On the night of October 11 to 12, 2026, refrigeration units in hundreds of French supermarkets began heating up instead of cooling down. Attackers had forced the systems into defrost mode, a setting meant to melt built-up ice, causing some equipment to reach 50°C (122°F) and even catch fire. The incident spoiled large amounts of fresh and frozen food and has turned a spotlight on industrial refrigeration controllers made by the Danish company Danfoss, which were sitting exposed on the open internet for months before the attack.

What happened to the supermarket chains

According to Futura-Sciences, more than 400 stores were affected in total, with losses potentially reaching several million euros. Carrefour confirmed 80 of its stores were hit. Intermarché and Netto, both part of the Les Mousquetaires retail group, reported more than 300 affected locations combined. Monoprix said about 5% of its stores were impacted. Leclerc and Coopérative U also confirmed attacks, with Coopérative U’s CEO Dominique Schelcher telling RTL that 80 of its roughly 2,000 stores were hit. Schelcher noted that his stores don’t buy equipment directly from Danfoss but use Danfoss-based systems installed by third-party refrigeration contractors, a detail that highlights how deep this kind of hardware sits in a retailer’s supply chain.

Danfoss said most of the affected equipment was “legacy,” pointing specifically to two older controller models: the AK-SM 800 and AK-SC 355. France’s national cybersecurity agency, CERT-FR, confirmed it was aware of numerous compromises involving these controllers and told operators to disconnect them from the internet or sharply restrict who can reach them. On October 13, CERT-FR updated its alert to also include XWEB supervisors made by Copeland (a US cooling equipment manufacturer) and its Italian brand Dixell, warning that attack campaigns were likely still ongoing. No one has publicly identified who carried out the attacks or how they gained access, and the Paris prosecutor’s office has opened a formal investigation.

How exposed dashboards made the attack possible

To understand the scale of the exposure before the attack, the threat intelligence company IPinfo examined its own weekly internet scans, which connect to common ports (the numbered channels computers use to communicate) across the IPv4 address space and record what responds. In a scan run on October 6 and 7, just five days before the attack, 2,528 internet addresses were found serving a Danfoss StoreView dashboard — the web interface technicians and store staff use to monitor and manage refrigeration controllers remotely. In effect, this is the digital version of a back-room control panel, except that anyone who typed in the right address could open it without authorization.

France accounted for 1,331 of those exposed dashboards, or 53% of the global total, more than every other country combined (1,197 across 72 other countries and territories). Poland followed with 179, then the United States (101), Portugal (92), and Belgium (85). IPinfo’s data rules out some obvious explanations for why France was so disproportionately affected: French dashboards ran the same mix of software versions found elsewhere, so they weren’t simply running older or unpatched code more often than other countries. They also weren’t unusually connected — about two-thirds reached the internet through a single national provider, a pattern similar to how Portugal, Germany, and Romania route traffic through their dominant telecoms.

Notably, 98% of the exposed dashboards were reachable through telecom provider networks rather than cloud or data center infrastructure, consistent with controllers plugged directly into a store’s own internet line, with remote access opened for a technician or head office to check in.

Why these systems stay connected despite the risk

CERT-FR’s own advisory offers a clue as to why so many of these controllers remain online despite the obvious exposure: it tells store operators to check their insurance terms before cutting off the data feed their controllers send to refrigeration contractors. In other words, disconnecting a vulnerable controller isn’t just a technical decision — it can affect maintenance contracts and insurance coverage, creating a disincentive to simply unplug exposed systems even after a public warning.

Aging software behind the control panels

The exposed dashboards reveal two distinct generations of software. The older generation is built with Flash, the browser plug-in Adobe retired in 2020, and is served by the AK-SM 800 controller. Danfoss declared this controller end of life in 2023. That same year, the security research firm Synacktiv publicly documented a login bypass for these devices — a way to access the system without a valid password — and Danfoss’s own guidance at the time was to restrict network access rather than rely on a software fix. This matches the pattern CERT-FR describes now: legacy industrial hardware that is difficult to patch, expensive to replace across hundreds of stores, and often left reachable from the open internet simply because taking it offline is operationally and contractually complicated.

What this means for operators and developers

This incident is a reminder that industrial control systems — refrigeration, HVAC, manufacturing equipment — frequently run on much older software than typical IT infrastructure, and that exposure often isn’t discovered until after an attack. For developers and engineers working with internet-connected hardware, a few practical takeaways stand out:

• Internet-facing management dashboards for industrial equipment should never be reachable without authentication or network restrictions, regardless of how convenient that makes remote support.
• End-of-life hardware and software (like Flash-based interfaces) should be treated as a priority for replacement, not a line item to defer indefinitely, since vendors stop issuing security fixes for it.
• Organizations relying on third-party contractors to install and manage equipment, as many French supermarkets did with Danfoss systems, should still maintain visibility into what’s exposed on their own networks rather than assuming the vendor or installer has handled security.

Frequently asked questions

Were customers’ personal data or payment systems affected?
The excerpt does not indicate any data breach involving customer information; the attack specifically targeted refrigeration controllers and caused physical damage to equipment and food spoilage, not a data theft incident.

Is this vulnerability specific to Danfoss, or does it affect other vendors too?
CERT-FR’s updated alert also names XWEB supervisors from Copeland and its Italian brand Dixell, suggesting the exposure risk extends beyond Danfoss to other refrigeration monitoring systems with similar remote-access designs.

Has anyone claimed responsibility for the attack?
No. As of the source reporting, no individual or group has been identified as responsible, and the method of initial access remains unknown. The Paris prosecutor’s office investigation is ongoing.

Source: France’s Supermarket Fridges Were Vulnerable Online for Months