Supermarket cyberattack: what the refrigeration hack reveals

On the night of 11 to 12 October 2026, a cyberattack hit French supermarkets through an unexpected path: the controllers that run their fridges and freezers. Attackers took these devices over remotely, forced defrost cycles and changed temperature setpoints. No ransom and no stolen data, but tonnes of products thrown away. The attack is a reminder that a forgotten, internet-facing device can cause very real damage.

According to Public Sénat, about 300 Intermarché and Netto stores, 80 Carrefour, around 30 Monoprix, U stores and several E.Leclerc were hit on the first night. The head of the Mousquetaires group said the attackers had triggered remote defrosts and pushed some units "up to 50 degrees". The head of Coopérative U estimated losses at a few tens of thousands of euros for a small store, and up to €180,000 or €200,000 for a hypermarket.

CERT-FR, ANSSI's alert centre, issued an alert on 12 October, updated the next day with more targeted equipment, warning that attack campaigns were "probably still ongoing". The cybercrime section of the Paris prosecutor's office has opened an investigation. At the time of writing, nobody had claimed the attack and the exact entry point had not been made public.

In a supermarket, each refrigerated cabinet is run by a controller, and a central unit lets refrigeration contractors monitor and adjust the installation remotely. The CERT-FR alert lists the Danfoss AK-SM and AK-SC series, then Copeland xweb and Dixell xweb. What they have in common: a management interface reachable from the internet. CERT-FR puts it bluntly: exposing a management interface on the internet "goes against good practice".

Danfoss said, according to Cooling Post, that most affected units were older models: the AK-SM 800, end of life since 2021, and the AK-SC 355, phased out in 2016, which no longer receive fixes. Others were AK-SM 800A units, the current model, running outdated firmware. An audit firm quoted by Public Sénat had also found, back in 2023 at a retailer, a flaw allowing authentication to be bypassed, and reported it to the manufacturer.

In other words, the attack probably did not require exceptional means: it exploited devices installed for the convenience of maintenance, then forgotten.

The CERTFR-2026-ALE-012 alert distinguishes two situations.

If the device is not compromised

• remove all internet exposure, checking the insurance contract first before cutting data uploads to the refrigeration contractor;
• review the whole configuration, especially defrost schedules;
• allow access only through a VPN or a protected network; filtering contractors' addresses on a firewall is only an emergency measure;
• apply the manufacturer's recommendations: firmware updates, strict security level and changed default passwords.

If the device is compromised

• remove internet exposure, then reset the device to factory settings;
• reconfigure it fully before putting it back into service, with VPN access and the manufacturer's recommendations.

CERT-FR warns that a reset alone is not enough: it removes the attacker's foothold but leaves the device vulnerable. For remote access to industrial installations, its guide CERTFR-2025-DUR-003 sets out the same principles: address filtering, VPN, strong passwords and multi-factor authentication, patches applied promptly.