Hackers Hijack Danfoss Controllers, Spoil Food at Hundreds of French Supermarkets

The access method wasn't subtle. Attackers walked straight through internet-facing industrial controllers, and the door was open because many of those controllers were running credentials as weak as 'admin' with the current date as the password.

On the night of October 11, unknown actors compromised refrigeration control systems at hundreds of French supermarkets, triggering built-in defrost cycles and holding temperatures there. According to BleepingComputer, which reviewed retailer statements, the attack targeted Danfoss refrigeration controllers running older firmware versions. The Hacker News reported that some units reached 50°C, a figure consistent with what retailers told broadcasters and prosecutors.

The scale was significant. Reporting by BleepingComputer put victims across at least five major chains: Intermarché, Coopérative U, Carrefour Market, Monoprix, and Leclerc. The Paris prosecutor's office described a "large-scale" attack on "connected refrigerators in several major food retailers across France," and said it produced food losses and fires. An Intermarché spokesperson told BleepingComputer the chain had notified stores and pulled products from affected units, but declined to specify how many locations were involved.

The attack vector wasn't a zero-day. It was internet exposure combined with legacy hardware. According to hard2bit.com, which reviewed the CERT-FR alert issued October 12, France's national cybersecurity agency ANSSI issued advisory CERTFR-2026-ALE-012 flagging numerous compromised remote refrigeration controllers. The alert covered Danfoss's AK-SM and AK-SC series and extended the following day to include xweb consoles from Copeland and Dixell. Nobody has claimed responsibility.

The inventory of exposed devices is the part that should concern OT security teams outside France. Baptiste Robert, CEO of Predicta Lab, found roughly 2,750 Danfoss systems exposed on the public internet the morning after the attack, with over 1,500 of them in France, according to BleepingComputer. SOCRadar's Shodan queries returned over 4,400 Danfoss web interface results worldwide as of October 13, per hard2bit.com's analysis. That's a large attack surface that didn't materially shrink overnight.

The Hacker News noted that Danfoss's security advisories page listed no advisory about the attack or about the affected controller models as of October 13. Danfoss had not released a public statement addressing whether the newer firmware package for the AK-SM 800A was issued in response to the incident.

A Claroty research team had published findings in August detailing a hidden authentication mechanism in Danfoss systems used to manage refrigeration in supermarkets and cold storage facilities, according to Quartz's reporting. Whether that research contributed to the attack vector is unconfirmed. Confidence: low.

The broader OT picture is consistent with what Palo Alto Networks found in its 2026 State of Critical Infrastructure Cybersecurity report, reviewed by Industrial Cyber: 68 percent of critical infrastructure organizations lack complete real-time visibility into assets on their OT networks, and 29 percent of CVEs in 2026 were exploited within 24 hours of disclosure, against an industry average patch lag of 55 days.

The food supply angle matters here. This isn't a data breach or a ransomware negotiation. The physical consequence - spoiled meat, frozen goods, vegetables, fires at several locations - landed directly on the food chain, not on a server room. The Palo Alto survey found half of organizations reporting significant breaches also reported physical safety concerns as a result. This incident is a field case for that figure.

No attacker has been identified. The French prosecutor's office is investigating. Danfoss has not publicly outlined a remediation path for legacy AK-SC controllers, which the company phased out in 2016 and for which no further software updates are available, per The Hacker News. Those devices remain in active use across European retail infrastructure.

Sources cited:
- BleepingComputer (https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/)
- The Hacker News (https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html)
- hard2bit.com (CERT-FR alert analysis) (https://hard2bit.com/en/blog/french-supermarket-cyberattack-refrigeration-danfoss/)
- Quartz (https://qz.com/french-supermarket-cyberattack-refrigeration-danfoss-101226)
- Industrial Cyber (Palo Alto 2026 OT report) (https://industrialcyber.co/reports/palo-alto-reports-legacy-ot-systems-fragmented-security-tools-undermine-critical-infrastructure-cyber-resilience/)
- Al Jazeera (Paris prosecutor statement) (https://www.aljazeera.com/news/2026/10/13/unprecedented-cyberattack-hits-french-supermarkets-causing-food-losses)