Supermarket Refrigeration Controller Attacks Spread From France to Five More Countries
France's economy minister put the October toll at about 700 of the country's roughly 10,000 supermarkets. A second wave on Nov. 2 reached stores in Belgium, Estonia, Ireland, Luxembourg and Sweden. No one has claimed either.
Attacks on internet-connected supermarket refrigeration controllers that disrupted about 700 stores in France last month spread to at least five more European countries on Nov. 2, and no person or group has claimed responsibility for either wave.
The first attacks began the night of Oct. 11. France's Economy Minister Roland Lescure told the National Assembly on Oct. 13 that about 700 of the country's roughly 10,000 supermarkets were affected, according to ACHR News and SecurityWeek. The Paris prosecutor's cybercrime unit opened an investigation and said the attacks caused fires as well as food losses.
What CERT-FR named
France's government computer emergency team, CERT-FR, part of the national cybersecurity agency ANSSI, issued alert CERTFR-2026-ALE-012 on Oct. 12. It said the team was aware of "nombreuses compromissions," numerous compromises, of remote controllers for refrigeration installations: the Danfoss AK-SM and AK-SC series. An Oct. 13 update added Copeland XWEB and Dixell XWEB supervisors, and an Oct. 16 revision updated the recommendations.
The alert does not tie the compromises to a specific vulnerability. "In general, exposing a management interface on the Internet runs contrary to good practice," CERT-FR wrote, in a translation of its French text.
Danfoss said most of the affected units were older AK-SM 800 and AK-SC 355 controllers that no longer receive security updates, according to SecurityWeek. Support for the AK-SM 800 ended in May 2021, and the AK-SC 355 was discontinued in 2016. Some current AK-SM 800A units running outdated firmware were also hit. Copeland told ACHR News, "We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers," and said it was working with affected customers.
Defrost cycles stretched to eight hours
Investigators have seen neither a claim of responsibility nor a ransom demand, SecurityWeek reported. Le Monde reported that defrost cycles were lengthened from one hour to as many as eight, which delayed alarms. At Intermarché, where owner Les Mousquetaires counted about 150 affected stores, units ran at 50 C, or 122 F, for six hours and all the food was thrown out. Carrefour said 80 of its stores were affected. Coopérative U said 80 were targeted but only a minority had to discard products, and two stores in Alsace reported combined losses of 270,000 euros.
Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels on Oct. 11, more than 1,800 of them in France. By Oct. 14 the French count had fallen to 537. Patched and unpatched units dropped off at about the same rate, which Censys read as operators unplugging controllers instead of updating them.
SNEFCCA, the French refrigeration and air-conditioning contractors' association, said installers moved quickly to disconnect affected monitoring systems, that contractors had not been warned of the vulnerability in advance, and that they were waiting for an approved procedure to reconnect equipment safely, ACHR News reported.
The Nov. 2 wave
Overnight temperature spikes were recorded Nov. 2 at stores in Belgium, Estonia, Ireland, Luxembourg and Sweden, Al Jazeera reported. Swedish grocer ICA said 23 stores were hit and eight had to dispose of refrigerated and frozen products. "All affected stores had their equipment connected outside ICA's centrally managed store network," a spokesperson told Cybersecurity Dive. Irish chain SuperValu said 13 of its 223 stores had a specific refrigeration model affected, and Ahold Delhaize reported dozens of stores in Belgium and Luxembourg. Copeland confirmed some XWEB controllers were targeted in the second round.
The European Commission met with EU agencies and national authorities Nov. 3. In the U.S., the Cybersecurity and Infrastructure Security Agency is "actively monitoring and assessing this malicious cyber activity targeting refrigeration and cold chain monitoring systems," Chris Butera, its acting executive assistant director for cybersecurity, told Cybersecurity Dive. U.S. military officials confirmed in October that they were working with French law enforcement on refrigeration outages at U.S. military commissaries, and the Army Criminal Investigation Division said it is working with the Defense Commissary Agency and the Defense Criminal Investigative Service to determine what caused outages at at least six systems in August.
- Remove internet exposure from the affected units and from any unit on a public IP address
- Check insurance contract terms before cutting the data link to the refrigeration contractor
- Review the full configuration, especially defrost ranges
- Restore remote access only through a secure VPN or protected network. Filtering by the contractor's source IP is an emergency stopgap, not a lasting fix.
- For Danfoss units: update firmware, set the security level to Strict and change default passwords
- For compromised units: reboot, or factory reset, then reconfigure. On end-of-life units a reset alone is not enough, since the device stays vulnerable.
Why This Matters to Contractors
Les Mousquetaires has said the refrigeration systems at its stores were managed by Danfoss and that filing a criminal complaint was therefore up to the supplier, SecurityWeek reported. That puts whoever manages a store's controllers, whether a manufacturer's service arm or an independent contractor, inside the liability question. CERT-FR's instruction to check insurance terms before cutting the contractor's data link suggests some policies depend on that remote monitoring staying connected, which makes disconnecting a decision for the store owner and its insurer as well as the technician.
Sources
- CERT-FR (ANSSI), "Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération," CERTFR-2026-ALE-012, Oct. 12, 2026, last revised Oct. 16, 2026. cert.ssi.gouv.fr
- ACHR News, "Massive Cyberattack Targets Refrigeration Systems at French Supermarkets," Oct. 16, 2026. achrnews.com
- SecurityWeek, "Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers," Oct. 15, 2026. securityweek.com
- Cybersecurity Dive, "European authorities probe ongoing attacks targeting grocery refrigerators," Nov. 3, 2026. cybersecuritydive.com
- Al Jazeera, "Suspected cyberattacks trigger supermarket fridge failures across Europe," Nov. 2, 2026. aljazeera.com
- Ministère de l'Europe et des Affaires étrangères, "Déclaration d'attribution à l'Iran de cyberattaques visant la France," Nov. 9, 2026. diplomatie.gouv.fr
- CERT-FR (ANSSI), "Activités cyber offensives ciblant la France menées par des acteurs iraniens liés au CGRI," CERTFR-2026-CTI-009, Nov. 9, 2026. cert.cyber.gouv.fr