Refrigeration hack affected about 700 French supermarkets, government says, as Danfoss interfaces stay online

Editor’s Note: Hackers pushed refrigerated display cases into defrost at French supermarkets overnight Sunday, in an attack Finance Minister Roland Lescure says affected about 700 of the country’s 10,000 supermarkets. CERT-FR, the national computer emergency response team, said in an alert updated Tuesday that attack campaigns against Danfoss, Copeland and Dixell controllers were probably still underway. Danfoss has pointed to end-of-life equipment; Copeland has acknowledged a vulnerability but has not confirmed compromises in France.

For cybersecurity, data privacy, regulatory compliance and eDiscovery professionals, the incident moves building controls into the incident response plan. Loss estimates run from several million euros for one retail group to tens of millions nationwide by its chief executive’s reckoning, and Intermarché expects insurance to be a sticking point. CERT-FR recommends a factory reset for compromised units, which removes what an attacker left behind and may also remove the record a prosecutor or insurer will want.

Watch for a claim of responsibility, disclosure of how access was gained, confirmation of the reports from other countries and whether the exposed interfaces Reuters counted begin to fall.

News Analysis – Cybersecurity Beat

Refrigeration hack affected about 700 French supermarkets, government says, as Danfoss interfaces stay online

ComplexDiscovery OÜ Staff

Hackers seized refrigeration controls at French supermarkets overnight Sunday, pushing display cases into defrost and spoiling fresh and frozen food in an attack the government says affected about 700 of the country’s supermarkets.

The intrusion may not be over. In an alert updated Tuesday, France’s national computer emergency response team said attack campaigns against the same refrigeration controllers were probably still underway, and its first remedy is pulling those devices off the open internet. Plenty of controllers remain exposed: a Reuters scan that day found at least 4,500 web interfaces for controllers made by Danish manufacturer Danfoss.

French Finance Minister Roland Lescure gave Parliament the 700 figure on Tuesday, out of about 10,000 supermarkets nationwide, according to The Associated Press. He said France’s food supply was not at risk but that the attack “touches the heart of our food security.” His count sits well above earlier tallies: Reuters put the number at a minimum of 350 supermarkets and the BBC, working from chain figures on Monday, estimated about 400 stores. AP’s account does not say how the minister’s figure was compiled, so the numbers are best read as separate counts rather than as one rising series.

The chains’ own figures shifted as they checked their sites. Les Mousquetaires, which owns the Intermarché and Netto chains, cited about 150 Intermarché stores to Reuters on Monday and about 180 stores to the BBC and CNBC. It told the BBC it had also urgently disconnected another 100 stores from the internet as a precaution. It told Agence France-Presse that at least 300 Intermarché and Netto stores were targeted, and on Tuesday it said 300 were impacted, AP reported. Neither account says whether the precautionary disconnections were included. Carrefour reported 80 supermarkets hit and Monoprix 5 percent of its roughly 490 stores. Coopérative U Chief Executive Dominique Schelcher put his group’s figure at 80 of 2,000 stores, saying most stores kept their refrigeration running though some threw food away, AP reported.

Spoiled stock, smoke and a bill still being counted

That discarded food is where the bill begins. Les Mousquetaires said fridges at about 150 of its stores reached as high as 50 degrees Celsius (122 degrees Fahrenheit) for six hours and that it threw out all the food involved, Reuters reported Monday. Thierry Cotillard, who heads the group, told broadcaster BFMTV that the intruders switched its refrigerated display units into defrost mode and drove them up to 50 C.

Estimates of the damage depend on who is counting and what they cover. Cotillard told BFMTV the attack would represent losses of “tens of millions of euros nationwide in a single day,” according to Reuters. Les Mousquetaires gave CNBC a narrower figure for its own roughly 180 affected stores, saying it expected damages to reach several million euros. Schelcher told RTL radio that a small store could lose a few tens of thousands of euros and a hypermarket as much as 180,000 to 200,000 euros. Two Intermarché supermarkets in Haguenau, in Alsace, reported a combined 270,000 euros in lost goods to French broadcasters. Every one of those figures is a company or store estimate, and no audited industrywide total had been published as of Tuesday.

