of the cost differ. Les Mousquetaires told TIME the damage could reach several million euros. Its chief executive told BFM-TV the losses ran to tens of millions of euros nationwide in a single day.

The Paris prosecutor opened an investigation on Monday, and Prime Minister Sébastien Lecornu told France’s national cybersecurity agency, ANSSI, to investigate. ANSSI says it is also working with European counterparts.

One detail stands out. Le Monde reported that the attackers extended the defrost cycle in some freezers and cold rooms from one hour to eight, which would delay alarms.

Which devices were hit, and how were they reached?

CERT-FR, the response centre run by ANSSI, issued alert CERTFR-2026-ALE-012 on 12 October. It reported numerous compromises of Danfoss AK-SM and AK-SC series controllers and told operators to disconnect them or filter access. The French government said exposing a management interface to the internet is contrary to best practice, and that remote administration should be limited to trusted IP addresses where it is needed.

Supermarket refrigeration is typically run from control panels that manage a whole store’s fridges and freezers. Many can be reached over the internet so maintenance companies can adjust them from anywhere, Reuters reported.

Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems. It said the units affected were running outdated firmware, and that it has long advised customers to keep supported systems updated and to migrate legacy ones.

Investigators have not said publicly how the attackers gained access. In August, the security firm Claroty published research on flaws in the Danfoss AK-SM 800A controller that could allow a login bypass and code execution. Danfoss issued firmware updates for them. Whether those flaws played any part in this attack has not been established.

Could it happen elsewhere? 

TIME reported that internet scans found Danfoss refrigeration controllers exposed in the UK, the US and South Africa, among other countries. France accounted for nearly 60% of the exposed controllers the scans detected, according to the firm UK Cyber Defence. ANSSI says stores in other countries may use the same software. Reuters, citing a threat intelligence analyst, reported that Spain, Portugal, Poland, Germany and Belgium were affected. No other country had confirmed related breaches when TIME published. 

What the NCSC said in August

On 27 August the NCSC warned that attacks on operational technology were increasing across multiple sectors, in the UK and globally, and that some had caused limited real-world disruption. It told organisations not to assume their OT cannot be reached from the internet, and to verify. Exposure can come from misconfigurations, legacy connections and unmanaged assets, it said. It also asked for boundary devices to be kept in vendor support, updated and replaced before end of life. The advisory predates the French attack and does not refer to it.

What security teams can take from it 

Refrigeration is not normally a security system. The pattern will still be familiar to anyone who runs a site: a controller, a remote maintenance route, a contractor, and a device that may not appear on the security team’s asset list.

Five checks follow from what is confirmed:

1. List every building system a contractor can reach remotely. Refrigeration, heating and ventilation, lifts, access control and CCTV all belong on it.
2. Find out how each one is reached, and whether its management interface faces the internet. The French government’s advice was to limit remote access to trusted IP addresses.
3. Check firmware and support status. Danfoss said units hit in France were running outdated firmware, and the NCSC asks for devices to be replaced before end of life.
4. Check where the alarm comes from. The reported extension of defrost cycles to delay alarms suggests keeping an alert path that does not depend on the controller it is watching.
5. Register for the NCSC’s free Early Warning service, which flags exposed vulnerabilities in internet-facing systems.

Register your interest for The Security Event 2027

Subscribe to The Security Briefing for monthly updates!