Exposed refrigeration controllers in France triggered supermarket chaos

On the night of October 11 to 12, 2026, cyber attackers forced refrigeration systems in hundreds of French supermarkets into defrost mode, causing temperatures to spike as high as 50°C. The incident, which affected major chains including Carrefour and Intermarché, resulted in equipment fires and the disposal of vast amounts of perishable goods. Investigations point to vulnerable, internet-connected controllers made by Danish industrial company Danfoss as the entry point for the disruption.

What happened

The attack targeted the web-based dashboards used by technicians to monitor and manage store refrigeration. These interfaces, known as StoreView, were accessible directly from the public internet without adequate protection. Attackers pushed the systems into defrost cycles, which heat the cooling components to melt ice buildup. In many cases, this led to dangerous overheating, with some units catching fire and others spoiling their contents. The Paris prosecutor’s office has opened an investigation, though no specific group has been identified as responsible.

Major retail groups confirmed the scale of the damage. Carrefour reported impacts at 80 stores, while Les Mousquetaires, which owns Intermarché and Netto, saw more than 300 locations affected. Monoprix stated that about 5% of its stores were hit, and Coopérative U confirmed attacks on 80 of its 2,000 locations. Danfoss identified the compromised hardware as legacy models, specifically the AK-SM 800 and AK-SC 355 controllers, which the company declared end-of-life in 2023.

Key details

• France had 1,331 exposed Danfoss dashboards online before the attack, more than the rest of the world combined.
• 85% of these French systems ran software with known security flaws, including 527 unsupported legacy controllers.
• Most vulnerable devices had been exposed to the internet for at least six months prior to the incident.
• Only 195 of the 1,331 French dashboards had every known security fix applied.
• Following the attack, 76% of the previously exposed French dashboards went offline within two days.
• CERT-FR also warned about vulnerabilities in XWEB supervisors from Copeland and Dixell, with 70 such devices found online in France.

Background

Industrial Internet of Things (IIoT) devices often bridge the gap between physical machinery and digital management. In this case, Danfoss controllers allow remote monitoring of temperature and system health. However, when these devices are connected directly to the public internet rather than a secured internal network or virtual private network (VPN), they become visible to anyone scanning IP addresses. Many of these units run on older firmware that lacks modern security protections, making them susceptible to known exploits such as login bypasses.

The term "legacy" in this context refers to hardware that the manufacturer no longer actively supports with security updates. For the AK-SM 800, Danfoss ended support in 2023, yet hundreds remained online and accessible. Without regular patching or network isolation, these devices retain default configurations or unpatched vulnerabilities that attackers can exploit to gain control over critical infrastructure.

Why it matters

For teams managing self-hosted software or edge devices, this incident highlights the severe risks of exposing administrative interfaces to the public internet. It is not enough to assume that obscure or specialized hardware will remain unnoticed. Automated scanners constantly probe the entire IPv4 space, identifying any device that responds on standard ports. If your infrastructure includes similar IoT controllers, building management systems, or other edge hardware, leaving them publicly accessible is equivalent to leaving the back door unlocked.

The slow rate of patching observed in the data is another critical lesson. Between March and October 2026, the percentage of fully updated controllers in France rose only from 14% to 24%. This suggests that many organizations lack automated processes for updating embedded firmware. In a self-hosted environment, neglecting these updates leaves systems vulnerable to exploits that have been public knowledge for years, turning manageable maintenance tasks into potential catastrophic failures.

What you can do

• Audit your network for any IoT or edge devices that have public IP addresses and restrict access immediately.
• Move administrative interfaces behind a VPN or use strict firewall rules to allow access only from specific trusted IP addresses.
• Identify any legacy hardware that no longer receives security updates and create a plan to replace or isolate it.
• Implement automated monitoring for firmware versions and set up alerts for when updates are available.
• Change all default passwords and enable strict security levels on any remaining exposed controllers.
• Review insurance policies and contractor agreements to ensure remote access methods comply with security best practices.