Shortly after midnight on Monday, October 12, 2026, refrigeration controllers at several hundred French supermarkets began heating instead of cooling. Attackers who had gained remote access to Danfoss supervisory units raised temperature setpoints to about 50°C and locked the equipment into a continuous defrost cycle. By the time store managers arrived, freezers that normally hold -18°C were reading positive temperatures, one Danfoss display still showed 26°C, and at the Intermarché in La Haye (Manche) cabinets had deformed under heat that staff put at 80°C. The Paris prosecutor’s office confirmed food losses and fires. Danfoss confirmed its controllers were the target. Prime Minister Sébastien Lecornu handed the case to ANSSI the same afternoon. The full incident record is in the database.
What the attackers did
Commercial refrigeration in a supermarket is run by a site-level supervisory controller that coordinates the case controllers on each display cabinet, cold room and compressor pack. Danfoss sells this layer as the ADAP-KOOL system manager line, and the company says it has more than 50,000 such installations in food retail. Every cabinet runs a scheduled defrost, typically one or two hours per day, in which heaters or hot gas melt ice off the evaporator while product sits behind a closed door. The attackers abused that function. Instead of a short daily cycle, defrost ran continuously with the target temperature set at 50°C.
The Intermarché in Grand-Couronne near Rouen timed the change on its own system at 4:44 a.m. Le Monde reported that the attackers also stretched the defrost duration from one hour to eight, which pushed back the point at which temperature alarms would fire. Several employees told the trade site Je Bosse en Grande Distribution that the alert function itself had been switched off, so on-call refrigeration technicians were never paged. Stores that happened to open early, or whose managers still received a remote alert, saved part of their stock. Most did not. At a Gironde store a cold room that reached 50°C set off the sprinkler system. Thomas Lazzaroni of Cyberattaque.org described the method as a diversion of the defrost mode into a sustained cycle lasting several hours, and Antoine Hautin of the consultancy Almond told AFP that hitting hundreds of units at once pointed to a degree of sophistication and prior reconnaissance.
The operation stole no data and touched no checkout systems. Under French cold-chain rules, product that has left its temperature band cannot be sold, so affected stores followed a set procedure: record temperatures, photograph each unit, obtain a bailiff’s report (constat d’huissier) for the insurer, remove and count the stock, and destroy it.
The equipment and the known vulnerabilities
Danfoss told AFP on October 12 that most affected units were legacy products that no longer receive software or security updates. It named the AK-SM 800, declared end of life in May 2021, and the AK-SC 355, phased out in 2016, and acknowledged that some current-generation AK-SM 800A units were running outdated firmware. The company said it was in close contact with affected French customers and was deploying “firmware updates where available, stronger network protections and removing direct internet exposure where applicable”.
The AK-SM 800A has a documented security history. Early in 2025 Tomer Goldschmidt of Claroty Team82 reported to Danfoss a hidden authentication path in the controller’s embedded web interface: a support login whose password is derived from the device’s current date, which the researchers were able to reconstruct. Danfoss published advisory DSA-2025-03-01 and release R4.2 on March 24, 2025, and the flaw became CVE-2025-41450 (CVSS v3.1 8.2) when CISA issued advisory ICSA-25-140-03 on May 20, 2025. Two further bugs, a post-authentication command injection through the alarm-to-mail settings (CVE-2025-41451) and an nginx configuration injection (CVE-2025-41452), were fixed in R4.3.1 in August 2025 and added to the CISA advisory on August 26, 2025. Team82 presented the work publicly on August 9, 2026 under the title “Freeze the Controller, Defrost the Food”, alongside 23 vulnerabilities in Copeland XWEB Pro supervisors, and reported that a Censys scan had found 2,765 AK-SM 800A management interfaces exposed to the internet.
The exposure numbers after the attack were worse than that. On October 12, Baptiste Robert of Predicta Lab counted 2,752 internet-facing Danfoss systems, 1,590 of them in France. Valéry Rieß-Marchive of LeMagIT found close to 3,000 French IP addresses serving the Danfoss StoreView console, some with last-modified dates between 2021 and 2024. Shodan returned more than 4,500 Danfoss devices worldwide. A Danfoss technical note from October 2025 had already described two earlier incidents of the same type: 16 supermarkets in Russia and 40 stores in Israel attacked in 2022 through AK-SM 800 units that sat on the internet without a firewall or VPN.
None of this proves which path the attackers took on October 11. CISA’s advisory, as of its last revision, recorded no known exploitation of the three CVEs. The AK-SM 800 and AK-SC 355 units that made up most of the victims predate the AK-SM 800A research entirely, and a device from 2016 exposed on a public address may need no vulnerability at all. Nothing public suggests that Danfoss’s own hosted infrastructure was breached, although Les Mousquetaires chose to describe the event as an attack “at Danfoss”. Investigators have not excluded exposed legacy controllers, exploitation of the published CVEs, stolen maintenance credentials or a hijacked remote-access session at a refrigeration contractor. CERT-FR’s notice of October 12 states only that the agency is aware of numerous compromises of AK-SM and AK-SC series devices and that exposing a management interface to the internet is contrary to good practice.