Accounts of fire differ in a similar way. Managers arriving Monday morning were hit by hot air blowing out of their freezers, and some locations had small fires, the BBC reported. The Paris prosecutor’s office described equipment that began to catch fire. A Les Mousquetaires spokesperson told CNBC that overheating caused smoke in some of its stores but that no fires had been reported there, an account that can hold alongside reports of fires elsewhere.

Recovering the losses may be hard. Intermarché told AFP it expects insurance to be one of the sticking points, because policies do not cover this type of incident, franceinfo reported. Reaction was sharp. Schelcher called the attack unprecedented and unacceptable in posts on X, and Christophe Hansen, the European commissioner for agriculture and food, wrote on X that “the weaponisation of food has become a reality,” the BBC reported. Lescure called the episode “a wake-up call for everyone,” yet the official account of what the attackers exploited remains thin.

What the alert names, and what the vendors say

The official record starts with CERT-FR bulletin CERTFR-2026-ALE-012, first issued Oct. 12 and updated Oct. 13 to add more targeted equipment. It lists four affected product families: Danfoss AK-SM series controllers, Danfoss AK-SC series controllers, Copeland xweb systems and Dixell xweb systems. CERT-FR, the incident response arm of the National Cybersecurity Agency of France (ANSSI), said it was aware of numerous compromises of these remote refrigeration controllers. It added that exposing a management interface to the internet generally runs contrary to good practice, a principle the rest of the bulletin turns into specific instructions.

The bulletin names no vulnerability and no firmware version, although a source close to Prime Minister Sébastien Lecornu said Monday that ANSSI had found a flaw in Danfoss software, according to Reuters. Neither the agency nor the government had published that flaw in the reporting reviewed for this article.

The manufacturers have filled some of that gap, starting with Danfoss, which has pointed to older equipment. The company said it was “aware of incidents in France affecting a limited number of refrigeration management systems” and that the affected units “were running outdated firmware,” according to Reuters. It added that it had “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions.” In a statement to franceinfo, Danfoss said the majority of affected devices were obsolete products, including AK-SM800 and AK-SC355 systems, whose support has ended, so they no longer get software or security patches.

Copeland’s position is harder to pin down. A spokesperson for the company, Dixell’s owner, would not confirm the agency’s account in one Reuters report Tuesday. In another Reuters report that day, Copeland acknowledged the “vulnerability” and said, “We are currently working with impacted customers to mitigate the risk.” AP reported that Copeland said the flaw was in “a discontinued, end-of-life generation of controllers.” Trade publication Cooling Post printed the same statement but tied it to a vulnerability identified by UK Cyber Defence, a British security firm whose internet scan found over 800 refrigeration and building controllers in the United Kingdom reachable from the open internet. Copeland had not confirmed that any of its controllers were compromised in France, in the reporting reviewed for this article.

Whatever the vendor, end-of-life equipment may explain why some units went without patches, but it does not explain why so many controllers could be reached from the internet or why their known weaknesses were left open.

Experts describe known weaknesses and a low bar

Weaknesses in Danfoss controllers were not a secret. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of an authentication bypass in the Danfoss AK-SM 8xxA series in May 2025 and of a command-injection flaw in August 2025, BleepingComputer reported. On Aug. 9 this year, researchers at Team82, the research unit of industrial cybersecurity vendor Claroty, published an analysis of the Danfoss AK-SM 800A. They described a hidden “code-of-the-day” login that could bypass authentication, a command-injection flaw allowing remote code execution after login and a web-server configuration flaw, all addressed in firmware R4.3.1, Claroty said. That research covers a different designation from the end-of-life models Danfoss named. No investigator or company had said publicly whether any of those flaws were used in France, in the reporting reviewed for this article.

