Cyberattack warms up fridges at French supermarkets
Attackers took over controllers exposed to the internet and triggered defrost cycles. Reports of affected stores range from 250 to 700 and no one has claimed the attack.
Unidentified attackers took control of refrigeration systems at French supermarkets on the night of Sunday, Oct. 11, 2026, according to BleepingComputer. They got in through controllers running old versions of Danfoss software and switched on the automatic defrost function of those units, so refrigerators and freezers heated up. Ars Technica reports that some reached 50 °C (122 °F), with spoiled fresh and frozen food and fires in electrical installations.
According to France's cybersecurity agency, the damaged equipment came from three manufacturers (Danfoss, Copeland and Dixell, the last owned by Copeland), per Euronews. The sources name Intermarché, Coopérative U, Carrefour, Monoprix and Leclerc. The Paris prosecutor's office opened an investigation and, as of Oct. 14, no one had claimed the attack or demanded a ransom.
The Danfoss AK-SM 8xxA controllers had known flaws. Danfoss published advisory DSA-2025-03-01 on March 24, 2025, about CVE-2025-41450, an authentication bypass rated 8.2 on the CVSS scale, and its fix came in version 4.2. No source confirms which flaw was used in this case.
| Outlet | Figure |
|---|---|
| BleepingComputer, citing French media | 250 to 350 |
| Euronews | at least 350 |
| Ars Technica, estimate | about 700 |
There is no official figure. Access has not been closed either: the firm Predicta Lab found 2,752 Danfoss systems visible on the internet on Oct. 12, 1,590 of them in France, and Reuters, cited by Euronews, counted at least 4,500 interfaces on Tuesday.
What manufacturers and experts say
Danfoss said many units reached the end of their life cycle and no longer receive security patches. Copeland acknowledged a vulnerability in a discontinued generation of controllers. Dominique Schelcher, president of Coopérative U, called it an "extremely serious" matter without precedent. According to the firm Pen Test Partners, two measures would have been enough: taking the controllers off public access, behind a VPN that admits only authorized addresses, and moving them to a supported version.
Ars Technica adds that Spain, Portugal, Poland, Germany and Belgium were reportedly affected, a claim no other source confirms. None of the sources consulted reports effects in Mexico. The French agency's statement and the outcome of the investigation are still needed to know the real scope and who was behind it.
