On the night of October 11–12, 2026, cyber attackers remotely triggered refrigeration systems in hundreds of French supermarkets into defrost mode, causing units to reach 50°C (122°F) and forcing stores to discard perishable food. According to Futura-Sciences, more than 400 stores were affected across multiple chains: Carrefour reported 80 stores hit, Intermarché and Netto (both part of Les Mousquetaires) reported over 300 combined, Monoprix reported about 5% of its stores, and Coopérative U reported 80 of its 2,000 locations. Losses could reach several million euros, and the Paris prosecutor’s office opened an investigation.
The attack targeted refrigeration controllers made by Danfoss, a Danish industrial company. Danfoss identified the compromised equipment as “legacy” models—the AK-SM 800 and AK-SC 355 controllers. CERT-FR, France’s cybersecurity agency, also identified XWEB supervisors from Copeland and its Italian brand Dixell as targeted systems. No actor has claimed responsibility, and the method of intrusion remains unknown.
Internet scans conducted by IPinfo on October 6–7, five days before the attack, found 2,528 Danfoss StoreView dashboards—control panels accessible to anyone with the web address—exposed online globally. Of these, 1,331 (53%) were in France, far exceeding any other country. Poland had the next highest count with 179, followed by the United States (101), Portugal (92), and Belgium (85).
Critically, 85% of French dashboards (1,136 of 1,331) ran software with known security flaws. This included 527 controllers Danfoss no longer supports, 280 missing 2023 security fixes (including one rated critical), and 329 missing 2025 fixes. Only 195 had all known patches applied. The vulnerability persisted for months—scans from late March through October 2026 consistently found between 2,464 and 2,622 dashboards exposed globally, with roughly half in France. Among French systems identified on October 6, 1,019 remained at the same address when checked on March 30, six months earlier, indicating minimal remediation.
Danfoss declared the older AK-SM 800 controllers end of life in 2023. The security firm Synacktiv published a login bypass for them that year, prompting Danfoss to advise restricting network access. Updates progressed slowly: the share of French controllers with every known fix increased from 14% in late March to only 24% by October.
After the attack, most stores disconnected their systems. Between October 6–7 and October 14, French dashboards online at the same address dropped 76%, from 1,331 to 316. Outside France, only 25% disappeared, suggesting French operators responded more decisively. Danfoss dashboards with known flaws remained exposed in 69 other countries, with Poland (157), the United States (85), and Portugal (77) most affected. Some reports suggest Spain, Belgium, Germany, Poland, and Portugal may have been targeted as well, though this remains unconfirmed.
Key facts
- More than 400 French supermarket stores were affected when attackers remotely triggered defrost mode in refrigeration systems on October 11–12, 2026
- Internet scans found 1,331 exposed Danfoss control dashboards in France five days before the attack, 85% running software with known security flaws
- Danfoss declared the compromised AK-SM 800 controllers end of life in 2023; a login bypass for these systems was published in 2023
- Only 195 of 1,331 French dashboards had all known security patches applied; 527 ran controllers Danfoss no longer supports
- After the attack, 76% of previously exposed French dashboards went offline within three days