French supermarkets' refrigeration units were compromised, revealing outdated cybersecurity practices and vulnerabilities.
In an alarming incident, supermarket refrigeration systems across France were exposed to potential cyber threats for months before a major security breach occurred. On the night of October 11, 2026, hundreds of French supermarkets found their fridges and freezers suddenly chiming alarms as the systems entered defrost mode due to a cyberattack. This incident not only highlighted the vulnerability of critical infrastructure but also raised questions about outdated cybersecurity measures in place across the country's retail sector.
Cyber attackers targeted refrigeration systems by pushing them into defrost mode, causing temperatures to rise steeply. Reports indicated that some equipment reached dangerously high temperatures of up to 50°C (122°F). The immediate consequences were severe, with many supermarkets forced to dispose of fresh and frozen food stocks, resulting in millions of euros in losses.
More than 400 stores were identified as affected, as per Futura-Sciences. Carrefour confirmed that 80 of its locations faced disruptions, while rivals Intermarché and Netto reported that over 300 of their stores were impacted. Monoprix also indicated that around 5% of its outlets were affected. Other prominent chains, such as Leclerc and Coopérative U, followed suit, admitting to breaches in their refrigeration systems.
The Danish industrial company Danfoss, responsible for many of the refrigeration controllers used in these supermarkets, came under scrutiny after the breach. The company's legacy systems, named AK-SM 800 and AK-SC 355, were particularly exposed, having been identified with numerous security flaws. CERT-FR, France's cybersecurity agency, reported multiple compromises involving these controllers. The agency advised operators to promptly disconnect such units or at the very least, restrict access.
Interestingly, a prior scan performed on October 6 and 7 revealed a staggering 2,528 online Danfoss StoreView dashboards. France alone accounted for 1,331 (53%) of these systems, a figure that dwarfed other countries with similar technologies. The next closest nation was Poland with 179 online systems. This data sparks a question: why was France so disproportionately affected?
Upon analyzing the circumstances, it appears that the prevalence of open dashboards in France is primarily rooted in outdated software. Many controllers were still running on outdated firmware versions, with 85% of French systems exhibiting known security vulnerabilities. The security firm Synacktiv had identified a login bypass exploit for the AK-SM 800 controllers, highlighting the urgency for firmware updates.
Despite this awareness, the situation had not improved significantly within the months leading up to the incident. A review of scans from late March 2026 revealed a troubling trend: the number of outdated controllers remained stagnant, with no substantial measures taken by operators to upgrade or secure the systems.
The recent attack served as a catalyst for rapid change, as following the event, drastic action was taken to secure the exposed systems. Subsequent scans revealed a dramatic 76% drop in the number of Danfoss dashboards remaining online, with many stores rushing to disconnect potentially vulnerable units.
This incident serves both as a wake-up call and an opportunity for constructive change within the retail sector and beyond. It is evident that many organizations continue to underestimate the importance of robust cybersecurity measures, particularly regarding critical operational technologies. The reliance on outdated systems without proper maintenance or upgrades poses significant risks, not just to businesses, but to entire supply chains and consumer safety.
Though the full ramifications of the hacks are still being assessed, the warning signs remain clear. Exposed systems with outdated software are an invitation for cybercriminals, bringing forth the necessity for urgent cybersecurity assessments and modern solutions. Forward-looking solutions may involve investing in better security protocols, regular software updates, and embracing new technologies that can help drown vulnerabilities in anonymity.
The unfortunate incident affecting French supermarkets illustrates a broader trend: as the digital transformation accelerates, industries are becoming increasingly reliant on technology that requires solid cybersecurity strategies. Organizations must prioritize cybersecurity investments, not just as an afterthought but as a core component of their operations.
Cyber resilience is no longer an option; it is a necessity. Effective policies and practices that mitigate risks must be put in place. In addition, organizations may explore options such as secure virtual private networks (VPNs) for remote access and conducting regular cybersecurity training for their staff.
The cyberattack led to significant losses for supermarkets, as many fresh and frozen food items had to be discarded when refrigeration systems malfunctioned. Reports indicated losses could reach several million euros.
Most refrigeration controllers were running on outdated software, with many known security flaws. Major issues were found in legacy systems like the AK-SM 800 and AK-SC 355 models produced by Danfoss.
To mitigate risks, organizations should conduct regular cybersecurity assessments, implement software updates, create secure remote access protocols, and invest in training staff on cybersecurity best practices. This proactive approach helps to fortify against cyberattacks.