French Supermarket Refrigeration Hack

On the night of October 11, 2026, attackers reached the controllers that keep food cold in French supermarkets and told those machines to heat up. Stores threw out fresh and frozen stock. Prosecutors opened a national investigation that includes reported fires. On October 12, France’s cybersecurity agency warned that remote refrigeration controllers from several manufacturers were being compromised at scale, and that leaving their management interfaces on the internet is how this class of incident keeps working.

This was an operational technology (OT) attack. The target was the equipment that holds a temperature, runs a defrost cycle, and decides whether a cabinet full of food is still safe to sell. A data diode on the path those commands used would have changed the outcome. Expanse enforces that path in hardware: the store can still send temperatures, alarms, and operating records outward, and the network on the far side has no way to send a command back through the same link.

What happened

Public accounts from the first day are still uneven, which is normal while chains count stores and insurers count stock. The shape of the incident is consistent across them.

Coopérative U chief executive Dominique Schelcher wrote on October 12 that stores in the network had been hit from October 11, and called an attack on equipment that preserves fresh food “of extreme gravity” and unprecedented.^{1 2} E. Leclerc, Intermarché, and Coopérative U each confirmed a cyberattack to AFP.²

Counts published that day already differed by source:

• Intermarché told Infosecurity Magazine that 150 Intermarché stores and 30 Netto stores were affected, and that a full waste figure was not yet possible.³
• AFP, cited by CBS, reported at least 300 Intermarché or Netto shops, more than 100 Coopérative U outlets, and several E. Leclerc stores.²
• Carrefour said 80 of its roughly 6,000 stores were hit.^{3 2}
• Groupe Casino said 5% of Monoprix supermarkets were affected.³

BFM TV reported that attackers remotely triggered forced defrost and programmed temperatures as high as 50°C (122°F).³ Intermarché told AFP that affected branches would have to throw away fresh and frozen products.² BFM TV also reported that an Intermarché and a Super U in Haguenau, in Alsace, had already lost about €270,000 of merchandise between them.³

The Paris prosecutor’s office opened an investigation into what it called a large-scale cyberattack on the refrigerators of several major food retail chains, and said the probe would identify victims and establish the link to reported food losses and fires.² EU food and agriculture commissioner Christophe Hansen wrote that food security needs attention at every level, “because the weaponization of food has become a reality.”³

Reporting also described effects, or at least parallel security incidents, outside France. Infosecurity Magazine said supermarkets in Belgium and the Netherlands were reportedly affected.³ Separately, CBS reported that Ahold Delhaize was dealing with a security issue that left a grocery-delivery app unable to fulfill orders.² Those reports should stay distinct until investigators say they are the same campaign.

The machines they reached

The common thread in the first French statements was refrigeration control equipment, much of it from Danish manufacturer Danfoss.

E. Leclerc told AFP that a cyberattack on one of its refrigeration equipment suppliers had repercussions in several stores.² An Intermarché spokesperson confirmed to Infosecurity Magazine that the compromised systems were administered through Danfoss, that the attackers targeted outdated versions of the control software, and that affected stores were running vulnerable consoles with remote-control capability and a communication channel that was not adequately secured.³

Danfoss told AFP that most of the affected equipment was legacy product that no longer receives software or security updates. It named the AK-SM800 and AK-SC355 fridge regulators as notably affected, said a version of the AK-SM800 was running outdated firmware, and said it had long advised supermarkets to move off those models.² Danfoss later confirmed to reporters that the targeted models were either obsolete (AK-SM800 and AK-SC355) or not updated (AK-SM800A).³

On October 12, CERT-FR, the incident-response center of France’s cybersecurity agency ANSSI, published alert CERTFR-2026-ALE-012. The first version covered numerous compromises of Danfoss AK-SM and AK-SC remote refrigeration controllers. The October 13 update added Copeland XWEB and Dixell XWEB, monitoring systems used on commercial refrigeration and HVAC. CERT-FR’s summary is direct: exposing a management interface on the internet is contrary to good practice.⁴

A person close to Prime Minister Sébastien Lecornu told AFP that the national cybersecurity agency had identified a vulnerability in software supplied by a Danish company, contacted the vendor, and was checking whether other countries and other French companies were exposed.² As of October 13, agencies have not published a full intrusion narrative or named a specific vulnerability as the one used in every store. Claroty, which has studied these product families, said the exact access path used against the French chains was not yet public.⁵

What is public is enough to explain the damage. These controllers supervise compressors, evaporators, defrost schedules, and temperature records. Whoever can operate the management interface can change how the cabinets behave. Independent research published before this incident had already shown that a compromised supervisory controller in this class can disable cooling, including in ways that hide the failure from the temperature record operators trust.^{3 5} The French attacks match that outcome: remote changes to defrost and setpoint, applied across many stores at once, against equipment whose management plane was reachable.

Antoine Hautin of cybersecurity firm Almond told AFP that refrigeration equipment once sat apart from the internet and is now tied in through sensors and remote monitoring, and that hitting hundreds of units together showed real coordination.² Claroty has also reported that an earlier scan found 2,765 Danfoss AK-SM 800A devices reachable from the public internet, with no public way to know how many of those had since taken a firmware update.⁵

Why patching and a VPN are weak answers here

CERT-FR’s immediate advice is the right emergency move. Take the affected units, and every similar unit on a public address, off the internet. Check defrost schedules. If a unit is already compromised, factory-reset it, rotate credentials, review accounts, and reconfigure it before it returns to service. Apply the manufacturer’s current guidance, which for supported Danfoss systems includes current firmware, Strict security mode, and replacement of default passwords.⁴

Two limits in that same alert are easy to skip.

