Hundreds of French supermarkets hit as attackers hijack Danfoss refrigeration controllers

During the night of 11 to 12 October 2026, attackers took control of Danfoss refrigeration supervisors in French supermarkets and forced fridges and freezers to heat up. CERT-FR issued an alert about compromised Danfoss AK-SM and AK-SC units; Les Mousquetaires report 300 Intermarché and Netto stores affected and Coopérative U fewer than a hundred.

What happened

On the night of Sunday 11 to Monday 12 October 2026, refrigeration systems in hundreds of French supermarkets were tampered with remotely. On 12 October, CERT-FR published alert CERTFR-2026-ALE-012: it has seen several compromises of Danfoss AK-SM and AK-SC supervisors, the controllers that manage cold rooms, fridges and freezers, and points to management interfaces left reachable from the internet.

The Les Mousquetaires group told BFMTV that 300 Intermarché and Netto stores were affected, and said the attack apparently hit a service provider that manages store refrigeration. Coopérative U chief executive Dominique Schelcher confirmed the attack publicly; the chain told BFMTV that fewer than a hundred of its stores were hit. According to 01net, the Paris prosecutor’s office has handed the investigation to the national anti-cybercrime office (OFAC), which is also looking at reported fire starts. BFMTV reports that ANSSI was brought in by the Prime Minister.

How the attackers caused damage

According to BFMTV’s industry sources, the attackers forced a continuous defrost cycle with a setpoint of 50 °C, so cabinets heated for hours. Many stores had to discard frozen and fresh products; BFMTV cites €270,000 of losses for two stores in Alsace alone. According to 01net, Danfoss said most of the affected software is obsolete and no longer receives security updates; several outlets mention firmware versions older than 4.

What to do now

1. List every building controller (refrigeration, HVAC, energy) and ask your contractors which firmware each one runs.
2. Check internet exposure: scan your public IP ranges (for example nmap -Pn on your public addresses) and look for 3G/4G routers or remote-access boxes installed by a contractor.
3. Disconnect or filter the AK-SM and AK-SC interfaces, as CERT-FR advises; if remote maintenance is essential, allow only the provider’s IP addresses or a VPN.
4. If compromise is suspected, follow CERT-FR: restrict access to authorised providers, factory-reset the unit, apply all patches, change every password, audit accounts and rebuild the configuration.
5. Replace end-of-life controllers that no longer receive updates, and file a complaint if you were affected.

Our take

A fridge controller is a server too: it has an operating system, accounts and a web interface. Equipment installed by a contractor outside the IT department’s view must still appear in the inventory, be patched and stay off the internet. Otherwise a forgotten box can cost far more than a hacked web server.

Sources

• CERT-FR — Incident de sécurité ciblant les Danfoss série AK-SM et AK-SC (CERTFR-2026-ALE-012)
• CERT-FR — Recommandations de sécurité (CERTFR-2025-DUR-003)
• BFMTV — La température est montée jusqu'à 50 degrés : une cyberattaque contre les systèmes frigorifiques provoque la destruction de produits frais dans des centaines d'Intermarché et de Super U
• 01net — 50°C dans les frigos : une cyberattaque oblige Intermarché, Leclerc et Super U à jeter leurs produits frais
• ZATAZ — Une cyberattaque dérègle le froid des supermarchés

How we choose, verify and write our analyses →