On Monday 12 October 2026, several French grocery groups said a cyberattack had hit refrigeration systems in their stores overnight. The same day, CERT-FR, the French national CSIRT, published alert CERTFR-2026-ALE-012 about compromises of remote refrigeration controllers.
What is confirmed
From the CERT-FR alert, first published 12 October 2026 and updated on 13 and 16 October:
- CERT-FR says it is aware of many compromises of remote refrigeration controllers.
- Products listed: Copeland xweb, Dixell xweb, Danfoss AK-SC series and Danfoss AK-SM series.
- It says exposing a management interface to the internet goes against good practice, and that attacks are probably still ongoing.
- It recommends removing internet exposure, reviewing the full configuration including defrost schedules, restoring access only through a secure VPN or protected network, and applying vendor hardening. For Danfoss that includes the Strict security level and changing default passwords.
- A reset alone is not enough, because the equipment stays vulnerable and is likely to be compromised again.
What is reported
These points come from news reports, not from CERT-FR.
- Al Jazeera, citing AFP, reported that attackers raised freezer and fridge temperatures as high as 50 degrees Celsius overnight, that more than 500 shops were affected, and that some incidents involved fires or melted equipment. Counts differ by outlet. BleepingComputer reported 250 to 350 stores citing French media.
- Retailers named in reports include Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc.
- BleepingComputer reported that Coopérative U's president said on X that a cyberattack had affected refrigeration systems in several stores, and that the Paris prosecutor's office opened an investigation.
- The Hacker News reported that Danfoss said most affected units were older models it no longer updates, the AK-SM 800 (end of life since 2021) and the AK-SC 355 (phased out in 2016), plus some AK-SM 800A units on outdated firmware.
- BleepingComputer cited a researcher who counted 2,752 Danfoss systems exposed online, 1,590 in France.
- Background: Danfoss issued advisories in 2025 for CVE-2025-41450 (authentication bypass) and CVE-2025-41451 (command injection) in the AK-SM 8xxA series. Reports say fixed versions exist. No source ties them to this attack.
What is not known
How the attackers got in, who is responsible, whether any of the 2025 flaws was used, the exact number of stores, and the total financial loss. No claim of responsibility was reported in the sources we read.
What to do now
- List every building controller, refrigeration supervisor and similar device that has a public IP or a port forward.
- Take management interfaces off the internet. Use a VPN or a bastion, and treat source IP filtering as temporary, as CERT-FR says.
- Check the defrost and setpoint schedules for changes you did not make.
- Change default and shared passwords, and apply vendor firmware where it exists.
- For end of life models, plan replacement or isolation, because no patches will come.
- Agree with maintenance contractors how remote access works and who owns it.
How this could have been avoided
- The core exposure, by CERT-FR's account, is management interfaces reachable from the internet. Not publishing them removes the attack path whatever the exact flaw.
- Several affected models are out of support, so an asset inventory with end of life dates would have flagged them for isolation or replacement.
- Default or shared credentials and remote contractor access are named in the guidance. Unique credentials and access through a VPN limit what one leaked login can do.
- Alerting on setpoint or defrost schedule changes would have given an earlier signal than spoiled food.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the cause of the attack known?
No. CERT-FR calls it a compromise of internet-exposed controllers, but no source we read confirms the initial access method or ties it to a specific vulnerability.
Why is a factory reset not enough?
Per CERT-FR, the equipment stays vulnerable, so it is likely to be compromised again unless exposure is removed.
