INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Hackers heat French supermarket fridges to 50°C in cyberattack

| 2026-10-14 09:30 LOW HIGH DDOS & DISRUPTION CYBERATTACK (GENERAL)
JSON
Executive Summary
AI-generated
Hackers reportedly heated supermarket fridges to 50°C in France, spoiling food stocks, while stores in the Netherlands and Belgium faced separate IT outages. In a French supermarket cyberattack confirmed by retailers on Monday, hackers took remote control of internet-connected refrigeration systems and pushed fridge and freezer temperatures as high as 50 degrees Celsius (122F). Cyberattacks on supermarket refrigeration systems reportedly pushed temperatures as high as 50°C (122°F), affecting hundreds of stores in France and forcing retailers to discard food.
Technical Observables 2 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
urls 1 domains 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
DK FR
manufacturingmanufacturing retailretail
Incident Timeline
‎October 11
Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels on October 11, more than 1,800 of them in France.
target_region France
Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels on October 11, more than 1,800 of them in France.
organisation Censys
Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels on October 11, more than 1,800 of them in France.
general_metric 3,000 exposed control panels
Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels on October 11, more than 1,800 of them in France.
‎October 12
ANSSI’s CERT-FR first warned on October 12 of numerous compromises involving Danfoss AK-SM and AK-SC series refrigeration controllers.
target_region France
…r emergency response team (CERT-FR) on October 12 specifically named Danfoss AK-SC and AK-SM series as well as Dixell xweb and Copeland xweb as “affected systems.” Fears of Deliberate Industrial Sabotage Speaking to Infosecurity , Amir Preminger, CTO of industrial security provider Claroty, said refrigeration controllers are a prime target, not just for supermarkets but also cold-storag…
tactic Sabotage
…r emergency response team (CERT-FR) on October 12 specifically named Danfoss AK-SC and AK-SM series as well as Dixell xweb and Copeland xweb as “affected systems.” Fears of Deliberate Industrial Sabotage Speaking to Infosecurity , Amir Preminger, CTO of industrial security provider Claroty, said refrigeration controllers are a prime target, not just for supermarkets but also cold-storag…
attribution CERT-FR
…r emergency response team (CERT-FR) on October 12 specifically named Danfoss AK-SC and AK-SM series as well as Dixell xweb and Copeland xweb as “affected systems.” Fears of Deliberate Industrial Sabotage Speaking to Infosecurity , Amir Preminger, CTO of industrial security provider Claroty, said refrigeration controllers are a prime target, not just for supermarkets but also cold-storag…
organisation AK-SM
…r emergency response team (CERT-FR) on October 12 specifically named Danfoss AK-SC and AK-SM series as well as Dixell xweb and Copeland xweb as “affected systems.” Fears of Deliberate Industrial Sabotage Speaking to Infosecurity , Amir Preminger, CTO of industrial security provider Claroty, said refrigeration controllers are a prime target, not just for supermarkets but also cold-storag…
organisation CTO
…r emergency response team (CERT-FR) on October 12 specifically named Danfoss AK-SC and AK-SM series as well as Dixell xweb and Copeland xweb as “affected systems.” Fears of Deliberate Industrial Sabotage Speaking to Infosecurity , Amir Preminger, CTO of industrial security provider Claroty, said refrigeration controllers are a prime target, not just for supermarkets but also cold-storag…
organisation Claroty
…r emergency response team (CERT-FR) on October 12 specifically named Danfoss AK-SC and AK-SM series as well as Dixell xweb and Copeland xweb as “affected systems.” Fears of Deliberate Industrial Sabotage Speaking to Infosecurity , Amir Preminger, CTO of industrial security provider Claroty, said refrigeration controllers are a prime target, not just for supermarkets but also cold-storag…
organisation AK-SC
ANSSI’s CERT-FR first warned on October 12 of numerous compromises involving Danfoss AK-SM and AK-SC series refrigeration controllers.
‎2026/10/14
Hackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold, exploiting unpatched older hardware and bypassing authentication mechanisms.
organisation Intermarché
Hundreds of supermarkets affected in France Supermarket chains that have confirmed being affected include Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix.
E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected.
" Intermarché owner Groupement Les Mousquetaires said around 150 of its supermarkets were affected by the attacks, while Carrefour confirmed around 80 impacted stores.
organisation ANSSI
The cyberattack that disrupted refrigeration at hundreds of French supermarkets this week also affected equipment from Copeland and its Dixell brand, according to France’s national cybersecurity agency ANSSI.
France’s national cybersecurity agency, ANSSI, said in an emailed statement that it was “mobilised to handle this incident” both at the national level to support potential victims and at the European level to coordinate with its counterparts.
Danfoss Refrigeration Controllers at the Center France’s government cybersecurity agency, ANSSI, identified the targeted systems as Danfoss refrigeration controllers, including the AK-SM800 and AK-SC355 models.
organisation Monoprix
Hundreds of supermarkets affected in France Supermarket chains that have confirmed being affected include Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix.
