Hacked French Supermarket Chillers Pushed into Defrost to Spoil Food

Overnight between October 11 and 12, 2026, refrigeration units in hundreds of French supermarkets abruptly shifted into defrost mode. According to the Paris prosecutor, internal temperatures in some units climbed to 50°C, with isolated equipment catching fire and forcing store operators to trash entire stocks of fresh and frozen goods.

The incident struck hardware from Danish industrial supplier Danfoss, alongside other commercial management gear. French cyber defense agency CERT-FR confirmed breaches involving older Danfoss controllers, specifically the AK-SM 800 and AK-SC 355 lines, and later widened its advisory to include XWEB systems used to monitor retail cold chains.

The underlying weakness was neither subtle nor sudden. Network intelligence firm IPinfo reported that 85% of affected systems had known security vulnerabilities prior to the incident. That tally included 527 legacy controllers that Danfoss no longer supports, while only 195 units ran all available patches. Exposure had lingered for at least six months: 1,019 French control interfaces sat open at identical network addresses back in March, with fully patched devices climbing only from 14% to 24% over that span.

Other countries exhibited a similar 84% vulnerability rate in their installed base; France was simply hit harder because far more of its unshielded units were wired directly to the public web. Following the incident, active online instances dropped sharply, from 1,331 down to 316 by October 14.

Retail losses are substantial. Publication Futura-Sciences reported over 400 impacted supermarkets, with damage estimates reaching millions of euros. Carrefour reported 80 stores hit, while Les Mousquetaires saw more than 300 locations disrupted across its Intermarché and Netto chains. Coopérative U CEO Dominique Schelcher noted 80 of its 2,000 stores were affected, clarifying that the retail cooperative relies on refrigeration maintenance contractors who install and maintain the systems.

CERT-FR warned that intrusions may still be ongoing, urging operators to pull legacy controllers off the public internet entirely, isolate vendor access behind VPNs, enforce strict security modes, and replace default credentials. The agency emphasized that simple factory resets or restricting contractor IP ranges will not protect unpatched hardware once exposed again.

Source: habr

Primary source: IPinfo