French Grocery Store Refrigeration Hack Shows the Growing Risk of OT Cyberattacks

What happened

On the night of Saturday 11 October 2026, attackers reached the refrigeration controllers in roughly 700 of France's approximately 10,000 supermarkets and put them into forced defrost. Defrost is a routine function — every commercial refrigeration system runs it on a schedule to clear ice off the evaporator coils. Run it continuously on a full case, and it becomes a heater.

By the time staff arrived, some units had reached 50 °C (122 °F) after about six hours. Several caught fire or partially melted. Stores threw out whole aisles of chilled and frozen stock.

The affected chains, as reported, include more than 300 Intermarché and Netto stores, over 100 Coopérative U outlets, 80 Carrefour supermarkets, around 30 Monoprix, and a number of E.Leclerc stores. Ahold Delhaize was also affected. Two outlets in Alsace alone reported combined losses of €270,000; across the incident the figure is in the millions of euros, with trade press putting the destroyed product in the tens of millions of dollars.

France's Prime Minister, Sébastien Lecornu, directed ANSSI — the national cybersecurity agency — to investigate and coordinate with other European countries. Paris prosecutors opened their own investigation. Similar exposure has since been identified in Belgium, Germany, Luxembourg, the Netherlands, Portugal, Poland and Spain. At the time of writing nobody has been publicly identified as responsible, and no motive has been established.

Dominique Schelcher, chief executive of Coopérative U, called it unprecedented. For once that is not hyperbole: this is one of the first mass-casualty events in commercial building automation, and the thing that broke was not a server.

How it was possible

The equipment at the centre of this is made by Danfoss, a Danish manufacturer whose refrigeration and building controls are installed worldwide. Danfoss has said that most of the affected units were AK-SM800 and AK-SC355 system managers — legacy products that no longer receive software or security updates — along with AK-SM800A units running firmware more than a year behind its security fix.

Three things turned that into a national incident.

The controllers were reachable from the internet. A Shodan scan on 19 August 2026 found 3,726 of these controllers answering on the public internet. Some were not even behind the store's network: they were connected through their own cellular modems for remote monitoring, which means the site firewall never saw that traffic at all.

The authentication was not meaningful. Claroty published research in August 2025 describing a hidden "code-of-the-day" authentication mechanism in this hardware family. The security researcher Kevin Beaumont summarised the practical effect bluntly: "The username is admin and the password changes every day automatically to.. the current date. Every single one is like this." Four CVEs are associated with these products — CVE-2023-25915, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452 — and CISA has published an advisory on an authentication flaw in the AK-SM 800A. The first of those identifiers is from 2023.

Nothing independent was watching the temperature. Claroty's research also demonstrated that a compromised AK-SM800A could be made to disable cooling while continuing to report normal temperatures. If your only thermometer is the device that has been taken over, you find out when somebody opens a freezer door.

None of this required a sophisticated attacker. It required an internet-connected device with a predictable password, which had been documented publicly for years.

Why a refrigeration controller is a security problem

If you run IT, a refrigeration controller probably is not on your asset list. It was specified by the refrigeration contractor, commissioned by the equipment vendor, and is maintained under a service agreement that predates anyone currently in the building. Its network connection was arranged so the vendor could dial in. Nobody wrote it down.

That is the normal state of operational technology — OT, the systems that control physical processes, as distinct from the IT systems that process information. It covers refrigeration, heating and air conditioning, building management, lighting, access control, cameras, pumps, conveyors and production machinery. We have written before about OT and ICS security as a discipline; this incident is what the discipline is for.

Two properties make OT different from a laptop fleet.

The first is that the consequences are physical. A compromised file server costs you data. A compromised refrigeration controller costs you inventory, and in several French stores it cost them the case itself. There is no backup that restores forty pallets of frozen food.

The second is that the lifecycle is far longer than IT equipment, and the replacement cycle is driven by mechanical failure rather than software support. A controller installed in 2012 is still doing its job perfectly well in mechanical terms. The vendor stopped shipping security updates for it years ago. Both things are true at once, and the second one is invisible until an incident like this.

How these systems are used in the United States

Danfoss is a major supplier of building control systems in the US, and the architecture that failed in France is the standard arrangement here. A US grocery store, cold-storage warehouse, restaurant group or food distributor is very likely running:

• a refrigeration system manager that sequences compressors, monitors case temperatures and schedules defrost cycles;
• a building management system — BMS — for heating, cooling and lighting;
• an energy management system that the utility or an energy contractor can see into for demand-response programmes;
• a vendor remote-monitoring link so the service company can diagnose an alarm without driving out;
• increasingly, a cloud dashboard for multi-site temperature compliance reporting, because food safety regulators want temperature records.

Every one of those is a legitimate business requirement. Each also creates a path into the controller, and in most installations those paths were configured for convenience by whoever installed the equipment.

The US also has a regulatory dimension France does not. Under the FDA's Food Safety Modernization Act, and under state retail food codes, a grocer has to document that chilled and frozen product was held at safe temperatures. If the system that produces those records can be manipulated — and Claroty showed that it can — then a refrigeration compromise is a food-safety documentation problem as well as a loss event. That is worth raising with your quality team before it is topical.

