French Supermarket Refrigeration Attack: What It Teaches

On the night of 11-12 October 2026, a cyberattack hit several French retailers, manipulating their connected refrigeration systems. According to reports, temperatures in fridges and freezers were driven up to 50 °C (122 °F), with cases of fire and spoiled food. At the time of publication (14 October 2026), investigations are ongoing.

The scale of the incident

These are the figures disclosed by the companies or reported by the press:

• Les Mousquetaires (Intermarché group): around 150 stores affected, with refrigeration units heated for six hours overnight.
• Carrefour: attacks affecting 80 supermarkets.
• Monoprix: 5% of its roughly 490 French stores.
• Coopérative U: according to an analysis by Shieldworkz cited by the source, more than 100 stores.

The French national cybersecurity agency, ANSSI, has been tasked with investigating, while authorities assess the possible risk of wider exposure.

A possible Danfoss link, not yet confirmed

Parts of the trade press have pointed to research published in August by Claroty's Team82 on the Danfoss AK-SM 800A, a centralized system manager for refrigeration controllers. The study, based on a Censys scan, identified 2,765 internet-exposed devices and three vulnerabilities:

• CVE-2025-41450: authentication bypass via a hidden "code-of-the-day" login;
• CVE-2025-41451: command injection leading to remote code execution;
• CVE-2025-41452: Nginx configuration injection that can cause denial of service.

Danfoss has released firmware R4.3.1 to fix the issues. It should be stressed, however, that based on available information it is not confirmed that these flaws were exploited in the October attacks: the link remains a hypothesis, and only the investigations can clarify the access vector and responsibility.

Why this case is emblematic

This was not an attack on point-of-sale systems or customer data, but an action with physical effects, carried out through facility controls and the cold chain. Amir Preminger, CTO of Claroty, noted that refrigeration controllers are an overlooked target, often wrongly assumed to sit on isolated networks. The risk, he added, extends to cold storage warehouses, logistics, and the pharmaceutical and chemical industries.

The convenience of remote maintenance is, in effect, the attack surface.

Remote access designed to reduce on-site visits ends up reachable by anyone if the management interface is published on the internet. In a system that commands temperature setpoints, tampering with a single parameter can cause material damage within hours.

What to do in practice

The recommendations that have emerged are simple but often neglected:

• keep management interfaces off the public internet;
• restrict administrative access to trusted management networks, or protect it with VPN and segmentation;
• update device firmware by applying vendor patches.

For those handling temperature-sensitive goods such as food, pharmaceuticals or chemicals, a practical first step is to inventory every controller interface reachable from the internet, including systems installed by third parties and forgotten over time. The second is to introduce monitoring for anomalous setpoints: an alarm on unexpected parameter changes, independent of the control system, can significantly shorten reaction time.

Once ANSSI's investigation provides verified technical details, more precise conclusions will be possible. In the meantime, the episode is a reminder that OT security does not stop at the production line: it also covers the utility systems that quietly protect the value of the goods.