01What happened
Chains including Intermarché and Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc were affected; reports put the total at around 700 stores. The attackers ordered the units to defrost and stay warm. Because defrosting is a normal overnight process, the change did not trigger alarms and few staff were present to notice.
France's CERT-FR reported numerous compromises of remote controllers for refrigeration installations, naming Danfoss AK-SM and AK-SC series and Copeland and Dixell xweb devices. Researchers also reported related activity in other European countries. Who was behind the attack had not been established at the time of writing.
02Why it worked
The controllers ran management web interfaces that were reachable directly from the public internet. According to public reporting, many used weak, predictable credentials. Danfoss said affected units were older models whose security could not be updated, and that it had long advised customers to keep supported systems current.
CERT-FR put it simply: exposing a management interface on the internet is contrary to good practice. Equipment installed by a facilities contractor is still part of your network, even if IT never sees it.
03What CERT-FR recommends
Remove internet exposure from affected units and anything else on a public IP address. Check the full configuration, especially defrost schedules. Restore remote access only through a secure VPN or protected network; filtering contractor IP addresses on a firewall is an emergency measure, not a permanent solution.
Apply the manufacturer's guidance: update firmware, enable the strictest security mode and replace default or weak passwords. Check your insurance terms before cutting the data feed to your refrigeration provider.
04The lesson for every business
Building management, cameras, HVAC, access control and production machines are often installed and managed by outside vendors. Ask them: what is reachable from the internet, how is remote access secured, who holds the passwords, and how will you know if a setting changes?
Physical processes need alarms on unusual changes, not only on failures. This incident is widely described as the first cyberattack with a direct effect on a national food supply chain—it is unlikely to be the last.
Sources & further reading
CERT-FR — CERTFR-2026-ALE-012 alert on refrigeration remote controllers
BBC — Fridges in French supermarkets hit by cyber attack
CNN — What to know about the attack on supermarket refrigeration in France