French supermarket refrigeration attack, October 2026

What happened. Overnight on October 11 to 12, 2026, someone reached the internet-exposed refrigeration controllers of French supermarkets and put their display cases, cold rooms and freezers into a forced defrost at 50°C for hours[1][2]. On October 13, the Minister of the Economy and Finance told Parliament that about 700 of France’s roughly 10,000 supermarkets had been affected[3]. Stores that did not catch it in time threw away their fresh and frozen stock[4].

Why it matters. The attack went straight from the internet to the equipment that keeps food cold, with no corporate IT network in the path, and caused physical loss at hundreds of sites in one night[2]. The head of France’s national cybersecurity agency, ANSSI, said it relied on “the absence of basic protections in the stores”[5].

About this analysis. This analysis sets out what is known, stage by stage. It covers the French attack of October 2026 only; a later wave at stores elsewhere in Europe has its own page. Much of the store-level detail comes from trade press and wire copy, and no authority has published a technical report. This account reflects the best available information as of November 5, 2026; new information could confirm, change or discredit parts of it.

Highlights

• Controllers at stores of five grocery groups, Intermarché and Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc, were set to defrost continuously at 50°C, and the government put the count at about 700 supermarkets[6][3].
• The controllers were reachable from the public internet. ANSSI’s director general told the Senate that the administration interfaces were protected only by weak passwords, and ruled out zero-days and a sophisticated attack[2][5].
• Danfoss said most of the affected equipment was its end-of-life controllers, which no longer receive updates; CERT-FR also named Copeland and Dixell XWEB units[7][2].
• No one has claimed the attack and no arrest is reported. The Paris prosecutor counts fires among the damage, but their cause is not established[8][1][9].

Attack flow

• Updated: 2026-11-05
• Intent: Malicious [confirmed]
• Threat actors: Not attributed [unknown | No public attribution]
• Access vector: Internet Accessible Device [confirmed]; Default / Weak Credentials [confirmed | weak passwords, per ANSSI]
• IT impact: Not in path [not in path | No IT network involved]
• OT targeting: Direct OT Compromise [confirmed]
• OT sophistication: Crude [confirmed]
• OT impact: Manipulate Control [confirmed | T0836, T0831]; Suppress Alarms [reported | T0878]
• Perils: Overheating [primary]; Fire [reported]
• Financial losses: Products & Materials [confirmed]; Business Interruption [confirmed]; Cyber-Physical Incident Response [confirmed]; Assets & Equipment [confirmed | fires reported]; Cyber Incident Response [confirmed]; Reputation Damage [confirmed | cyber cover absent]; Data Loss [implied]

What happened

The attack began around 23:00 on Sunday, October 11, and its effects were noticed around 04:00, according to Le Monde’s timeline as carried by InformatiqueNews[9]. The attacker set the defrost cycle to run continuously with a 50°C setpoint[6]. Les Mousquetaires told Reuters its cabinets were at 50°C for six hours[1], and one employee found her defrost programmed for six hours instead of the normal 30 to 45 minutes[6]. In many stores the on-call alarm did not ring, or rang late[10][9].

On October 12 and 13 the chains gave their counts. Les Mousquetaires’ rose from about 150 stores to 300 Intermarché and Netto stores; Carrefour reported 80 supermarkets and Monoprix about 5% of its roughly 490 stores; Coopérative U’s CEO said 80 of its 2,000 stores had been hit[1][3]. E.Leclerc said one of its refrigeration equipment suppliers had been attacked, with effects in several stores[11]. The stores that fared best were the ones awake: one moved its stock into its cold rooms at 05:00, had its refrigeration contractor on site within the hour and threw nothing away. Others had to empty, sort, clean and disinfect every unit before restocking[6].

CERT-FR, the national computer emergency response team, issued an alert on October 12, widened it on October 13 to Copeland and Dixell XWEB controllers, and told operators to take the units off the internet[2]. The Paris prosecutor’s office opened an investigation entrusted to OFAC, the national office against cybercrime, and the Prime Minister ordered ANSSI to investigate[12][1]. Censys counted 1,825 internet-exposed Danfoss StoreView hosts in France on October 11 and 537 on October 14, as operators disconnected[13]. On October 21, ANSSI’s director general gave the Senate the first official account of how the attacker got in[5].

Intent: malicious

In a single night, defrost setpoints were raised to 50°C and cycles stretched to six or eight hours across hundreds of stores[1][9]. That is not an error. No ransom demand, no data theft and no claim of responsibility is reported. The absence of a claim or demand “has puzzled investigators”, according to a source with knowledge of the probe[8]. The purpose is unknown. The malice is not.