First, Danfoss has said most of the equipment hit in France no longer receives security updates.² CERT-FR warns that attacks are probably still underway, and that putting an end-of-life unit back on the internet after a factory reset leaves it able to be compromised again. A reset clears the current foothold. It does not give an obsolete controller a fix that the vendor no longer ships.⁴

Second, CERT-FR says remote access, if it must return, should come back only through a secured VPN or a protected network. Filtering firewall rules down to the refrigeration contractor’s source addresses is described as an emergency step, and explicitly as something that should not be treated as a lasting design.⁴ A VPN is still a bidirectional session. Once it is up, commands travel inward. A stolen contractor password, a compromised contractor network, or a flaw in the VPN appliance restores the same kind of path Intermarché described: remote control over a channel that was not adequately secured.³

CERT-FR also tells operators to check insurance terms before they cut the internet reporting those contractors receive.⁴ That is the operational bind. Stores need temperatures and alarms to leave the building. They do not need the internet, or a contractor laptop, to be able to rewrite the defrost table.

Where an Expanse data diode sits

Expanse is a pair of SFP+ modules: one transmit-only, one receive-only, with fiber between them. The permitted direction is a property of that hardware. A software flaw, a stolen password, or a compromised host on the receiving side cannot turn the optical path around.

For a supermarket cold chain, the useful orientation is outbound from the store:

1. Refrigeration controllers, case controllers, and the local panel stay on a store OT segment with no public address.
2. A transmit module at the edge of that segment sends temperatures, defrost status, alarms, and operating logs across the fiber.
3. A receive module on the monitoring side — the chain’s own dashboard, a security operations center, or the refrigeration contractor’s monitoring network — can only receive.
4. There is no optical return path, so that monitoring network cannot open a management session, push a setpoint, or trigger a defrost cycle back through the link.

Protocols that are already one-way fit this boundary directly, including syslog over UDP and SNMP traps. Where the receiving side needs files or a reconstructed stream, the Expanse Network Stack (ENS) moves those across the diode and rebuilds them on the far side. ENS runs on the hosts. It does not create a reverse path through the fiber.

That is the property this attack ran out of room to use. Forced defrost and a 50°C setpoint are inbound instructions. On a link that can only carry data out, those instructions have no route to the controller. An outdated AK-SM800 firmware image, an unpatched XWEB management service, and a contractor VPN password all fail the same way: the packet never arrives.

The deployment has to be the boundary

A diode enforces the link it is installed on. The French incident is a reminder to be precise about that.

• The public management interface has to go away. A transmit module sitting beside a controller that still answers on a public address does not protect that address. CERT-FR’s first instruction — remove internet exposure — is the precondition for the diode, and the diode is how monitoring continues after that exposure is gone.
• Direction is the control. Outbound from the store OT segment is what stops remote commands. A link aimed the other way would carry data into the store and would need its own inspection and release process. A pair of opposing links, one for telemetry and one for commands, recreates an inbound command path and has to be justified on purpose. For cabinet setpoints, the durable design is outbound telemetry, with changes made at the store or through a rare break-glass procedure that is offline the rest of the time.
• Other doors count. A cellular modem, a vendor remote-access tool, or a firewall rule “just for the installer” is another inbound path. Expanse does not close interfaces it is not placed on. Hosts, management connections, and every remaining route still belong in the assessment.
• Outbound data is a choice. One-way transfer means the receiving side cannot reply. It does not, by itself, decide which temperatures, store names, or account details are allowed to leave. That release decision stays with the operator.
• This is one layer of the system. Expanse is the physical one-way link. It is not, by itself, a complete cross-domain approval, and it does not guarantee delivery under every failure. Stores still need clean backups of controller configuration, a checked defrost schedule after any incident, and people who can run cabinets locally.

Those limits are why the claim here is “would likely have prevented a successful remote attack,” grounded in the mechanism investigators and the vendors have actually described. They are also why the claim holds for the equipment Danfoss says can no longer be patched. You cannot update a controller the vendor has ended. You can still refuse it a route that accepts instructions from the internet.

What to do while the campaign is still active

CERT-FR’s alert says compromise activity is probably continuing.⁴ For a chain, a cold store, a pharmacy wholesaler, or a refrigeration contractor, the practical sequence is:

1. Inventory every AK-SM, AK-SC, Copeland XWEB, Dixell XWEB, and any other supervisory controller that can change a temperature. Record which ones have a public address or a firewall opening for an outside maintainer.
2. Remove that internet exposure now, including units not yet confirmed compromised. Check defrost ranges before trusting the cabinets again.
3. If a unit is compromised, factory-reset it, rotate secrets, review accounts, reconfigure it, and apply every fix the vendor still offers. Treat a reset of end-of-life hardware as incomplete if the management interface goes back on the internet.
4. Read the insurance terms before cutting the contractor’s telemetry, as CERT-FR advises. Plan the replacement path so those records still leave the store.
5. Put that replacement path on hardware that can only transmit. Use Expanse for the one-way link and ENS where the monitoring side needs files or reconstructed streams. Keep remote setpoint changes off that design.

Food retail has spent years connecting cases so that a contractor can diagnose a cabinet without a truck roll. The French attacks show the other side of that connection: one insecure management plane, repeated across hundreds of stores, becomes a way to destroy inventory at national scale. The monitoring need is real. The return path is optional, and this weekend it was the part that failed.

This article is based on public reporting and the CERT-FR alert as of October 13, 2026. Store counts were still moving, and investigators had not published a complete account of the initial access path. The prevention argument follows from the mechanism those sources do describe: remote command of reachable refrigeration controllers.

References