French Stores Put Fridges Online, Then Attackers Cooked Them

Unknown attackers spent the night of 11 to 12 October forcing supermarket fridges across France into defrost, pushing cases toward 50C and ruining stock in about 700 stores. Finance minister Roland Lescure gave that national count against roughly 10,000 supermarkets. Staff opening early walked into a blast of hot air, spoiled food, and, in some shops, smoke or sprinkler water.

The boxes that failed were not cash registers. They were refrigeration controllers left reachable so a contractor could change a setpoint from off-site. French food rules ask for temperature control and records. They do not ask for a public internet address.

Hot Aisles in Hundreds of French Stores

Paris prosecutors opened a national case on a large-scale attack against connected refrigerators at major food retailers, and they listed food spoilage and fires among the damage. Prime minister Sébastien Lecornu told ANSSI, France’s cyber agency, to investigate and to warn counterparts in other European countries. No group has claimed the job in public, and no ransom note has been tied to it.

Dominique Schelcher, president of Coopérative U, said 80 of the group’s nearly 2,000 stores were hit. He called an attack on gear that keeps fresh food and feeds the country “extremely serious and unprecedented,” and “unacceptable.”

Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU.
Nos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra…

— Dominique Schelcher (@schelcher) October 12, 2026

Carrefour put its figure at 80 of 6,000 stores. Les Mousquetaires, which owns Intermarché and Netto, later said 300 of those shops were compromised. Monoprix said 5 percent of about 490 stores were affected. E.Leclerc confirmed that an attack on one of its refrigeration suppliers had knock-on effects in several stores. Those chain tallies do not add up to Lescure’s 700, and they were never meant to; independents and smaller banners sit in the national figure.

Two shops in Haguenau, Alsace, put local losses at 270,000 euros, 50,000 at an Intermarché and 220,000 at a Super U. Les Mousquetaires spoke of several million euros across its own estate. Intermarché chief executive Thierry Cotillard said nationwide losses could run to tens of millions of euros in a single day. Those are different piles of money, not one official total.

Remote Defrost Did the Damage Overnight

The move was blunt. Attackers reached the controllers that run display cases and cold rooms and turned on forced defrost, the cycle that is supposed to clear ice for a short stretch. Cases that had been as cold as -27C were driven toward a 50C setpoint (122F) and held there for about six hours. Charles Dezon, who manages the Intermarché in Gradignan, said the attack looked to have started around 11pm and was only noticed at 4am, when a delivery driver found the stock room flooded.

Shoppers never had to be in the building. Overnight is when alarms are thin and a long defrost can look, at first, like a maintenance quirk. Some reports described the defrost window being stretched far past the usual hour, which delayed the moment anyone treated it as an incident. By Monday morning, managers were throwing out fresh and frozen goods because they could not prove the cold chain had held.

Ken Munro, a partner at Pen Test Partners, said it was not hard to work out how to take control of the fridges, and that unit management at the retailers was likely outsourced to a third party that gave little thought to locking them down. That matches how these estates actually run. A frigoriste, not the shop’s IT bench, holds the login. The store holds the melted stock.

Prosecutors included fires in the damage list. Les Mousquetaires said its own shops saw smoke and did not report fires. Both can sit on the same night: overheated plant in a closed aisle will throw smoke in one banner and trip a sprinkler in another.

Why French Supermarket Fridges Sat on the Public Internet

Remote fridge control is sold as safety. A contractor can watch temperatures after closing time, log a clean chart, and fix a failing compressor without driving across town. Matt Hayden, vice president of cyber and emerging threats at General Dynamics Information Technology and a former assistant secretary at the US Department of Homeland Security, described the compliance pitch before this attack landed, using a refrigerator as the example.

So if the health department comes by, they say, ‘Look, my refrigerator was at 27 degrees for the last 72 days,’ and they have a check mark, and they get their A plus. But that simple connectivity is also a vector in which that particular refrigerant unit could be targeted for disruption.

Matt Hayden, VP of cyber and emerging threats, General Dynamics Information Technology

After the French incident he called it a clear case of devices with no useful data on them, and no path into a wider corporate network, being abused because they sat on the internet with unpatched firmware. He expected opportunity hunters, not a nation-state, and he framed the harm as food-supply damage at small scale that could move fast if the same pattern hit heavier plant.

