During the night of October 11 to 12, 2026, attackers remotely took control of systems used to manage refrigeration installations in hundreds of French supermarkets.
These controllers normally allow store operators or maintenance companies to remotely monitor and adjust the operation of a store's refrigerators and freezers. This remote administration capability is precisely what was exploited during the attack.
In affected stores, the attackers altered the temperature settings of the refrigeration systems. Some equipment was reportedly pushed to around 50°C for several hours, instead of maintaining the temperatures required for food preservation.
A Cyberattack With Physical Consequences
The incident therefore went beyond making software unavailable or disrupting a digital service. By manipulating the controllers, the attackers directly altered the operation of physical equipment inside the stores.
In the first days following the attack, Intermarché reported that around 150 of its stores had been affected. Carrefour reported 80 affected stores, while Monoprix said that around 5% of its locations had been impacted. Coopérative U also confirmed that it had been targeted. The consolidated figures now available put the number of French supermarkets affected by the cyberattack at more than 700. This figure refers to stores affected by the incident and does not necessarily mean that every location experienced a break in the cold chain or the destruction of food products.
The consequences were immediate: breaks in the cold chain, the destruction of fresh and frozen products and, in some locations, fires. Intermarché notably said that it had disposed of all affected food products to eliminate any potential health risk.
However, the precise method used to compromise all of these systems has not been made public. Several devices were running older software or outdated firmware versions, while some management interfaces remained directly accessible from the Internet.
Which Equipment Is Affected?
The attack is no longer limited to the Danfoss controllers identified in the initial reports. CERT-FR now lists several families of equipment among the compromised systems observed in France.
These notably include Danfoss controllers from the AK-SM and AK-SC series, as well as Copeland XWEB and Dixell XWEB systems. This equipment is used to remotely monitor and control refrigeration installations.
On the Danfoss side, a significant proportion of the affected devices belong to older generations. The manufacturer notably stated that the AK-SM 800 and AK-SC 355 models, which have now reached end of life, were among the affected systems. More recent AK-SM 800A controllers running outdated firmware versions were also affected.
Vulnerable, Exposed or Compromised: Three Different Situations
The presence of a model in a security alert does not mean that every device in that product range has been compromised. A device may have a vulnerability without being directly accessible from the Internet, or it may be exposed without any compromise having been detected.
Conversely, when a management interface is directly accessible through a public IP address, the risk increases significantly. CERT-FR notes that exposing an administration interface to the Internet goes against security best practices and recommends removing such direct access.
For equipment that has reached end of life and no longer receives security patches, the risk is even greater. CERT-FR warns that simply restoring factory settings is not enough: if the equipment remains exposed and vulnerable, it can be compromised again.
What Impact Has Actually Been Observed?
The most visible consequences of the attack concern products stored in the affected refrigeration systems. When temperatures were remotely altered, the affected stores had to remove and destroy fresh or frozen products for which the cold chain could no longer be guaranteed.
The losses can quickly become significant. Thierry Cotillard, president of Groupement Les Mousquetaires, cited an average cost of around €50,000 for a medium-sized Intermarché store and estimated that the economic impact could reach several tens of millions of euros across the attack as a whole.
The incident also caused disruption inside stores, including emptied shelves, temporarily unavailable equipment and operations required to inspect, reset and secure the affected systems. Fires were also reported at several locations.
Losses Are Not Necessarily Covered by Cyber Insurance
The nature of the attack also raises a less visible issue: a cyber incident can cause physical damage without that damage automatically being covered by cyber insurance.
Cyber insurance policies may cover certain costs related to an incident, such as forensic investigations, crisis management or certain response expenses. However, physical losses caused by the attack, including the destruction of goods, are generally excluded from standard cyber insurance coverage.
Intermarché said that this type of incident was not covered by its insurance. Coopérative U also stated that losses related to destroyed goods were not covered, raising questions about how responsibility should be allocated between stores, installers, service providers and equipment manufacturers.
Coverage may still vary depending on the terms of individual policies. A lack of security updates, commitments made when taking out the policy, or the existence of specific coverage for physical damage and perishable goods can all affect whether a claim is covered.
No Widespread Food Shortage
Despite the unusual scale of the attack, the available evidence does not indicate a nationwide food shortage. The documented consequences remain concentrated among the stores and systems that were actually affected.
It is therefore important to distinguish between two levels: the attack caused real physical and financial losses across several hundred stores, but this does not mean that France's overall food supply was disrupted.
Timeline and Developments
The first large-scale compromises visible in France emerged during the night of October 11 to 12, 2026. Several retailers detected abnormal changes to the settings of their refrigeration systems and began isolating the affected equipment.
On October 12, CERT-FR published an initial alert concerning compromises of refrigeration management systems. The first findings mainly focused on Danfoss equipment and the exposure of its administration interfaces to the Internet.
On October 13, the alert was expanded. Other equipment families, including Copeland XWEB and Dixell XWEB, were added to the systems affected by the observed compromises. At that point, the incident could no longer be considered limited to a single range of controllers.
In the following days, security operations continued while numerous refrigeration control systems remained accessible from the Internet. CERT-FR considers that attack campaigns targeting these systems are probably still ongoing.
What We Are Monitoring Now
Several questions remain unanswered: the identity and motivations of the attackers, the exact method used to compromise the different systems, the possible emergence of new victims, and whether the campaign could spread to other countries or other refrigeration control systems.
The economic consequences will also need to be monitored, particularly the losses incurred by retailers, insurance coverage, and any potential liability involving the different parties responsible for installing, maintaining and securing this equipment.
Going further: data and monitoring
The incidents examined in this report are part of a broader cybersecurity environment in which some indicators can change rapidly, including newly exploited vulnerabilities, observed malicious activity and changes in overall exposure.
These data are monitored separately to distinguish the events examined in this report from broader trends that can be observed over time.
The Cyber Radar complements this analysis by regularly tracking several indicators based on public data.
Follow developments more closely
To follow important developments more directly, you can also find L'Actu sans le Bruit on Telegram. The channel follows new events as they unfold, while this report is updated only when those developments materially change the situation.
The channel is published in French, but Telegram's translation feature can be used to translate posts into English.