OT / ICS Security

Attack on refrigeration systems in hundreds of French supermarkets: internet-exposed controllers targeted

On the night of October 11-12, 2026, attackers remotely took control of refrigeration controllers in hundreds of French stores, raising the temperature in refrigerators and freezers. The French CERT-FR called for immediate disconnection of the controllers from the internet.

  • SourceCERT-FR (ANSSI)
  • Source PublicationOctober 12, 2026
  • TypeThreats and Incidents

What happened

On October 12, CERT-FR (ANSSI) issued alert CERTFR-2026-ALE-012 regarding “numerous compromises” of remote refrigeration system controllers – Danfoss AK-SC and AK-SM series, and after an update on October 13, also Copeland and Dixell xweb. According to retail chains, devices were switched to defrost mode and heated – Les Mousquetaires reported temperatures up to 50°C – forcing food disposal. The Paris prosecutor’s office launched an investigation.

Key findings

  • Affected networks according to reports: Intermarché and Netto (at least 300 stores according to AFP, approx. 150 according to Reuters), Coopérative U (80), Carrefour (80), Monoprix (approx. 30), and individual E.Leclerc stores.
  • According to Danfoss, most compromised devices were older, unsupported models: AK-SM 800 (end-of-life since May 2021) and AK-SC 355 (discontinued in 2016). Some newer AK-SM 800A had outdated software.
  • As of October 13, no entry point or specific vulnerability had been identified, and CERT-FR had not published indicators of compromise. The alert reiterates that exposing a management interface to the internet contradicts best practices.
  • CERT-FR Recommendations: remove internet exposure, review configuration (including defrost schedules), restore access only via VPN, update software, set Strict security mode, and change default passwords. A factory reset alone is insufficient.
  • No one has been attributed to the attack. A Sekoia analyst told Reuters about similar cases in Spain, Portugal, Poland, Germany, and Belgium – without further details.

Why it matters

SafeWave Commentary

This is a case at the intersection of IT and OT, which clearly shows where the risk lies today: not just in the production network of a power plant, but in thousands of small building and refrigeration controllers, managed remotely by service companies – often from the internet and on retired equipment. The result was not a data leak, but physical loss: spoiled food, and according to reports, also equipment damage.

The conclusions are the same as after the attack on Polish renewable energy farms in December 2025: inventory of OT and IoT devices exposed to the internet, remote service access exclusively via a controlled channel with MFA, changing default passwords, and a plan for replacing unsupported equipment. If such controllers operate in your facilities, CERT-FR’s recommendations should be treated as a checklist.