Threat actors: not attributed

No one has claimed the attack, and no authority has named an actor or reported an arrest[8]. The OT Cyber Coalition noted that French and European authorities have not attributed it[14]. Ian Thornton-Trump, CISO of Inversion6, told ISMG “It’s of course too early to speculate but this screams Russian APT”[7]; nothing official supports that reading, and Moscow has repeatedly denied involvement in any sabotage[15]. On November 4, the pro-Russian groups NoName057(16) and Z-Pentest claimed attacks on Danfoss and Dixell XWEB equipment without evidence; the claim is unverified and does not name France[16].

The Pentagon is treating freezer failures at stores on at least six US military bases in late August 2026 as a suspected cyberattack, and the US Army’s criminal investigators say they are working with French law enforcement “to better understand the refrigeration outages in Europe”[17]. No source links an actor to the French attack. No threat actor is highlighted on the map.

Access vector: exposed controllers and weak passwords

Exposure is confirmed. CERT-FR says the compromised controllers were exposed on public IP addresses and that it is aware of numerous compromises of Danfoss AK-SC and AK-SM and Copeland and Dixell XWEB units[2]. On October 21, ANSSI’s director general, Vincent Strubel, told the Senate Foreign Affairs and Defence Committee that the systems were reachable directly from the internet with no firewall or segmentation, and that the administration interface was protected only by weak passwords. He ruled out zero-days and a sophisticated attack[5][16]. That is official testimony, not a published technical report, and it names no CVE. Weak is not necessarily factory default.

Danfoss said most of the affected equipment used its AK-SM800 and AK-SC355 controllers, which have reached the end of their life cycle and no longer receive updates, and that some stores ran the newer AK-SM800A on outdated firmware[7][1]. Claroty’s Team82 had published three flaws in the AK-SM 800A, all fixed by Danfoss in 2025, among them a hidden “code-of-the-day” authentication bypass, CVE-2025-41450[18][19][20]. CISA said in May 2025 that no known public exploitation had been reported to it[21]. No authority has tied any of these flaws to the attack, and Claroty says no details are available on how the attackers got in[22]. A Synacktiv consultant said an audit a few weeks earlier had found one interface with no password at all[9].

IT impact: not in this attack’s path

No source reports phishing, a corporate network, lateral movement from IT systems or a compromised contractor’s network. The supervisory controllers that run the stores’ refrigeration were themselves reachable from the internet, for remote maintenance, and the attacker went straight to them[2][5]. No customer data was taken and no tills were affected[10]. This stage is marked Not in path, and the flow on the map passes through it without touching any IT technique.

OT targeting: a direct compromise

In every store, the refrigeration controllers were the first and only systems touched. That makes this a direct OT compromise: the attack acted on the equipment that runs the process, not on IT systems the stores depend on. The controllers were the stores’ own equipment, supplied by Danfoss and, per CERT-FR, Copeland and Dixell[2][7]. No outage at Danfoss, a refrigeration contractor or a utility is reported.

OT sophistication: crude

The attacker used the equipment’s own defrost function, through its own management interface, on older devices that no longer receive updates[3][6]. ANSSI’s director general ruled out a sophisticated attack[5], and a Synacktiv consultant said the method need be no more than a Shodan search for exposed units and a check for known weaknesses[9]. Scale is not the same as sophistication: one working method, repeated against every reachable unit, is enough to reach hundreds of stores in a night.

OT impact: settings changed, alarms quiet

What the attacker did on the devices is confirmed by the victims. Les Mousquetaires said its cabinets ran at 50°C for six hours, and Le Monde reports defrost stretched from one hour to eight[1][9]. Thierry Cotillard, president of Les Mousquetaires, said “The attack triggered the defrost cycle on all our refrigerated display cases”[7]. In MITRE ATT&CK for ICS terms that is Modify Parameter and Manipulation of Control, shown on the map as Manipulate Control.

The alarms are less clear. Staff at several stores reported on-call alerts that did not fire or fired late[10][9]. No authority has confirmed that they were deliberately disabled rather than not triggered by a defrost that looked legitimate, so Suppress Alarms is shown as reported. In these stores the alarm sat on the same controller the attacker had reached.

Perils: overheating, and fires of unknown cause

The primary peril is overheating: cabinets heated their evaporators for hours instead of cooling, and the stock spoiled[6][1].

Fire is reported, not established. The Paris prosecutor’s office described a “large-scale” attack causing food losses and fires[1], and said its investigation “should make it possible to identify the victims and establish the link with the damage reported by them in terms of food losses and fires”[7]. InformatiqueNews reports that the fires’ technical origin is still to be determined[9]. No location, count or cost of any fire has been published. Fire is shown as reported, and the link from overheating to fire is dashed.

