Hackers altered refrigeration settings at hundreds of French supermarkets overnight on Oct. 11-12, forcing stores to discard fresh and frozen food, France’s cybersecurity authorities said.
CERT-FR, the national computer emergency response team, issued an alert on Oct. 12 reporting numerous compromises of remote refrigeration controllers and expanded that alert on Oct. 13 to include additional controller models. The agency warned attacks might still be underway and recommended removing direct internet access, checking settings including defrost schedules, and installing available firmware updates.
Refrigeration controllers: compromises and CERT-FR guidance
CERT-FR’s expanded alert broadened the list of affected equipment beyond Danfoss AK-SM and AK-SC units to include Copeland and Dixell XWEB controllers. For equipment already compromised the agency recommended a factory reset, restoring access only through a secure VPN or protected network, and reconfiguring the devices, while warning that a reset alone would not secure unsupported devices left exposed online.
Affected retailers included Intermarché, Netto, Coopérative U, Carrefour and Monoprix. At one Intermarché store an owner reported a cold room reached 50°C before the damage was discovered early Monday. Coopérative U chief executive Dominique Schelcher confirmed disruption in his chain and said technicians were working to restore refrigeration.
Media reports said staff at a Dixell-equipped supermarket near Bordeaux intervened before food was lost, while an E.Leclerc in Lescure-d’Albigeois with Dixell equipment was forced to discard refrigerated goods, its director told a regional paper.
Danfoss had previously documented attacks involving its systems. In an October 2025 technical bulletin it said the AK-SM 800 model had reached end of life in 2021 and described incidents at stores using the controller in Russia and Israel in 2022. After the French attack Danfoss told Cooling Post that most affected Danfoss units were older models or supported products running outdated firmware and said it was helping customers update equipment where possible and restrict direct internet access. Investigators have not publicly established the precise route used to compromise the controllers.
Command authentication and operating limits
Thomas Plank, CEO of Tributech, an operational-technology security vendor, said controllers need to verify that a remote command came from an authorized source and has not been altered. “A network connection or a login on an intermediate server proves none of these points,” he said in comments provided to TechInformed. He added that authentic instructions should also be checked against the equipment’s operating limits: “Even a genuine command can be wrong,” and unusually prolonged defrost cycles should be rejected or require additional approval. The CERT-FR alert does not specify what checks the compromised controllers performed before executing commands.
The Paris prosecutor’s office has opened an investigation. Reuters reported that no group had publicly claimed responsibility by Oct. 13, and investigators have not established whether the different controllers were compromised through the same weakness.
