Following reports of cyberattacks on French supermarket refrigeration systems that disrupted hundreds of stores overnight from Oct. 11 to 12, 2026, forcing them to discard fresh and frozen food after attackers manipulated temperature controls and defrost settings, the vulnerability has been identified. The attack exploited refrigeration control software supplied by Danish company Danfoss, with affected equipment reportedly including obsolete units that no longer receive software or security updates.
The incident affected about 300 Intermarché and Netto stores, around 100 Coopérative U outlets, 80 Carrefour stores and about 30 Monoprix locations, along with several E.Leclerc stores. At an Intermarché supermarket in Gradignan, southwestern France, losses reached €21,000 at purchase value, while nationwide losses were expected to total several million euros or potentially tens of millions. Some stores temporarily closed while staff cleared affected products to prevent food safety risks.
Attackers raised temperatures in cold rooms and freezers to as high as 50 degrees Celsius and extended defrost cycles from one hour to eight hours, delaying alarms and intervention; temperatures reportedly reached 80 degrees Celsius at one store. Danfoss had issued security alerts in March and August 2025 after addressing software vulnerabilities that could allow attackers to take control of refrigeration systems.
France’s National Cybersecurity Agency (ANSSI) opened an investigation into the cybersecurity incident targeting remote controllers of refrigeration systems. The publisher did not specify the risk. The affected systems include the Copeland xweb, the Danfoss AK-SC series, the Danfoss AK-SM series, and the Dixell xweb. Affected supermarkets kept refrigeration systems disconnected from networks as a precaution against further attacks.
If the equipment is not compromised, begin by exiting the danger zone. First, remove the internet exposure of the affected units and of all units exposed on a public IP address. Before cutting off the transmission of internet data to the refrigeration service provider, check the contractual insurance conditions. Second, check the entire configuration, including the defrosting ranges.
Next, restore service. First, restore access only through a secure VPN or a protected network. In an emergency, simple filtering of the source IPs of refrigeration service providers on a firewall is possible, but this solution should not be considered a long-term one. Second, implement the best practices recommended by the manufacturer, such as a firmware update. For Danfoss equipment, for example, update the firmware, configure the security level in Strict mode, and ensure that the default passwords have been changed.
If the equipment is compromised, also begin by exiting the danger zone. First, remove the internet exposure of the affected units and of all units exposed on a public IP address. Before cutting off the transmission of internet data to the refrigeration service provider, check the contractual insurance conditions. Second, restore the equipment through a factory reset.
Then, restore service. First, restore access only through a secure VPN or a protected network. In an emergency, simple filtering of the source IPs of refrigeration service providers on a firewall is possible, but this solution should not be considered a long-term one. Second, reconfigure the equipment for its return to service. Third, implement the best practices recommended by the manufacturer, such as a firmware update. For Danfoss equipment, for example, update the firmware, configure the security level in Strict mode, and ensure that the default passwords have been changed.
“While the French and European authorities have not attributed the attacks, we know what could have been done to reduce the impact of such a consequential incident,” the Operational Technology Cyber Coalition (OTCC) wrote in a Wednesday statement. “ANSSI recommends implementing basic cybersecurity best practices, such as using secure VPNs, changing default passwords, and updating firmware when possible. Unfortunately, the failure to implement cybersecurity fundamentals led to a significant incident.”
OTCC detailed that these are some of the best practices it called out in its recent report calling for the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue a binding operational directive (BOD) to improve OT cybersecurity within the federal government. “Such a BOD would send a strong signal to the private sector about what steps to take in their own environments. With that BOD, the U.S. Department of Agriculture could approach the Food and Agriculture critical infrastructure sector and recommend implementing best practices. While no incidents have been reported in the United States, malicious actors are undoubtedly viewing this incident as a potential attack vector to perform here. We cannot wait for that to happen.”
The coalition observed that the incident is yet another reminder that OT threats are immediate and reach deeply into everyday life. Protecting the systems that preserve food, deliver water, and power communities is essential to public safety and economic security.
