Cyberattacks disrupted refrigeration equipment at hundreds of French supermarkets, causing food losses and operational damage. The incident reveals how weaknesses in connected industrial systems can affect the physical world.
Cover illustration generated for this article. It is not a photograph of an attacked store, of a Danfoss product or of a measured temperature.
On the morning of October 12, 2026, supermarket staff across France discovered an unusual problem. Refrigerators and freezers that should have been keeping food cold had become dangerously warm.
In some affected locations, refrigeration equipment reportedly reached temperatures of 50°C. Perishable products had to be discarded, and reports described fires. The disruptions were linked to a cyberattack on connected refrigeration controllers, rather than an ordinary mechanical breakdown.
Several supermarket chains were affected, including Intermarché, Carrefour, Monoprix and Coopérative U. As investigators assessed the damage, counts of affected stores varied. Reuters reported on the incident, while subsequent reporting identified additional affected equipment families.
The incident illustrates a kind of cyberattack that receives less attention than ransomware or data theft. Attackers did not need to steal customer records or shut down a corporate website to cause disruption. Interference with software controlling physical equipment was enough.
How supermarkets control refrigeration
A household refrigerator operates largely independently. Large supermarkets may contain dozens of refrigerated cabinets, freezers and cold-storage rooms. To monitor those systems efficiently, commercial installations commonly use central management systems connected to local controllers and temperature sensors.
A temperature sensor measures conditions in a cabinet or cold room. A local controller operates cooling and defrost functions. A supervisory controller gathers readings, coordinates configuration and presents alarms. Its management interface allows technicians to inspect settings and sometimes make changes remotely.
The Danfoss AK-SM 800A is one example. Its web-based management interface supports monitoring refrigeration circuits, reviewing alarms and adjusting schedules. Claroty’s Team82 documented the architecture and security properties of this system.
Remote management helps contractors maintain equipment across many locations. It also creates a sensitive access point: someone with unauthorized control over the management interface may be able to alter settings that affect physical processes.
Accessible text alternative for this figure
Four boxes in a loop. Remote maintenance, by an authorized technician over secure access, reaches the supervisory controller, which has the management interface, alarms, schedules and configuration. The supervisory controller commands the local controllers, which run cooling and defrost logic. The local controllers drive the physical equipment: compressors, heaters and refrigerated cases.
Temperature sensors and independent checks read the physical equipment and report back to the supervisory controller. A red dashed line from remote maintenance to the supervisory controller shows the exposure risk of uncontrolled internet access to management functions. It is an exposure risk and not a verified incident path, and the figure does not reconstruct the French attacks.
A normal function becomes a risk
Refrigeration equipment performs periodic defrost cycles to remove accumulated ice. Depending on the system, cooling may pause or heating components may operate temporarily. The controller determines when defrost starts, how long it lasts and when ordinary cooling resumes.
Defrost is not malicious. But if an unauthorized person changes schedules or operating parameters, a freezer may fail to maintain safe temperatures. That can damage stored goods even if the equipment has not been physically touched.
Reports from France described attackers manipulating refrigeration controls, including defrost functions. The exact command sequence was not publicly reconstructed for every affected store as of this article’s evidence cutoff. This explanation describes how the technology works, not a proven step-by-step reconstruction of the attack.
What equipment was affected?
Initial coverage emphasized Danfoss control systems. France’s national cybersecurity response team, CERT-FR, subsequently expanded its warning to include Danfoss AK-SM and AK-SC equipment and Copeland/Dixell xweb controller families. The CERT-FR alert addresses the wider risk and recommended safeguards.
That breadth matters. Different controllers have different firmware, interfaces and security mechanisms. Several affected product families do not establish that attackers exploited the same software vulnerability everywhere.
A particular concern is direct internet exposure. Equipment designed for remote maintenance may become discoverable by automated scanning if its administrative interface is made publicly reachable. In its August 2026 research, Claroty identified thousands of publicly accessible Danfoss AK-SM 800A interfaces, including one Censys scan cited by Claroty that counted 2,765 devices. This was a snapshot of exposure, not a tally of devices compromised in October.
What security researchers found in Danfoss controllers
In August 2026, Claroty’s Team82 published technical research into the embedded web-management software of Danfoss AK-SM 800A controllers. The team described three different weaknesses. Danfoss issued coordinated security advisories and firmware fixes.
These are documented vulnerabilities. They have not been established as the specific entry path used in the French supermarket attacks. They nevertheless show why industrial controller interfaces deserve the same careful security engineering as other networked software.
Authentication bypass: CVE-2025-41450
The controller had an alternative authentication mechanism based on a daily code. Researchers reverse-engineered its calculation and showed that a person able to reproduce the algorithm could authenticate without the normal administrator password. A login screen alone is not enough if a second, weaker path grants the same authority. Danfoss addressed the issue in its firmware updates. The documented CVSS score was 8.2 (High), the same in Claroty’s research and Danfoss’s advisory.
Operating-system command injection: CVE-2025-41451
A configuration feature used for email notifications constructed operating-system commands using a value from user-controlled settings. The researchers found insufficient protection against command injection. After obtaining the necessary administrative privileges, an attacker could potentially cause the controller to execute unintended operating-system commands. Danfoss addressed this weakness in R4.3.1. The CVSS v3 score listed by Claroty was 7.6 (High), while Danfoss’s own advisory lists 8.7 (High).
