An October cyber-attack on French supermarket refrigeration systems altered temperature controls and led stores to discard food, according to the reviewed reports. CERT-FR lists compromised remote controllers across four product families and warns that attack campaigns may still be active. The reviewed sources leave the intrusion route and responsible group unidentified.[1][3][5]
Problem Publicly reachable refrigeration management systems can expose a physical food process to remote control.[1][3]
Baseline Euronews cited a Reuters scan of at least 4,500 visible Danfoss interfaces. That exposure count is separate from affected-store estimates.[3]
Solution CERT-FR advises removing public exposure, checking the full configuration and using protected access. Its Danfoss example adds current firmware, Strict security mode and changed default passwords.[1]
Measured result A PBS report carrying Associated Press copy gave an estimate attributed to the French government of about 700 affected supermarkets. Claroty separately counted 2,765 exposed AK-SM 800A devices in an August Censys scan.[2][4]
What happened
A PBS report carrying Associated Press copy said French Finance Minister Roland Lescure told Parliament about 700 of the country’s 10,000 supermarkets were affected.[2]
The Guardian reported that attackers remotely overrode temperature settings on thousands of freezers, fridges and chiller cabinets, with some systems rising above 50°C. Staff removed spoiled food after the incident.[5]
Euronews separately reported at least 350 affected supermarkets and cited a Reuters scan that found at least 4,500 Danfoss interfaces visible online.[3] The at-least-350 report and the roughly-700 figures in the PBS/Associated Press and Guardian reports come from separate reports with different dates and counting bases; the sources do not reconcile them.[2][3][5] These figures measure different things and should not be added or treated as one audited total.
Danfoss said many affected units had reached end of life or were running outdated firmware. Its reporting advises updating supported systems and replacing obsolete unsupported equipment.[2][3][5]
The security gap
Claroty’s 9 August 2026 research, rechecked on 17 October, examined the Danfoss AK-SM 800A platform. Its Censys scan counted 2,765 exposed devices, and its testing documented a hidden authentication mechanism, command injection leading to remote code execution and a web-server configuration flaw. Danfoss addressed the findings in firmware R4.3.1.[4]
Those findings do not show that the same flaws were used in France. The two technical pages reviewed here do not tie the named Claroty findings to this attack.[1][4]
The response sequence
CERT-FR’s guidance starts with isolation: remove affected units, and any other units on public IP addresses, from the internet. Operators should check the full configuration, including defrost schedules, then restore access only through a secure VPN or protected network.[1]
For Danfoss equipment, the alert also recommends current firmware, Strict security mode and changed default passwords. Compromised devices may need a restart or factory reset. CERT-FR warns that a reset alone leaves an end-of-life device vulnerable to another compromise.[1]
As an editorial operational test, operators could identify every refrigeration controller with a public IP, record who can reach it and mark whether the model still receives security updates. CERT-FR separately sets out isolation, configuration checks and protected restoration for compromised devices.[1]
Sources
[2] PBS News: Cyberattacks disrupt refrigeration systems at European supermarkets
[3] Euronews: Thousands of supermarket fridges still exposed after cyberattack
[4] Claroty Team82: Freeze the Controller, Defrost the Food
[5] The Guardian: Not cool: who hacked France’s supermarket fridges?