“The reported manipulation of supermarket refrigeration systems shows how attackers can cause physical disruption through routine operational controls,” Sai Molige, senior manager of threat hunting at Forescout, wrote in an emailed statement. “In this case, attackers reportedly manipulated defrost functions and suppressed or delayed alarms, putting food stocks at risk while making malicious activity resemble normal operations. Confirmed compromises involving Danfoss AK-SM and AK-SC systems and Copeland/Dixell XWEB controllers point to a broader exposure across remotely managed refrigeration equipment.”
Molige mentioned that the key question is how attackers reached those controls—through individually exposed interfaces or shared maintenance infrastructure. “Remote access often sits within service arrangements involving vendors, contractors, facilities teams and IT, leaving responsibility for security unclear. Retailers need clear ownership of those connections, tighter control over contractor access, and monitoring for unauthorized defrost commands, alarm suppression and configuration changes. Independent temperature measurements are also essential when the controller reporting conditions may itself be compromised.”
A Claroty blog post flagged one concern moving forward as the cascading impact of this incident. “Vulnerabilities in other refrigeration systems, for example, have been uncovered. Team82, in August, also published research on security issues impacting the Copeland XWEB platform and disclosed 23 vulnerabilities, 21 of which were high-severity. The flaws, which were patched by Copeland in a firmware update in February, could allow an unauthenticated attacker to progressively bypass the platform’s security mechanisms, resulting in root-level remote code execution (RCE).”
“As we saw in the cyberattacks affecting water utilities this summer in the United States, attackers are increasingly seeking disruptive attacks against critical services and will try to carry out hacks at scale,” Team82 researchers added. “With artificial intelligence (AI) reducing the time to scan systems for access control issues or vulnerabilities, coupled with geopolitical conflict spiking activity against critical infrastructure, these are issues that must be prioritized within operational environments.”
The researchers observed that food and beverage retailers and manufacturers should not assume that assets such as these controllers are isolated and secure. Supermarkets, cold-storage facilities, and other healthcare and commercial enterprises dependent on refrigeration should inventory assets, assess whether they are directly internet-facing, and ensure administrative services are restricted to trusted network segments or secured behind VPNs or industrial remote access solutions.
“The cyberattack on French supermarkets demonstrates how cybersecurity failures can move beyond stolen data and disrupted IT systems to directly affect physical operations, public safety and essential services,” John Walsh, field CTO, government and critical industries at IGEL, said. “When attackers can remotely manipulate refrigeration equipment, the consequences are no longer confined to the network. They can include damaged infrastructure, destroyed inventory, interrupted food supplies and potentially dangerous operating conditions.”
Walsh noted that the fundamental challenge is that OT (operational technology) has become increasingly connected, while many industrial environments still depend on legacy equipment, fragmented management systems and remote-access architectures that were not designed around continuous verification of trust.
“Organizations need to move beyond simply protecting the network perimeter. They must establish trusted access and execution environments, maintain visibility into connected operational assets, enforce least-privilege access, segment critical systems and continuously validate the identity and security state of devices and users accessing operational infrastructure,” Walsh observed. “Equally important, security controls must be complemented by independent operational safeguards that prevent unauthorized commands from creating unsafe physical conditions.”
“The cyberattack on French supermarkets is a reminder that an attack doesn’t need to involve stolen data or a ransom demand to bring a business to a halt. Disrupting the systems a business relies on can be just as damaging,” Nolen Johnson, director of hardware/OT security testing at LevelBlue, wrote in an emailed statement. “In this case, attackers targeted refrigeration systems that keep food safe, showing how cyberattacks can have consequences well beyond financial losses.”
He added that many supermarkets and retailers still rely on legacy technology. Once installed, these devices often become effectively invisible. They perform their function reliably and quietly, and unless something breaks, nobody thinks about them as computers that need ongoing security maintenance. Some remain operational for decades, long after vendors stop providing security updates.