No US refrigeration outages attributable to this campaign have been reported as of this writing. CBS News reported that Ahold Delhaize — which operates in both Europe and the US — also experienced "security issues" in its US operations, without further detail, and we would not read more into that than the reporting supports.

The exposure, though, is the same exposure. 3,726 controllers were answering the public internet in August; the French stores were a subset of what was reachable, and the identical equipment is installed across North America under the same service arrangements.

What to actually do

If you operate this equipment and want the specific, ordered fix — which models, which firmware release, what to do about the ones that cannot be patched — read the remediation plan for Danfoss AK-SM and AK-SC sites. The rest of this section is the general shape of the problem.

The remediation here is unglamorous and mostly free. It is also well understood — none of what follows is novel, which is rather the point. The reason the French stores were vulnerable is not that the countermeasures are hard. It is that nobody owned the problem.

Four things matter more than everything else combined, and they are worth doing in this order.

Find out what you have. You cannot protect a controller you do not know exists. That means a walk of the building with the facilities manager, the refrigeration contractor's service records, and a look at what the firewall is actually passing. Pay particular attention to equipment with its own cellular connection, because it will not appear in any network inventory you already have.

Take management interfaces off the internet. This single change would have prevented most of what happened in France. A refrigeration controller has no business accepting connections from arbitrary addresses. If the vendor needs access, there are safe ways to give it to them, covered below.

Separate the operational network from the business network. A camera, a rooftop unit and a point-of-sale terminal should not be able to reach each other. Segmentation is the control with the best ratio of risk reduced to money spent, and on most existing equipment it is a configuration change rather than a purchase. Smaller organisations can follow our low-cost OT network segmentation guide, while larger, multi-site environments should work from a more formal enterprise OT security architecture. The principle is identical in both; the depth and the governance around it differ. For the general case, see also network segmentation and shrinking the blast radius.

Fix the credentials and the firmware. Default and derivable passwords are what made the French attack trivial to scale. Where a device cannot be given a real password — and some genuinely cannot — that device needs to be somewhere an attacker cannot reach it, which brings you back to segmentation.

Vendor access

Most OT equipment is maintained by somebody outside your organisation, and they need a way in. The common arrangement — a port forwarded from the internet, or a shared vendor account with a password the whole service team knows — is the arrangement that failed here.

The safer patterns are not expensive: a site-to-site or client VPN, a zero-trust remote access broker, a jump host the vendor connects through, access granted for a maintenance window rather than permanently, and named accounts so you can tell which engineer did what. Smaller sites can find the practical version in the low-cost guide's section on vendor remote access; organisations with dozens of vendors across many sites need the vendor risk and privileged access controls in the enterprise guide, because at that scale the problem is governance rather than configuration.

Remote access for your own staff

The same applies to your own people. Someone has to be able to check a store's refrigeration at two in the morning, and the temptation is to expose the interface so they can reach it from a phone. Put it behind a VPN or a zero-trust access gateway with multi-factor authentication instead. Both guides cover the implementation — the simpler version for single or few sites, the centralised version where you need session recording, approval workflows and just-in-time credentials.

Independent monitoring

Because a compromised controller can lie about temperature, the monitoring that actually protects inventory is monitoring that does not depend on the controller. A separate temperature sensor, on a separate network path, with its own alerting, is cheap and it is the control that would have woken someone up in France at midnight rather than at six.

What this does and does not buy you

Segmentation, controlled remote access, strong authentication, current firmware and independent monitoring would have stopped this particular attack. They will not stop everything, and nobody should tell you otherwise. An attacker with a vendor's credentials, or with access to a laptop that is allowed to manage the controllers, is a different problem.

What these controls do is remove the easy paths and make the remaining ones noisy. The French stores were hit because they were findable from the internet with a guessable password — a condition any competent scan picks up in an afternoon. Removing that condition moves you out of the population that gets swept up in an opportunistic campaign, which is the population almost every victim belongs to.

That is what defence in depth means in practice. Not a guarantee, but several independent things that each have to fail before the freezer gets warm.

Where to go next

• Small and mid-sized organisations — a single store, a restaurant group, a warehouse, a commercial building, a clinic — start with the low-cost OT and IoT security guide. It is written for environments with one firewall and no security team, and most of it is configuration rather than purchasing.
• Large, multi-site or regulated organisations — supermarket chains, logistics operators, manufacturers, hospitals, universities, property portfolios — work from the enterprise OT security architecture guide, which covers asset discovery, zone-based segmentation, an IT/OT DMZ, privileged access management, passive monitoring and site isolation.

If you want help working out which of your systems are reachable from the internet today, that is a short engagement and a sensible first step. Our OT and ICS security and attack surface management practices do this work, and you can also measure a single site yourself with our free port scanner, which checks the connection you run it from and nothing else.

Sources

• 2026 French supermarket refrigerator hack — Wikipedia
• Hackers turn up the heat in refrigerators at hundreds of supermarkets in France — CBS News
• Major French Supermarket Chains Hit by Cyber-Attack — Infosecurity Magazine
• Hack of Danfoss refrigeration controllers in Europe causes tens of millions in food losses — Facilities Dive
• Hundreds of supermarkets in France hit by 'unprecedented' cyberattack — Al Jazeera
• Cyberattack targeting refrigeration systems hits 700 supermarkets — The Washington Times