Scale and losses
Store counts moved all day and still differ by source. Les Mousquetaires, which runs Intermarché and Netto, went from about 150 stores in the morning to at least 300 by evening, with roughly 100 stores discarding their entire refrigerated range. Coopérative U reported just under 100 stores. Carrefour confirmed 80 of its roughly 6,000 French stores. Monoprix put its figure at about 30, or 5 percent of its network. E.Leclerc said several stores were affected through one of its refrigeration equipment suppliers. Employees also reported losses at Carrefour Market, Carrefour City, Metro and Picard, and at independent butchers using the same supervisory platform. Aggregate estimates ran from 250 to 350 stores (BleepingComputer) to more than 400 (RTS) and about 500 (Cooling Post). One employee’s observation captured the pattern: every store whose temperature monitoring ran through the Danfoss platform was hit, whatever the banner.
Per-store losses were reported at about 50,000 euros at the Intermarché in Haguenau and the Intermarché in Guerlédan, 150,000 to 200,000 euros for 60 cubic metres of food at a store in Gironde, and 220,000 euros at the Super U in Wasselonne. Les Mousquetaires estimated the national total at several million euros. Intermarché warned that standard store insurance may not cover a cyberattack on refrigeration equipment, and who ultimately pays, the insurer, the refrigeration contractor or Danfoss, is unresolved. Fresh and frozen aisles stayed closed for days, suppliers had orders cancelled, and some stores did not expect frozen sections back before the end of the week.
Official response
Coopérative U chief executive Dominique Schelcher broke the story on X in the late morning of October 12, confirming that “a cyberattack has been affecting the refrigeration production facilities of several stores in our network since last night” and calling an attack on equipment essential to food preservation “extremely serious and unprecedented”. An Intermarché internal memo dated the same day “confirms the existence of a cyberattack that occurred during the night at Danfoss”, and a crisis meeting with Danfoss and the refrigeration contractor Axima began at 11 a.m.
The cybercrime section of the Paris prosecutor’s office opened an investigation on its own initiative at midday into “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France” and assigned it to the Office anti-cybercriminalité (OFAC). In the afternoon the Prime Minister’s office said Lecornu was following the case personally and had tasked ANSSI, which reported that it had identified a vulnerability in the Danish vendor’s software, contacted Danfoss, begun searching for other French operators running the same equipment and started coordinating with European counterparts because other countries could be affected. EU Agriculture Commissioner Christophe Hansen condemned the attack, writing that “food security requires more attention at all levels because the weaponisation of food has become a reality”. No group has claimed responsibility and no attribution has been offered by any official body.
The Ahold Delhaize incident
The same weekend produced a second grocery-sector incident that is unconnected on current evidence. Ahold Delhaize, parent of Albert Heijn, Delhaize and five US banners, began experiencing what it later called a cybersecurity incident on Sunday afternoon, October 11, and disclosed it at 08:29 on October 12 in a statement filed as inside information under the EU Market Abuse Regulation. The company took systems offline as a precaution. In the Netherlands, the websites, apps and customer service of Albert Heijn, Etos and Gall & Gall went down, online grocery delivery stopped, all placed orders were cancelled, loyalty programmes including Koopzegels and Air Miles stopped working, and work halted at several Albert Heijn distribution centers. Electronic shelf labels in stores kept displaying the previous week’s promotional prices, so Albert Heijn told customers to keep receipts for compensation. Delhaize in Belgium could not accept new online orders. In the United States the websites of Food Lion, Hannaford, Stop & Shop, Giant Food and The Giant Company went offline, and Stop & Shop staff reported losing access to schedules and pay stubs.
Tom’s Hardware and others reported the two events together as a European supermarket cyberattack affecting refrigeration, deliveries and store prices. Ahold Delhaize has not said what happened, no ransomware group has claimed it, and neither French nor Dutch authorities have linked it to the Danfoss attack. Ahold Delhaize suffered a previous incident in November 2024 that exposed data on more than 2 million people and took Hannaford’s e-commerce offline.
Precedents in the archive
Refrigeration has been attacked before, but never at this breadth. In November 2024, the GRU-directed hacktivist persona CARR reached the control system of a Los Angeles meat processing facility through an internet-exposed VNC HMI, spoiled thousands of pounds of meat and caused an ammonia leak. In May 2026, an Iranian-linked persona reconfigured the industrial refrigeration controllers at an Israeli food processor, pinned valves open and destroyed three compressors. The Americold ransomware attack of 2020 and the JBS Foods attack of 2021 disrupted the cold chain from the IT side. In late August 2026, freezers at more than a dozen US military commissaries failed within two days, with Fort Huachuca reporting that every freezer had been put into defrost mode; Army and Air Force investigators have not published a cause.
The closest structural analogue is the mass exploitation of a single internet-exposed controller model across many small operators: the CyberAv3ngers Unitronics campaign in 2023 and the Rockwell MicroLogix attacks on Minnesota water utilities in July 2026. In each case the victims shared a product with a public weakness and a management interface on a routable address, and the attacker needed no foothold in any corporate network. The French supermarket attack fits the same template, with retail refrigeration taking the place of water treatment.
What defenders should take from it
Refrigeration, lighting, electronic shelf labels, scales and building management in a supermarket are typically installed and maintained by contractors and sit outside the store’s IT governance. The French incident shows the whole set of failure modes at once: equipment five to ten years past end of life, current units without firmware applied, management interfaces on public addresses, alerting that could be silenced from the same interface the attacker controlled, and no independent temperature monitoring to fall back on. Operators of AK-SM 800A units should confirm they are on R4.3.1 or later; operators of AK-SM 800 and AK-SC 355 units have no patch to apply and should remove the devices from the internet and plan replacement. Independent temperature loggers with out-of-band alerting would have turned a total loss into a late-night call-out at most of the affected stores.