Where the alarm sat on the same controller as the attack, the only protection left was a person awake in the store.

Financial losses: what it cost

No total exists. On the first day, Cotillard put losses at “tens of millions of euros nationwide in a single day”, and Les Mousquetaires told CNBC its own could reach “several million euros”[1][23]. Both are estimates in words, not figures. Coopérative U’s CEO told RTL a supermarket’s cost would be “180,000 or even 200,000 euros”, an estimate by store size, not a loss at any store[7]. The only figure a named party gave at a stated scope is one store’s.

Loss evidence

• Confirmed: Materials and product loss; Lost revenue and productivity; Manual operations and workarounds; Cyber-physical event response (emptying, cleaning, restocking); Property damage (fires reported); Network event response and recovery; Third-party physical and societal impact; Cyber insurance (cover absent)
• Reported amounts: €50,000 Losses at the Intermarché in Haguenau, according to its manager[24]
• Implied: Equipment repair and replacement; Production data integrity; Voluntary improvements; Property insurance response; Business interruption liability (potential claim); Public relations response
• Not supported: Contingent business interruption; Ransom extortion; Bodily injury; Embedded device replacement; Legally mandated improvements; Regulatory action or liability; Contract violation obligation; Information privacy liability

Who pays is an open question. Intermarché told AFP that its insurance did not cover this type of incident, Cotillard said supermarkets would begin a legal battle over who is responsible for the losses, and brokers told Reuters that cyber insurance typically excludes physical losses[25]. No claim, lawsuit or insurer decision has been reported.

What this incident shows

A building-services controller, not a plant control system, produced the peril, and one method produced it at hundreds of sites at once. There was no protection layer independent of the compromised controller: the alarm was on the same device, and the only layer that held was a person who noticed in the night[6].

Everything in CERT-FR’s alert works on how often this can happen: exposure, credentials and patching[2]. The one control that limited the loss once a controller was reached was an alarm path that did not depend on it, in the stores that had one. When a second wave hit stores elsewhere in Europe on November 2, Danfoss said most stores had acted on its October 13 advice to disconnect, “but a small number did not”[26].

