Hackers altered refrigeration settings, including defrost cycles, at hundreds of French supermarkets overnight on Oct. 11-12, forcing stores to discard fresh and frozen food.
France’s cybersecurity authorities have since expanded an alert about compromised controllers and warned that attacks might still be underway.
The affected retailers included Intermarché, Netto, Coopérative U, Carrefour and Monoprix. At one Intermarché store, the owner told Le Monde that a cold room reached 50°C before the damage was discovered early Monday. Coopérative U chief executive Dominique Schelcher confirmed disruption in his chain and said technicians were working to restore refrigeration.
France’s national computer emergency response team, CERT-FR, reported numerous compromises of remote refrigeration controllers in an alert issued Oct. 12. On Oct. 13, CERT-FR expanded its alert beyond Danfoss AK-SM and AK-SC equipment to include Copeland and Dixell XWEB controllers.
Le Monde reported that staff at a Dixell-equipped supermarket near Bordeaux intervened before food was lost. Another Dixell-equipped store, an E.Leclerc in Lescure-d’Albigeois, was forced to discard refrigerated goods, its director told La Dépêche du Midi.
Danfoss had warned about older controllers
Danfoss, a Danish refrigeration equipment manufacturer, had documented earlier attacks involving its systems. In an October 2025 technical bulletin, it said the AK-SM 800 model had reached end of life in 2021 and described incidents at stores using the controller in Russia and Israel in 2022.
Following the French attack, Danfoss told trade publication Cooling Post that most affected Danfoss units were older models or supported products running outdated firmware. It said it was helping customers update equipment where possible and restrict direct internet access. Investigators have not publicly established the precise route used to compromise the controllers.
A command can be genuine but unsafe
Thomas Plank, CEO of Tributech, an operational-technology security vendor, said controllers need to verify that a remote command came from an authorized source and has not been altered. “A network connection or a login on an intermediate server proves none of these points,” he said in comments provided to TechInformed.
The second check, Plank said, is whether an authentic instruction falls within the equipment’s operating limits. “Even a genuine command can be wrong,” he said. He argued that unusually prolonged defrost cycles should be rejected or require additional approval. The CERT-FR alert does not specify what checks the compromised controllers performed before executing commands.
CERT-FR’s alert focused on exposed management interfaces. It called for removing direct internet access, checking settings including defrost schedules and installing available firmware updates.
For compromised equipment, it recommended a factory reset, restoring access only through a secure VPN or protected network, and reconfiguring the equipment. The agency warned that a reset alone would not secure unsupported devices left exposed online.
The Paris prosecutor’s office has opened an investigation, and Reuters reported that no group had publicly claimed responsibility by Oct. 13. Investigators have not established whether the different controllers were compromised through the same weakness.