Hackers Defrosted the Freezers in Hundreds of French Supermarkets. The Controllers Were Two Months Into a Public Warning.

01 What happened over the weekend

Store managers found the problem on Sunday night and Monday morning. A supermarket refrigeration system runs a defrost cycle every few hours to clear ice from the evaporators. The attackers triggered that cycle remotely and kept the cabinets warm. BFM TV reported that the hackers “managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores.” Intermarché told AFP its affected branches would have to “throw away all of the products” that are fresh and frozen.

The count varies by outlet. Semafor put it at at least 400 stores [ Semafor 2026 ] , which matches the retailers’ own figures added together. Intermarché’s chief executive, Thierry Cotillard, told BFM TV the losses could reach “tens of millions of euros nationwide in a single day.” Coopérative U’s chief executive, Dominique Schelcher, called the attack “unprecedented”.

The Paris prosecutor’s office opened an investigation into “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France”, aiming to “identify the victims and establish the link with the damage they reported in terms of foodstuff losses and the outbreak of fires” [ RTÉ 2026 ] . Prime Minister Sébastien Lecornu asked the national cybersecurity agency, ANSSI, to investigate. The agency is working with European counterparts because other countries may be affected. No group has claimed the attack.

02 What the attackers reached

A person close to the Prime Minister said ANSSI had already found “a vulnerability in software supplied by a Danish company and has contacted the vendor.” Danfoss then told AFP that most of the affected equipment was legacy product, named its AK-SM800 and AK-SC355 regulators, and said a version of the AK-SM800 was running “outdated firmware.” It said it had long advised customers to update and replace older equipment. It gave no count of affected systems.

These units are system managers. One box in the back office runs every cabinet, cold room and compressor in the store: setpoints, alarms, defrost schedules. Refrigeration firms manage them remotely through a built-in web interface, which saves a technician a drive to the store at 2am. Every remote connection a contractor uses is also a way in for anyone who finds it.

03 The warning came in August

On 9 August 2026 Claroty’s Team82 published research on the Danfoss AK-SM 800A, titled “Freeze the Controller, Defrost the Food” [ Claroty 2026 ] . It described three flaws, all fixed in firmware R4.3.1.

Claroty’s researchers found 2,765 of these controllers answering on the internet in a Censys scan. Their advice was short: upgrade to R4.3.1, keep the management interface off the internet, and reach it only through a VPN or a restricted management network.

Nobody has confirmed that the weekend’s attackers used any of these flaws. Danfoss points to legacy units, and the AK-SC355 was not part of the August research. Still, the August paper and the October attack describe the same situation. Store controllers sat on the internet with a web login in front of them. The firmware on many of them was out of date, and on some models no fix will ever come.

04 Every multi-site business has these boxes

Supermarkets took the hit because a warm freezer destroys stock within hours and the result is visible on every shelf. The pattern underneath is common. Hotels, hospitals, pharmacies, cold-chain logistics, restaurant chains, data centres and office landlords all run controllers that a contractor installed, a contractor maintains remotely, and the IT team has never seen.

Those controllers rarely appear in an asset register, because facilities bought them and the contractor manages them. They miss patch cycles, because nobody owns them. Their remote access usually runs through whatever the contractor set up years ago: a port forward on the store router, a 4G modem in the cabinet, a shared login for every site. A security team can harden its laptops and email to a high standard while a box in the back office takes logins from anywhere.

Danfoss’s own statement points at the hardest part. Legacy equipment that “no longer receive[s] software or security updates” cannot be fixed with a patch. It has to come off the internet, sit behind access you control, or be replaced. Each of those costs money, so most businesses put it off.

05 Six checks for your connected equipment

Start with refrigeration if you run it, then work through every other category of connected plant. A facilities manager and one engineer can answer the first three from records and a short call with each contractor.

• What do you have? List every controller across every site, with make, model, firmware and the contractor who maintains it.
• Which ones answer on the internet? Check your public addresses from outside. A login page that loads from home loads for an attacker too.
• How do your contractors connect? Each connection should be named, logged, limited to that contractor and switched off when not in use. Shared logins across sites fail this test.
• Is the firmware still supported? For Danfoss AK-SM 800A, that means R4.3.1 or later. For models the vendor has retired, plan isolation or replacement.
• What can someone change from each interface? Setpoints, defrost, alarms and schedules. If an attacker can also silence the alarms, nobody finds out until morning.
• Who would notice at 3am? Temperature alarms should reach a person outside the controller itself, through a route an attacker on the controller cannot switch off.

French retailers learned where their controllers were from the temperature in their freezers. You can find out from a test instead. Give us your public address ranges and a list of your sites, and within 14 days you will know which controllers answer from the internet, what each one lets an attacker change, and the order to close them in. Enterprise-grade. Not enterprise-priced. Start with your Threat Map.