Outside specialists describe a low bar either way. Clément Domingo, an ethical hacker known as SaxX, told RMC radio the operation was not especially sophisticated, blaming skipped updates and a password that was simply the current date. Claroty’s research describes something related but not identical, a daily code that the controller’s software derives from its date through an algorithm. No official had confirmed that either mechanism was used, and investigators have not publicly disclosed how the attackers got in, Reuters reported Tuesday.

“This is about basic cyber hygiene,” said Ken Munro, a partner at British security firm Pen Test Partners, according to Reuters. Munro said the attackers were exploiting well-known weaknesses and that the hack could easily be “kids messing around.” If a nation-state were behind it, he asked, why would it hit only some French fridges when “there are plenty of other nations with fridges on the internet”?

What the intruders did once inside was simple. Freezers normally run short defrost cycles overnight, but the attackers instructed the units to warm and hold that heat, the BBC reported, a detail that gives weight to CERT-FR’s instruction to review each controller’s full configuration, specifically including defrost schedules.

Thousands of interfaces remain reachable

Fixing settings inside one store does nothing about the controllers still sitting on the open internet. Using the Shodan search engine, Reuters located at least 4,500 Danfoss interfaces visible on Tuesday, and Onyphe, a French internet scanning firm, said only a small minority seemed to run the current software version. Baptiste Robert, chief executive of security firm Predicta Lab, counted 2,752 exposed Danfoss systems on Monday, 1,590 of them in France, BleepingComputer reported. Claroty’s August study, using Censys and signatures for one model, counted 2,765 exposed AK-SM 800A devices. Those counts come from different scanners and, where disclosed, different search criteria, so they should not be read as a trend or added together.

CERT-FR’s remedies are specific. Operators should remove affected units and any other unit sitting on a public IP address from the internet, restore access only through a secure VPN or protected network and apply the manufacturer’s hardening guidance. For Danfoss equipment, that means updating firmware, setting the Strict security level and changing default passwords. For compromised units, the agency calls for a factory reset. It warns that keeping an unpatched end-of-life device exposed to the internet invites compromise, and that a reset alone leaves such a device vulnerable and all but certain to be compromised again.

That warning puts the pressure on everyone who touches the equipment, not only its maker. France’s retail federation, the Fédération du Commerce et de la Distribution, called on Danfoss and the refrigeration contractors who use its systems to provide full transparency and act without delay, franceinfo reported. At the European level, Christel Delberghe, director general of retail association EuroCommerce, said, “This incident underlines the importance of resilience across the entire supply chain.”

No claim, no ransom and echoes abroad

Criminal accountability now rests with the Paris prosecutor’s office, which opened its inquiry on its own initiative Monday through its anti-cybercrime section and assigned it to France’s national anti-cybercrime office, known as OFAC, franceinfo reported. Its stated aims are to identify the victims and link the attack to the reported food losses and to equipment that began to catch fire. Lecornu also asked ANSSI to take up the case, a person in his office told Reuters.

No group had claimed responsibility as of Tuesday, and a source with knowledge of the probe told Reuters that the absence of either a claim or a ransom demand has puzzled investigators.

The reach may extend past France. Felix Aime, a senior cyber threat intelligence analyst at security firm Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium were also hit. A person in the prime minister’s office said France was in coordination with other European authorities. Dutch retailer Ahold Delhaize is dealing with a cybersecurity issue that began Sunday evening, Reuters reported, the same night the French controllers were hit. The company said it saw no reason to connect the two, and the Netherlands’ national cybersecurity center, NCSC, did not believe the incidents were linked, Reuters reported.

The closest parallel is in the United States. Reuters said the French attacks resemble refrigeration disruptions at about a dozen U.S. military commissaries in late August. At one of them, Fort Huachuca in Arizona said on Facebook that all its commissary freezers had gone into defrost mode, while the Pentagon described the episode only as a “possible refrigeration disruption,” Military Times reported. Three military criminal investigation agencies were looking into the outages by Sept. 1, Stars and Stripes reported, with the Army Criminal Investigation Division’s Cyber Field Office and the Air Force Office of Special Investigations confirming active cases. None elaborated, and as of Sept. 30 no update on any findings had been announced, Stars and Stripes reported.