WHAT FOOD RULES ACTUALLY ASK FOR

• Frozen rooms: EU rules from 2005 require instruments that record air temperature on a dated log, kept for at least a year.
• Open cabinets: A thermometer that staff and inspectors can see is enough; continuous recording is not demanded for those small shop-floor units.
• French maxima: Decrees from 2009 and 2013 set limits such as 2C for minced meat on display, without requiring an internet feed.
• The missing duty: None of those texts, and not the later fluorinated-gas leak alarm rule, require a controller to hold a public IP address.

Stores connected anyway because remote maintenance is cheap and a digital log is easy to wave at an inspector. CERT-FR later had to tell operators to check insurance contracts before they cut the internet data feed back to the refrigeration contractor, which is a neat statement of how the risk was built. The same pipe that kept a policy happy is the pipe an outsider used to cook the aisle.

Three Vendors and Two End-of-Life Lines

ANSSI’s CERT-FR named the product families. Danfoss AK-SM and AK-SC controllers were in the first alert. Copeland xweb and Dixell xweb, Dixell being a Copeland brand, were added the next day. Danfoss said most of the French units that were hit were legacy products that no longer get software or security updates, plus some current AK-SM 800A boxes running old firmware. Copeland said it had found a vulnerability in a discontinued, end-of-life generation of controllers and that it was working with customers.

CONTROLLERS NAMED AFTER THE ATTACK

CISA, in advisory ICSA-25-140-03, had already described a datetime-based password on the AK-SM 8xxA series. Tomer Goldschmidt of Claroty Team82 reported it. On versions before R4.2, an outsider could bypass authentication because the device would accept a password built from the date. CISA published that advisory on 20 May 2025 and added command-injection and denial-of-service bugs, fixed in 4.3.1, on 26 August 2025. CERT-FR has not said those CVEs were the path used in October, and Danfoss has not confirmed it either.

CISA’s own advice on that family was to keep control devices off the internet and to put remote access behind a VPN. Danfoss, for gear that still gets code, points customers to Danfoss security advisories for supported firmware. End-of-life AK-SM 800 and AK-SC 355 boxes cannot be patched into safety. The close for those is replace them, and until then keep them off a public address.

Rival banners learned they shared a supplier problem the hard way. Intermarché, Carrefour, Coopérative U and Leclerc do not share a network. They shared controller families whose management pages were easy to find. One weak remote-admin design, copied across an industry that outsources cold, is enough to hit competitors on the same night.

CERT-FR Still Treats the Campaign as Live

CERT-FR’s 12 October alert reported numerous compromises of remote fridge controllers. A 16 October revision, issued four days after the first night, still warned that attack campaigns were probably still running. Putting a management interface on the internet, the agency wrote, is against basic practice.

THE ALERT CALENDAR

1. 11 to 12 October 2026: Overnight defrost attack on French supermarket refrigeration.
2. 12 October 2026: CERT-FR publishes CERTFR-2026-ALE-012 on Danfoss AK-SM and AK-SC gear; Paris prosecutors open a case; the prime minister tasks ANSSI.
3. 13 October 2026: CERT-FR adds Copeland xweb and Dixell xweb after a second night of incidents.
4. 14 October 2026: Censys’s French count of exposed Danfoss StoreView panels falls to 537.
5. 16 October 2026: CERT-FR updates recovery steps and says campaigns are probably still under way.

Censys counted nearly 3,000 internet-exposed Danfoss StoreView panels on 11 October, more than 1,800 of them in France. By 14 October the French figure was 537. Patched and unpatched units dropped at roughly the same pace, which is what a mass unplug looks like, not a firmware campaign. Claroty had earlier counted more than 2,700 AK-SM 800A admin interfaces on the public internet, a separate scan of a current product line that was already a warning.

WHAT WE KNOW

• Named vendors: Danfoss, Copeland and Dixell controllers are in the CERT-FR alert.
• National scale: Lescure put the hit at about 700 of roughly 10,000 French supermarkets.
• Physical harm: Forced defrost toward 50C, dumped stock, and damage that prosecutors list as including fires.

WHAT IS UNCONFIRMED

• The bug: No CVE is named in CERTFR-2026-ALE-012, and vendors have not tied the night to the 2025 Claroty findings.
• The actor: No public claim of responsibility, and no confirmed ransom demand.
• The bill: Local euro figures exist; there is no official nationwide loss total.

CERT-FR’s recovery sheet is practical. Pull every exposed unit off a public address, including neighbours that were not yet hit. Restore remote access only through a VPN or a protected network. If a box is already owned, factory-reset is not enough on end-of-life firmware, because the next scan will take it again. And check the insurance wording before you cut the contractor’s telemetry, which is how you know the business process and the attack path were the same cable.

