Cybersecurity

French Supermarkets Hit

Leon SCOTT

14 Oct 2026 • 5 min read

French Supermarkets Hit

Wow - thats new - attacking fridges I mean.

At least 300 shops of Intermarche or its Netto brand were targeted, along with over 100 Cooperative U outlets, and several E. Leclerc stores, the retailers told AFP in separate statements.

Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

It said its AK-SM800 and AK-SC355 fridge regulator systems were notably affected, with a version of the former using "outdated firmware". It added that it had long advised supermarkets to update from those models. Danfoss gave no figures of how many systems were affected.

How much does an industrial or commercial freezer cost.

Danfoss AK-SM800 series controllers typically range from $3,000 to over $6,000 USD, while the older AK-SC355 controllers cost between $1,000 and $7,000 USD new through parts distributors, or $300 to $2,000 USD on the secondary surplus market. Both systems are legacy commercial refrigeration controllers that are past their end-of-life (EOL) cycle, so actual market pricing depends heavily on remaining supplier stock or whether the unit is refurbished.

Product Pricing Details

AK-SM 880A: Danfoss AK-SM800 Series: Modernised or replacement variants like the AK-SM 880A retail for approximately $6,041.65 USD brand new or $2,974.89 USD via wholesale and industrial surplus suppliers like BuyEMS. [1]
Danfoss AK-SC355: As a highly vintage legacy controller, specialized distributors like Total Parts USA list individual units at a high premium of $6,991.59 USD. However, secondary surplus and marine suppliers like Al Shifa Marine Store offer them for $995 USD, and platforms like PicClick list them starting around $1,950 USD. [1, 2, 3]

Important Lifecycle Note

If you are planning or maintaining a commercial supermarket or cold storage build, keep in mind that these lines are discontinued:

The AK-SC355 was officially phased out by Danfoss in 2016.
The AK-SM800 series hit its end-of-life phase in 2021.

Because they no longer receive official software or cybersecurity updates, relying on them carries operational risks. For new installations, facilities generally transition to the newer Danfoss AK-SM 800A or AK-SM 800 ALLES series system managers.

Lets dig a little

Short answer: no one has publicly confirmed the entry point yet. The evidence points to attackers hitting internet-exposed Danfoss management interfaces running outdated firmware with known, patched flaws. That is inference from the evidence, not a confirmed finding.

I couldn't fetch the RNZ page (it blocked the request). It's AFP wire copy, so I used the syndicated and original reporting instead.

What happened

On the night of 11 October 2026, refrigeration systems at hundreds of French supermarkets were compromised and forced into defrost mode while fully stocked. Fridges and freezers heated to around 50°C for roughly six hours. The heat caused fires and spoiled food at several hundred stores. Chains named include Intermarché, Coopérative U, Carrefour, Monoprix and Leclerc.

How they most likely got in

The attack targeted Danfoss controllers. The attackers hijacked controllers running older Danfoss software and abused the built-in automatic defrost function to raise temperatures.
The vulnerabilities were already public. CISA warned in May 2025 of an authentication bypass (CVE-2025-41450) and in August 2025 of a command injection flaw (CVE-2025-41451) in the Danfoss AK-SM 8xxA series, which is used for refrigeration in food retail. Danfoss fixed these in firmware R4.3.1.
A detailed exploit write-up had been published. Claroty's Team82 found the flaws and published a write-up in August on achieving remote code execution via publicly accessible AK-SM 800A management interfaces. Claroty called the internet-facing web interface the most realistic entry point for a remote attacker.
Many controllers are exposed and unpatched. One researcher found 2,752 Danfoss systems exposed online on Monday, 1,590 of them in France. French scanning firm Onyphe said only a small minority appeared to be running the latest software version.
Remote access is by design. These store control panels can be reached over the internet so maintenance companies can adjust them from anywhere. Intermarché's spokesperson said the attack reportedly affected a service provider that manages refrigeration systems in stores, which suggests a contractor or remote-management route, though that isn't confirmed.

Three experts told Reuters the attack appears to have been easy to pull off. One of them, Ken Munro, described it as a case of basic cyber hygiene, with the attackers pushing on an open door.

Still unknown

Attribution. No hacktivist or ransom group has claimed it, and the absence of a claim or ransom demand has puzzled investigators. The same source also questioned a nation-state motive, noting that it would be odd to hit only a subset of French fridges.
The actual intrusion path. BleepingComputer states that no information is available yet on how the controllers were compromised. France's ANSSI is investigating.
Ahold Delhaize. It had a separate incident, and Dutch authorities saw no connection to the French attack.

Takeaways

Management interfaces for controllers like these shouldn't face the internet. Danfoss itself advises restricting admin access to trusted management networks or VPNs.
Known, patched, internet-exposed bugs are the likely cause, so patch lag and exposure matter more than any sophisticated technique.
The mass-exposure pattern isn't new. In 2019, researchers found about 7,400 internet-exposed RDM refrigeration controllers using default credentials.

If you want, I can turn this into a consolidated write-up with a full references list and notes on which outlets are primary versus aggregators.

Sources:

Thats ugly, documented as well.

#enoughsaid