Whether those inquiries ever connect the two sides of the Atlantic, affected companies face a narrower question now: what record of the attack will survive the cleanup.

Preservation, insurance and the maintenance contract

That record is at risk from the remedy itself. CERT-FR says a factory reset removes what an attacker left on a compromised controller. In this publication’s reading, the same step can also erase the configuration, logs and account changes that prosecutors, insurers and counterparties will want to see. The prosecutor’s stated task is to tie specific losses to the attack, and claims adjusters are likely to ask the same question. Where it can be done without delaying safety measures, capturing configuration exports, alarm histories, defrost schedules, user accounts and remote-access logs before a reset preserves that evidence, as do temperature records and disposal logs for discarded stock.

The alert also points at contracts. It tells operators to check the conditions of their insurance agreements before cutting the internet data feed to their refrigeration maintenance provider. Depending on the policy and the maintenance agreement, cutting that feed in a hurry could raise a coverage question of its own, so the remote-access line belongs on the same checklist as the firewall rule. Security teams should inventory every building system reachable from a public address, and legal teams should know who controls that access under each maintenance agreement.

A defrost cycle is routine maintenance that keeps a refrigerated case running, and on Sunday night, at hundreds of stores across France, intruders turned that same routine into the tool that spoiled the food inside.

If a store’s cold chain can be disrupted from anywhere with an internet connection, who in your organization owns the risk of building systems nobody treats as IT?

News sources

• Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (CERT-FR, ANSSI)
• Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers (Claroty Team82)
• Hackers heat French supermarket fridges, sparking fires and spoiling food (Reuters)
• Investigators hunt French supermarket fridge hackers, no claim of responsibility (Reuters)
• Copeland, Dixell refrigeration systems also hacked, French cybersecurity agency says (Reuters)
• Cyberattack hits 700 supermarkets in France, sparking investigation (Associated Press)
• Fridges in French supermarkets hit by cyber attack (BBC)
• Un piratage “pas si sophistiqué que ça” : ce que l’on sait de la cyberattaque qui a fait monter en température les frigos de supermarchés (franceinfo with AFP)
• French supermarket fridges get hacked, heating to 122°F and sparking fires (CNBC)
• Hundreds of supermarkets in France hit by ‘unprecedented’ cyberattack (Al Jazeera with AFP and Reuters)
• Cyberattack shuts down refrigerators at French supermarkets (BleepingComputer)
• Cyber firm claims over 800 UK supermarkets vulnerable to attack (Cooling Post)
• DoD confirms ‘refrigeration disruption’ at military commissaries (Military Times)
• Army, Air Force special agents investigate refrigerator outages affecting several commissary stores (Stars and Stripes)
• Refrigeration failures affect 4 military commissaries in Europe (Stars and Stripes)

Assisted by GAI and LLM Technologies

Additional reading

• MonsterCloud indictment exposes the ransom payment a victim’s own file may not record
• Wikimedia publishes its own account of suspected OpenAI agent activity on its wikis
• Cyber Law Toolkit tests AI deception, cyber torture and peacetime cyber duties
• ENISA Threat Landscape 2026 finds DDoS leads incident counts while ransomware stays most impactful in the short term
• Cyber Resilience Act reporting starts Sept. 11 on an unfinished platform
• Europe’s draft cloud rule would put vendor ownership in the audit file
• The eight-hour clock starts today: EU e-evidence orders now land on covered U.S. providers’ EU addressees
• California’s AI Transparency Act arrives alongside Europe’s Article 50
• Federal magistrate judge treats LinkedIn’s Relativity aiR workflow as TAR
• One benchmark, three directions: 2026 legal rates rise, flatten and fall at once
• Confidence cools, commitment holds: full results from the 1H 2026 eDiscovery Business Confidence Survey
• Complete look: ComplexDiscovery OÜ’s 2025 to 2030 eDiscovery market size mashup
• The workstream of eDiscovery: Considering processes and tasks

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more understandable for practitioners, policymakers, and business leaders.