This crosses a different boundary from authentication. A user interface meant to change a notification setting should not let someone control what commands the device executes.
Web-server configuration manipulation: CVE-2025-41452
The embedded management interface used Nginx to handle web requests. Researchers found that authenticated users could influence some server configuration through insufficiently restricted functionality, allowing changes to web handling and possible denial of service. The CVSS v3 score listed by Claroty was 5.4 (Medium), while Danfoss’s own advisory lists 6.8 (Medium). The issue was addressed in R4.3.1.
| Research finding | Security boundary | Demonstrated consequence |
|---|---|---|
| CVE-2025-41450 | Authentication | Normal administrator authentication could be bypassed |
| CVE-2025-41451 | Command construction | Operating-system commands could be executed with required access |
| CVE-2025-41452 | Web-server configuration | Management interface could be manipulated or disrupted |
These mechanisms can also interact. A weakness granting unauthorized access may make another, authenticated-only weakness more dangerous. That is a lesson from the vulnerability research, not a claim that this precise chain caused the October attacks.
See Claroty’s technical research, Danfoss DSA-2025-03-01 and DSA-2025-08-01.
Why industrial equipment is harder to secure than office software
The vulnerability types are familiar from ordinary web applications. Their consequences are different when the software manages equipment that must keep operating.
An emergency shutdown can have physical consequences. An incident responder may be able to disconnect a compromised office server immediately. A refrigeration installation requires an operational assessment first. Local controllers might continue safely without a supervisor, or a lost monitoring link could create additional problems. The response needs input from qualified refrigeration engineers.
Equipment stays in service for years. Replacing industrial controllers involves cost, vendor support and potential interruption. Unsupported firmware may therefore remain installed well after other business technology has been refreshed. Where replacement cannot happen promptly, remote-access restrictions and network isolation become especially important.
Maintenance crosses organizational boundaries. External refrigeration contractors may support multiple stores. They need controlled, traceable access, not permanent public administrative interfaces or shared credentials that cannot be attributed to a particular technician.
Recovering the device is not enough. Even a functioning management screen cannot by itself prove that operating parameters are safe or that spoiled products can be returned to sale. Security recovery and physical-process verification are separate tasks.
What operators should examine
The French government alert and established industrial-security practices point toward safeguards that address both exposure and consequences:
| Area | Practical check | Why it matters |
|---|---|---|
| Inventory | Identify controller models, firmware, remote access and operational dependencies | Find exposed and unsupported equipment |
| Remote access | Remove unnecessary public management interfaces, and use controlled access paths | Reduce internet reachability |
| Accounts | Use individual identities, suitable authentication and limited privileges | Restrict who can change equipment settings |
| Updates | Apply vendor-approved firmware after operational testing | Address documented software weaknesses |
| Networks | Segment control systems from unrelated IT systems | Limit unnecessary access and movement |
| Configuration monitoring | Record changes to defrost schedules, thresholds, alarms and accounts | Identify unexpected operational changes |
| Independent checks | Maintain appropriate physical alarms and safe operating procedures | Detect unsafe conditions if management controls fail |
| Recovery | Coordinate containment and restoration with engineers | Restore trustworthy control and safe equipment operation |
A configuration change outside an approved maintenance window can be as important as a suspicious login. Security staff need to compare controller logs with maintenance records and the physical readings of the equipment. Unexpected activity is an investigation signal, not automatic proof of an attack.
If compromise is suspected, preserve relevant evidence, restrict further unauthorized access and work with qualified operations personnel. A factory reset alone may leave the original exposure or weak access path intact. Apply supported fixes, review credentials and verify equipment configurations and food-safety conditions before normal operations resume.
What remains unknown
As of October 14, 2026, public reporting had not established the attacker identity or the exact access method for every affected installation. Counts of affected stores and reported temperatures also varied by source and time. The documented Danfoss CVEs explain credible weaknesses in one controller family, but no published evidence in the sources reviewed proves they were the incident’s common cause.
Those uncertainties do not undermine the technical lesson. They distinguish observed operational disruption from a complete forensic reconstruction.
When cybersecurity affects the physical world
Centralized refrigeration management offers real operational advantages. The same technology allows a software setting to influence equipment that keeps food safe.
The French incidents show why protecting operational technology involves more than malware detection or data security. Organizations must secure access to control functions, recognize changes that affect physical conditions and design incident responses that preserve safe operation.
A refrigerator’s defrost cycle is an ordinary maintenance function. Whether that function serves the store or an attacker depends partly on the security of the system allowed to control it.
Sources and further reading
Editorial source cutoff: 14 October 2026. Each source was opened and checked on 14 October 2026. Reporting on the incident is still developing, so counts and details may change.
- CERT-FR: Alert CERTFR-2026-ALE-012. Official incident alert and protective guidance (October 2026).
- Claroty Team82: Freeze the Controller, Defrost the Food. Controller architecture, exposure research and technical vulnerabilities (August 9, 2026).
- Danfoss: DSA-2025-03-01. Manufacturer advisory for CVE-2025-41450.
- Danfoss: DSA-2025-08-01. Manufacturer advisory for CVE-2025-41451 and CVE-2025-41452.
- Reuters: Intermarché and wider French supermarket attacks. October 12, 2026.
- Reuters: Additional Copeland and Dixell systems. October 13, 2026.
- Le Monde: After Danfoss, hackers strike other refrigeration systems. October 13, 2026.