Hackers sabotage refrigeration at hundreds of French supermarkets

Hackers sabotaged refrigeration systems at hundreds of French supermarkets overnight from October 11 to 12, spoiling fresh and frozen food in an attack covered in The Rundown on October 13.

In Gradignan, store owner Charles Dezon described a cold room that reached 50°C (122°F) and €21,000 in lost inventory, Le Monde reported. Attackers extended defrost cycles from one hour to eight, according to the newspaper.

Updates from October 13 and 14

Later on October 13, AP reported that France’s finance minister estimated about 700 supermarkets had been affected. ANSSI, France’s cybersecurity agency, identified compromises involving Danfoss and Copeland equipment.

Paris prosecutors opened a criminal investigation into food losses and reported fires. A link between the attacks and the fires remains unproven.

An AP follow-up on October 14 reported ANSSI’s warning from the previous evening that attacks were probably continuing. Intermarché estimated its losses at tens of millions of euros.

Why it matters

Refrigeration sabotage can destroy physical stock within hours without requiring access to a customer database. For store owners, protecting the controller is part of protecting the food on sale. The reported fires raise a safety question that investigators have yet to resolve.

The timing raises questions about how retailers and their suppliers acted on known equipment risks. Danfoss’s security advisories listed flaws in 2025, including a way to bypass login checks on certain AK-SM 8xxA versions. The exact vulnerability exploited in the supermarket attacks remains unclear.

On August 9, 2026, Claroty’s Team82 published research on weaknesses in AK-SM 800A controllers and documented devices exposed to the internet. It urged customers to install software version R4.3.1 or later and limit administrative access through trusted networks and VPNs. Those recommendations put both software maintenance and remote access in the scope of protecting refrigeration.

Some older equipment presents a different maintenance problem. Danfoss said in its October 2025 technical newsletter that the AK-SM 800 had reached the end of its product life in May 2021, and urged customers with legacy equipment to discuss replacement. Retailers may need both software updates for supported models and a replacement plan for older units. They must weigh the cost and disruption of replacing equipment against the risk of another stock loss.

The controls themselves also shape the risk. Claroty describes a console that manages temperature limits, operating schedules and notifications. Retailers should check who can change those settings, whether a separate alarm can detect abnormal temperatures, and who can respond overnight.

At one Paris store, an early alarm helped save most fresh produce, while frozen goods were lost, AP reported on October 14. That example shows how detection and response can limit the damage, even after an attacker gains control.

For retailers restoring service, the recovery plan should include a review of remote access and clear responsibility for firmware updates, equipment replacement and overnight alarms. These tasks connect the public warnings about controller flaws to the daily work of keeping food cold.