On the night of 11 to 12 October 2026, attackers took remote control of refrigeration controllers in hundreds of French supermarkets and switched fridges and freezers into defrost mode. Some units reached 50°C. There was no malware, no ransom note and no stolen data. The attackers used the controllers' own maintenance functions.
Most of the affected devices were end-of-life Danfoss AK-SM 800 and AK-SC 355 units, which no longer get security updates. Some current AK-SM 800A units running old firmware were hit too, and Copeland/Dixell xweb systems were added to the official alert a day later.
Nobody has officially confirmed how the attackers got in. The evidence points to controllers left reachable from the internet, combined with a date-based login bypass that has been public since 2023.
What happened
On Monday morning, staff at Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc found warm display cases and cold rooms. In each store, all refrigeration is run from one supervisory controller. These are usually installed and maintained remotely by a refrigeration contractor, not by the retailer's IT team. During the night, the controllers had been put into continuous defrost.
CERT-FR, France's national incident response team, published alert CERTFR-2026-ALE-012 on 12 October. It reported
numerous compromises of Danfoss AK-SM and AK-SC controllers. On 13 October the alert was extended to Copeland xweb
and Dixell xweb, after an E.Leclerc near Albi that uses Dixell equipment lost control of its refrigeration at about 4am.
The cybercrime section of the Paris prosecutor's office has opened an inquiry into the food losses and into equipment that started to catch fire.
"The weaponisation of food has become a reality."
Christophe Hansen, EU Commissioner for Agriculture and Food, via Cooling Post
Which systems were hit
| Product | Status | Known weakness |
|---|---|---|
| Danfoss AK-SM 800 | End of life since 2021, no updates | Date-based "code of the day" login bypass, public since 2023 and never fixed |
| Danfoss AK-SC 355 | Phased out in 2016, no updates | Covered by the same 2023 advisory |
| Danfoss AK-SM 800A | Current model; affected units ran outdated firmware | CVE-2025-41450 auth bypass (fixed in 4.2), CVE-2025-41451 RCE (fixed in 4.3.1) |
| Copeland / Dixell xweb | Added to the CERT-FR alert on 13 October | Daily-changing "ONEDAY" admin account; 23 XWEB Pro flaws including unauthenticated RCE (CVE-2026-24663) |
How it most likely happened
CERT-FR and the vendors haven't named a vulnerability, and no indicators of compromise have been released. Still, the public evidence fits a simple sequence that needs neither a zero-day nor malware. Three security specialists told Reuters the attack looked easy to carry out, which matches this picture.
Probable attack chain
Based on public evidence; not officially confirmed
- Find exposed controllers The web management consoles were reachable from the internet so contractors could work on them remotely. Search engines like Shodan and Censys index them. StoreView / XWEB web UI
- Log in without the password Older Danfoss firmware accepts a vendor "code of the day" calculated only from the device's date. BFMTV reported that the targeted software was older than version 4. auth bypass, public since 2023
- Change the settings With an administrator session, the attacker can change defrost schedules and setpoints through the normal interface. No exploit is required for this step. forced continuous defrost
- Repeat across sites The same steps were carried out at hundreds of stores during the night, before staff arrived. night of 11–12 Oct
Why it worked
- Management interfaces for operational equipment were directly reachable from the internet.
- Hardware stayed in service for years after the vendor stopped supporting it.
- Products from two different vendors had undocumented, date-based support logins.
- Contractors supplied the systems, so it was often unclear who in the store was responsible for patching them.
Mitigation
Take every AK-SM, AK-SC and xweb unit off the internet. Before cutting the data link to your refrigeration contractor, check what your insurance contract requires.
Review the whole configuration, paying particular attention to defrost schedules and ranges.
Bring remote access back only through a secure VPN. Limiting access to contractors' IP addresses is fine as a temporary measure but shouldn't be treated as a permanent fix.
If a device may be compromised
CERT-FR recommends this order: remove internet exposure, reset to factory settings, restore access through a VPN only, reconfigure the device completely, and apply the vendor's hardening. For end-of-life units, a reset on its own is not enough. It removes anything the attacker left behind, but the device remains just as vulnerable, and CERT-FR believes attacks are probably still going on.
| Product | Action |
|---|---|
| AK-SM 800 / AK-SC 355 | No patches available. Keep them off the internet and plan to replace them soon. |
| AK-SM 800A | Update to 4.3.1 or later, preferably the latest 5.3.x. Units on 3.x need to move to 4.x first, and 5.3.x can't be rolled back. Set the security level to Strict and change any default passwords. |
| Copeland XWEB Pro | Install the latest firmware. |
| Dixell / Copeland xweb | Follow the Dixell France advisories, and keep supervisors disconnected from the network until official guidance is available. |
Longer-term hardening
- Keep an inventory of every refrigeration and building-management controller, including ones installed by contractors, with model and firmware version.
- Scan your own public IP ranges for StoreView and XWEB login pages, since attackers are already doing this.
- Send all contractor access through a single managed gateway with MFA, named accounts and logging.
- Set up alerts for changes to defrost schedules, setpoints, user accounts and mail settings.
- Use a separate temperature alarm system that doesn't depend on the supervisory controller.
- Make contracts state who patches the equipment, who monitors it, and what happens when it reaches end of life.
Where things stand
| Was it sophisticated? | Probably not. Known weaknesses on exposed, unpatched devices seem to be enough to explain it. |
| Is the entry method confirmed? | No. No CVE has been named and no IOCs have been published as of 14 October. |
| Who is behind it? | Unknown. There has been no claim and no ransom demand. |
| Is it limited to France? | There are unconfirmed reports of impact in five other European countries, and more than 800 vulnerable controllers have been found in the UK. |
| Should retailers elsewhere act? | Yes. The same equipment is used around the world, so it's worth checking exposure now. |
The investigation is still in its early stages, and the entry method, the attackers and the full number of affected stores may become clearer in the coming weeks. For now, anyone running these controllers should assume that an internet-facing unit on unsupported firmware is at risk and take it offline.
Sources
- CERT-FR, Alert CERTFR-2026-ALE-012, 12–13 October 2026.
- AFP via La Libre, original dispatch, 12 October 2026.
- Cooling Post, Danfoss moves to mitigate cyberattack.
- Synacktiv, Authentication bypass in Danfoss SM800 & SC255, 2023.
- Claroty Team82, Freeze the Controller, Defrost the Food, August 2026.
- Cybernews, Copeland named as second fridge supplier hit.
- BleepingComputer, Cyberattack shuts down refrigerators at French supermarkets.
Last updated 14 October 2026. The investigation is ongoing and details may change.
