Supermarket refrigeration hack hit 700 French stores, with fridges reaching 50°C

What it is

On 12 October 2026, attackers reached internet-exposed refrigeration controllers (Danfoss AK-SM800 and AK-SC355, plus Dixell/Copeland units) and held them in defrost mode for several hours. The page says the geographic spread (France, Spain, Portugal, Poland, Germany, Belgium) comes from Sekoia analysis. Named affected retailers are Intermarché (about 150 units), Carrefour, Coopérative U and E Leclerc. Losses are estimated, not measured, at tens to hundreds of millions of euros.

How it works

• Some Danfoss firmware generates a daily password from the date, and that firmware is publicly available. Anyone who reads the code can reproduce the credential for an unpatched device.
• The same daily password worked across every deployed unit, so one derivation opened hundreds or thousands of stores.
• Claroty Team82 describes this as a hidden "code-of-the-day" mechanism that bypasses normal authentication.
• The Danfoss models speak Modbus, which has no built-in security.
• Separately, Copeland/Dixell controllers had critical remote-access flaws. Fixes shipped in the preceding months.

Preconditions / Affected

• The controller is reachable from the public internet, and the page says affected stores likely had no VPN or IP allowlist.
• The firmware is old. Danfoss says most affected units are legacy products that no longer get software or security updates. Copeland calls its vulnerable generation "discontinued, end-of-life".

What to do

• Pull controllers off the public internet first. Everything else depends on this.
• Put remote access behind a VPN and an IP allowlist.
• Change known or default credentials.
• Install current firmware where a supported release exists.
• Bring contractor and third-party access through controlled, documented arrangements, not a contractor's separate connection into the store.
• For end-of-life units, Danfoss advises moving to current-generation systems.

Caveats

• The sources conflict on patching. Claroty says Danfoss told it a firmware release fixed the issues, while Danfoss says most affected units get no updates. Check whether your exact model has a supported release. If it doesn't, network isolation is your only control until replacement.
• The page does not say how the attackers got in, who they are, or whether the daily-password flaw was the actual entry path. It says only that the controllers had known weaknesses.
• CISA issued a related warning in February, so the exposure was publicly flagged months before the attack.
• The page is an AI-assisted secondary report citing Ars Technica, Facilities Dive, AFP and Reuters.