August’s Hospital Attack Never Touched the Clinical Record

Two months earlier, the same class of target showed up in a hospital. On 10 August 2026, Shared Health disclosed a ransomware incident against facility-maintenance systems at Winnipeg’s Health Sciences Centre and CancerCare Manitoba. Patient care kept running. The building did not. An official update said central HVAC monitoring at Winnipeg’s largest hospital was affected, with air still moving under local watch, while the security office could not issue or change ID badges because that workflow sat on a hit system. Extra officers walked the site. Cards already issued still worked.

Armis Labs, in a Q3 2026 study of building automation, used that hospital night as the example of physical leverage. Attackers do not need to encrypt a clinical record if they can freeze badges, cloud HVAC monitoring, and put climate in operating areas into the negotiation. Tim Beasley, a senior incident response consultant at Semperis, described a private-sector version of the same squeeze, without naming the customer.

There was one gig where the customer was refusing to pay, and so the threat actor was like, ‘Hold my beer, have fun getting into your offices,’ and locked everybody out.

Tim Beasley, senior incident response consultant, Semperis

Police smashed glass to get staff back inside. Asked if the customer paid, Beasley said, “Oh, hell, no!” The point for a grocer is the same as for a hospital: the pain is physical, local, and hard to shrug off until Monday’s delivery.

Michael Freeman, ServiceNow’s senior director of threat research, said building-management systems are also a place to hide. They are easier to compromise than a well-watched IT estate, and easier to live in. In one case against a large financial firm, he said, intruders kept getting kicked out of IT, so they planted backdoors in the BMS and pivoted back in. BAS and other operational kit often cannot be patched on a Tuesday because the plant is not allowed to stop.

ARMOS LABS FIGURES ON BUILDING AUTOMATION

• Ransomware overlap: Armis found that 73 percent of organizations run BAS already used in ransomware.
• Known holes: The same 73 percent have a known exploited vulnerability in at least one building automation system.
• Old protocols: 91 percent of BAS still talk over insecure protocols such as BACnet, KNX, Modbus and LonWorks, designs that assumed an air gap.
• Patch lag: About 28 percent of vulnerabilities are exploited the same day they land on CISA’s KEV list, and Armis tracks over 4,200 exploited CVEs that never reach that list.

Those numbers were in the report before anyone heated a French ice-cream aisle. The supermarket night did not invent physical-world extortion. It showed how little data you need on a box for the harm to be real.

Most Industrial Hits Still Start in the Office Network

Dragos, which tracks ransomware claims against industrial firms on leak sites and in public incidents, says the volume has been rising since 2022. Lexie Mooney, a senior threat analyst there, said the numbers have been consistently increasing. The firm counted 995 ransomware attacks against industrial organizations in 2023, a 49.5 percent rise from 2022, then a jump of more than 87 percent in 2024. Active groups targeting that sector went from 50 to 80 in 2024. In 2025 Dragos tracked 119 groups affecting more than 3,300 industrial organizations. In 2026 the quarterly counts were 1,020 incidents in the first quarter and 1,140 in the second.

Abdul Alamri, also a senior threat analyst at Dragos, said the vast majority of those cases are opportunistic. When physical plant or an OT process does get hurt, it is often because the group stumbled into it, not because it spent months learning a proprietary controller. Ransomware crews want outage and payment. They do not want to become experts in an obscure freezer rack. That is why so many industrial victims still feel the blow through IT, email, and business systems rather than a PLC.

Visibility is thin enough that many operators only notice a problem when the room feels wrong. Dragos estimates that fewer than 10 percent of OT networks worldwide have enough monitoring. In 30 percent of the incidents it handled in 2025, the investigation did not start with a detection alert. Someone on the floor said something seemed off. Alamri’s worry is that AI agents will probe those same quiet networks without getting tired, while defenders still find out from a warm aisle or a stuck door.

Freeman has already watched attackers use AI to read obscure operational software, including older Unix-type systems and VxWorks, so they no longer need a specialist sitting at their shoulder. Historically, even a skilled crew would leave a half-understood plant alone because changing the wrong setting could do something they could not predict. That caution shrinks if a model can tell them which number to move. He has seen people inside airline operational gear who then left, he said, because they did not know what they had. He still thinks about those cases.

Hayden’s forecast was that as firms get better at cleaning up the easy IT holes, internet-connected operational kit becomes the next place to look. The French fridges fit that forecast with almost no remainder. They held no customer database. They sat online so a contractor, and in some contracts an insurer or an inspector, could see they were cold. On 16 October CERT-FR was still telling operators to unplug them, and still warning that a factory reset on an end-of-life box is a round trip back to compromise.