700 Supermarkets, 50°C Fridges: How Old Controllers Let Hackers Spoil Food

On the night of Sunday, October 11, attackers took remote control of refrigeration controllers in supermarkets across France. They switched fridges and freezers into defrost mode. Some equipment reportedly reached 50°C (122°F), and SecurityWeek reported that temperatures rose for six hours before staff noticed. Stores binned chilled stock, and some reported smoke or small fires.

France's finance minister put the toll at about 700 of the country's roughly 10,000 supermarkets. The devices involved were internet-facing management boxes. Many were old enough that their maker no longer sends security fixes, and others had never been updated.

Based on France's CERT-FR alert CERTFR-2026-ALE-012, CISA advisories ICSA-25-140-03 and ICSA-26-057-10, Danfoss security advisory DSA-2025-08-01, Claroty Team82 research, and reporting by The Register, SecurityWeek, The Hacker News and Cooling Post, checked October 16, 2026. We could not read Ars Technica's original article; we rely on Techmeme's summary of it. Store counts and loss estimates differ between sources, and no official body has said how the attackers got in.

What was attacked, and where

The target was the "system manager" in each store. It runs the refrigeration cases and lets contractors log in remotely. France's CERT-FR alert was first issued on October 12 and updated on October 13. It reports "nombreuses compromissions" (numerous compromises) of Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb units.

Danfoss told the trade site Cooling Post that most affected units were legacy models. It named the AK-SM 800, which reached end of life in 2021, and the AK-SC 355, which was phased out in 2016. Neither gets software or security updates any more. Some current AK-SM 800A units were also hit, and Danfoss said those were running outdated firmware.

Retailers named in coverage include Intermarché and Netto (owned by Les Mousquetaires), Carrefour, Coopérative U, Monoprix and E.Leclerc. The Hacker News compiled the companies' own counts: about 80 of Coopérative U's 2,000 stores, 80 Carrefour supermarkets and about 30 Monoprix stores. Figures for Intermarché and Netto ranged from about 150 to at least 300. Citing Reuters, the same report says a Sekoia analyst saw activity in Spain, Portugal, Poland, Germany and Belgium. SecurityWeek also lists the Netherlands.

The vulnerabilities, as the advisories describe them

According to Techmeme's summary, Ars Technica's Dan Goodin reported that the attack "exploited critical vulnerabilities in three models flagged by Claroty and CISA." Official advisories describe two groups of known flaws:

• Danfoss AK-SM 8xxA series. CISA's ICSA-25-140-03 lists three CVEs: an improper-authentication flaw (CVE-2025-41450, fixed in R4.2), a command-injection flaw (CVE-2025-41451) and a configuration-control flaw (CVE-2025-41452). The last two are fixed in 4.3.1. Danfoss's own advisory DSA-2025-08-01, published on August 1, 2025, tells customers to "Install the latest patch with number 4.3.1."
• Copeland XWEB Pro (Dixell). CISA's February 2026 advisory ICSA-26-057-10 covers 23 CVEs in XWEB 300D, 500D and 500B PRO at version 1.12.1 and earlier. Most are command-injection bugs. The worst is an authentication bypass scored 10.0 out of 10. At the time, CISA said no public exploitation had been reported.

In August, Claroty's Team82 published research on the AK-SM 800A. It warned that "compromising the management interface can have significant operational consequences" and found thousands of these interfaces reachable from the internet.

Copeland told The Register: "We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers." Our own calculation: the authentication fix (R4.2) came out in May 2025, about 17 months before the attack, and the 4.3.1 patch about 14 months before.

The impact so far

Les Mousquetaires, which owns Intermarché, said its fridges and freezers were heated to as much as 50°C. Reuters put its affected stores at about 150 and AFP at least 300 across Intermarché and Netto, The Hacker News reported. Its chief executive, Thierry Cotillard, told BFMTV he expects losses of "tens of millions of euros" nationwide.

Fire reports are mixed. The Register says the attacks "sparked fires," and the Paris prosecutor described equipment that began to catch fire. A Les Mousquetaires spokesperson, however, told CNBC its stores saw smoke but no fires. The Paris prosecutor's cybercrime unit has opened an investigation, handled by the national anti-cybercrime office OFAC.

No group has claimed the attack, and no official body has attributed it. CERT-FR has not said which flaw, if any, was used, and it lists no CVE in its alert.

The catch: what is still unknown

The entry point has not been confirmed. The CVEs above are documented weaknesses, but according to The Hacker News, neither French authorities nor Danfoss had linked them to this attack as of October 13. Claroty's research did not cover the two oldest Danfoss models, which get no patches.

The numbers are also inconsistent. Store counts range from a few hundred in early retailer tallies to about 700 in the minister's figure, and nobody has published an audited loss total.

The exposure has not gone away either. Coalition's scan data, cited by The Register, found 618 Danfoss devices still connected to the internet as of Thursday, 206 of them in France. CERT-FR warns that attack campaigns are "probablement toujours en cours" (probably still ongoing).

What to do if your business runs connected controllers

Restaurants, pharmacies, cold stores and offices with remotely managed refrigeration or building controllers face the same basic risk. These steps come from CERT-FR, CISA and Danfoss.

1. Get it off the open internet. CISA's advice is to "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet." Ask your contractor whether your controller has a public IP address. Before cutting their remote data link, CERT-FR says to check your insurance contract terms.
2. Use a VPN for remote access. CERT-FR says contractors should connect only through a secure VPN or protected network. Filtering by contractor IP address is an emergency stopgap, not a long-term fix.
3. Update or replace. Apply the vendor's current firmware. CERT-FR's Danfoss example also calls for setting the security level to "Strict" and changing default passwords. Danfoss told Cooling Post it is working on "firmware updates where available, stronger network protections and removing direct internet exposure where applicable," and that legacy systems should be migrated to current ones.
4. Check the settings. CERT-FR advises reviewing the whole configuration, especially defrost schedules.
5. If you think a controller was compromised, factory-reset it, reconfigure it and report the incident. A reset on its own is not enough, CERT-FR warns, because an unpatched end-of-life device stays vulnerable.

Frequently asked questions

Was food in affected stores unsafe to buy?

Retailers said they discarded or withdrew products whose storage could not be guaranteed. The government said national food supply was not at risk.

Did hackers use a specific known vulnerability?

That has not been confirmed. Researchers and CISA had documented serious flaws in Danfoss AK-SM 800A and Copeland XWEB Pro controllers, but CERT-FR names no CVE, and no official body has said how access was gained.

Who was behind the attack?

Nobody knows publicly. No group has claimed it, and the Paris prosecutor's investigation has not named a suspect.

Old, internet-facing equipment let attackers spoil food at scale. If your business relies on a remotely managed controller, ask your contractor this week whether it is on the public internet and when its firmware was last updated.