References

1. “Hackers heat French supermarket fridges, sparking fires and spoiling food.” Reuters, 12 Oct. 2026, as carried by Daily Maverick. dailymaverick.co.za/article/2026-10-12-hackers-heat-french-supermarket-fridges-sparking-fires-and-spoiling-food/
2. CERT-FR (ANSSI). “CERTFR-2026-ALE-012 -- Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération [Security incident targeting remote controllers of refrigeration installations].” 12 Oct. 2026, updated 13 Oct. and 16 Oct. 2026. cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012
3. “Cyberattack targeting refrigeration systems hits 700 supermarkets, French government says.” Associated Press, 13 Oct. 2026, as carried by NY1. ny1.com/nyc/all-boroughs/ap-top-news/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says
4. “Hackers Remotely Defrost Hundreds of Supermarket Freezers in France, Causing Fires and Millions in Losses.” International Business Times UK, 13 Oct. 2026. ibtimes.co.uk/france-supermarket-refrigeration-cyberattack-1825287
5. Costa, Louise. “Frigos de supermarchés piratés : l’Anssi pointe des failles de sécurité élémentaires [Hacked supermarket fridges: ANSSI points to elementary security failures].” Le Monde Informatique, 22 Oct. 2026. lemondeinformatique.fr/actualites/lire-frigos-de-supermarches-pirates-l-anssi-pointe-des-failles-de-securite-elementaires-100864.html
6. “Cyberattaque Danfoss : combien va coûter la benne, magasin par magasin ? [Danfoss cyberattack: what will the skip cost, store by store?]” Je Bosse en Grande Distribution, 13 Oct. 2026. jebosseengrandedistribution.fr/2026/10/13/cyberattaque-danfoss-combien-va-couter-la-benne-magasin-par-magasin/
7. Schwartz, Mathew J. (ISMG). “Hackers Attack French Supermarket Freezers Causing Food Loss.” DataBreachToday, 12 Oct. 2026 (updated 13 Oct.). databreachtoday.com/hackers-attack-french-supermarket-freezers-causing-food-loss-a-33084
8. “Investigators hunt French supermarket fridge hackers; no claim of responsibility.” Reuters, 13 Oct. 2026, as carried by Business Insurance. businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/
9. “Supermarchés : l’attaque des frigos Danfoss expose l’angle mort de l’OT [Supermarkets: the Danfoss fridge attack exposes OT’s blind spot].” InformatiqueNews, 13 Oct. 2026. informatiquenews.fr/magasins-systeme-intermarche-leclerc-et-monoprix-touches-par-cyberattaque-250707
10. “Intermarché, U, Market, Monoprix, Leclerc : une cyberattaque coupe le froid dans les supermarchés [a cyberattack cuts the cold in the supermarkets].” Je Bosse en Grande Distribution, 12 Oct. 2026. jebosseengrandedistribution.fr/2026/10/12/intermarche-u-market-monoprix-leclerc-une-cyberattaque-coupe-le-froid-dans-les-supermarches/
11. Khandelwal, Swati. “Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers.” The Hacker News, 13 Oct. 2026. thehackernews.com/2026/10/attackers-heat-french-supermarket.html
12. “Cyberattaque Danfoss et Dixell : les frigos des supermarchés piratés, des millions d’euros de pertes [Danfoss and Dixell cyberattack: supermarket fridges hacked, millions of euros in losses].” FrenchBreaches, 13 Oct. 2026. frenchbreaches.com/blog/cyberattaque-danfoss-et-dixell-les-frigos-des-supermarches-pirates-des-millions-deuros-de-pertes
13. Poireault, Kevin. “France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack.” Infosecurity Magazine, 15 Oct. 2026. infosecurity-magazine.com/news/france-expose-danfoss-controllers/
14. Ribeiro, Anna. “French supermarket cyberattack exposes risks of unsecured remote access and legacy refrigeration systems.” Industrial Cyber, 16 Oct. 2026. industrialcyber.co/control-device-security/french-supermarket-cyberattack-exposes-risks-of-unsecured-remote-access-and-legacy-refrigeration-systems/
15. Mannes, Marie, Helen Reid and Louise Rasmussen. “Cyberattack on fridges hits supermarkets across Europe.” Reuters, 2 Nov. 2026. reuters.com/business/retail-consumer/temperature-soars-swedish-grocery-store-freezers-one-store-blames-hackers-2026-11-02/
16. Hegel, Tom. “Defrost and Disrupt | An Assessment of Europe’s Refrigeration Attacks.” SentinelLABS, 3 Nov. 2026, updated 4 Nov. sentinelone.com/labs/defrost-and-disrupt-an-assessment-of-europe-s-refrigeration-attacks/
17. “Reuters: Pentagon käsitleb sõjaväebaaside külmikute rikkeid küberrünnakuna [Reuters: Pentagon treats refrigerator failures at military bases as a cyberattack].” ERR, 29 Oct. 2026, relaying Reuters. err.ee/1610180536/reuters-pentagon-kasitleb-sojavaebaaside-kulmikute-rikkeid-kuberrunnakuna
18. Claroty Team82. “Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers.” Research, 9 Aug. 2026. claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
19. Danfoss. “DSA-2025-03-01: Improper Authentication vulnerability in Danfoss AK-SM8xxA Series, resulting in an authentication bypass.” Security advisory, 24 Mar. 2025. danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/
20. Danfoss. “DSA-2025-08-01.” Security advisory, 1 Aug. 2025. danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01/
21. CISA. “ICSA-25-140-03: Danfoss AK-SM 8xxA Series.” ICS advisory, 20 May 2025. cisa.gov/news-events/ics-advisories/icsa-25-140-03
22. Claroty Team82. “France Supermarket Hacks Expose Risks of Internet-Facing Refrigeration Systems.” Blog, 12 Oct. 2026 (updated 13 Oct.). claroty.com/blog/france-supermarket-hacks-expose-risks-of-internet-facing-refrigeration-systems
23. Murray, Conor. “French Investigators Probe Supermarket Cyberattack That Could Cost ‘Millions Of Euros’.” Forbes, 13 Oct. 2026. forbes.com/sites/conormurray/2026/10/13/french-investigators-probe-supermarket-cyberattack-that-could-cost-millions-of-euros/
24. Garoscio, Paolo. “Cyberattaque sur les systèmes frigorifiques : des millions perdus dans les supermarchés français [Cyberattack on refrigeration systems: millions lost in French supermarkets].” Journal de l’Économie, 12 Oct. 2026. journaldeleconomie.fr/cyberattaque-frigo-octobre-explications/
25. Abbott, George, and Elizabeth Howcroft (Reuters). “Insurers Say French Supermarkets’ Cyber Insurance Unlikely to Cover Food Losses.” Carrier Management, 20 Oct. 2026. carriermanagement.com/news/2026/10/20/292812.htm
26. “Fridges, freezers of 17 Dutch businesses attacked; large supermarkets unaffected.” NL Times, 2 Nov. 2026. nltimes.nl/2026/11/02/fridges-freezers-17-dutch-businesses-attacked-large-supermarkets-unaffected