Major supermarkets such as Carrefour, Coopérative U, Intermarché, Monoprix, and more were hit by the attacks, which spoiled perishable food and left stores without fresh produce.
E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected.
organisation E.Leclerc
Hundreds of supermarkets affected in France Supermarket chains that have confirmed being affected include Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix.
E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected.
The cyber attack impacted several major supermarket chains, including Intermarché, Super U and E.Leclerc.
organisation Intermarché and Netto
French broadcaster BFMTV reported that about 300 Intermarché and Netto stores and fewer than 100 Coopérative U stores were affected.
E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected.
The Mousquetaires group says 300 of its Intermarché and Netto stores were affected, Coopérative U says fewer than a hundred of its outlets, and E.Leclerc confirmed repercussions on cooling equipment in several stores without giving numbers.
organisation Dominique Schelcher
Dominique Schelcher, the CEO of Coopérative U, said on X that attacking equipment essential to preserving fresh food and feeding French shoppers is extremely serious and unprecedented.
“This is an essential system for the proper preservation of food products,” emphasized Dominique Schelcher, CEO of Coopérative U, in a post on X .
Coopérative U CEO Dominique Schelcher said 80 of the group’s stores were targeted, but only a minority had to throw away products.
organisation Carrefour
Hundreds of supermarkets affected in France Supermarket chains that have confirmed being affected include Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix.
Major supermarkets such as Carrefour, Coopérative U, Intermarché, Monoprix, and more were hit by the attacks, which spoiled perishable food and left stores without fresh produce.
E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected.
organisation BFMTV
According to French reporting citing BFMTV, the attack began overnight from Sunday to Monday and affected refrigeration systems linked to Danish manufacturer Danfoss.
French broadcaster BFMTV reported that about 300 Intermarché and Netto stores and fewer than 100 Coopérative U stores were affected.
Overnight from Sunday to Monday, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed .
organisation AK-SC355
It identified AK-SM800 and AK-SC355 systems among those affected and said it had long advised customers to move away from obsolete models and keep supported equipment updated.
Danfoss Refrigeration Controllers at the Center France’s government cybersecurity agency, ANSSI, identified the targeted systems as Danfoss refrigeration controllers, including the AK-SM800 and AK-SC355 models.
The company explained that most of the impacted equipment was older hardware—specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates—while the AK-SM800A units involved were running outdated firmware .
financial €50,000 € worth
In Haguenau, Alsace, an Intermarché store reportedly lost its frozen-food stock, worth about €50,000.
In Haguenau, an Intermarché reportedly lost its entire frozen stock, an estimated 50,000 euros, and a Leclerc store about 30 kilometers away in Wasselonne reportedly discarded frozen and fresh goods worth around 220,000 euros.
For example, an Intermarché in Haguenau lost its entire frozen stock, estimated at 50,000 euros, while a Leclerc store about 30 kilometers away in Wasselonne had to discard around 220,000 euros worth of fresh and frozen goods.
organisation Dixell
Notably, French local media France 3 reported that an E. Leclerc supermarket in the Tarn region, in the south-west of France, experienced disruptions to its refrigeration systems, despite using Dixell equipment instead of Danfoss.
The cyberattack that disrupted refrigeration at hundreds of French supermarkets this week also affected equipment from Copeland and its Dixell brand, according to France’s national cybersecurity agency ANSSI.
organisation BFM
French TV channel BFM reported that they appeared to trigger a forced defrost option, keeping units heating instead of cooling.
The equipment heated for several hours instead of keeping goods cold, and when staff opened the fridges and freezers in the morning, a sector source told BFM, “a wave of heat” came out.
organisation Claroty
This summer, Claroty detailed flaws in Danfoss’s AK-SM 800A , along with 23 vulnerabilities in Copeland’s XWEB Pro controller.
Researchers at Claroty’s Team82 later showed that a compromised controller could switch off cooling while still reporting normal temperatures to staff.
organisation AFP
The Danish manufacturer told AFP that most affected units were legacy products running outdated firmware, and that it had previously advised supermarkets to update them.
Contacted by AFP, E. Leclerc did not immediately confirm the information.
organisation AK-SM 800A
Claroty found a hidden authentication mechanism in the AK-SM 800A platform that accepted a code generated from the device's current date, bypassing the configured administrator password.
Upon examining the AK-SM 800A, one of the models targeted in this week’s attack, the researchers discovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols.
infrastructure 4,980 hosts
These findings […] The post Danfoss Refrigeration Hack Update – 4,980 Hosts Found Exposed to Internet appeared first on Cyber Security News .
Danfoss Refrigeration Hack Update – 4,980 Hosts Found Exposed to Internet.
organisation AK-SM800
Danfoss Refrigeration Controllers at the Center France’s government cybersecurity agency, ANSSI, identified the targeted systems as Danfoss refrigeration controllers, including the AK-SM800 and AK-SC355 models.
The company explained that most of the impacted equipment was older hardware—specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates—while the AK-SM800A units involved were running outdated firmware .
financial 220,000 euros
In Haguenau, an Intermarché reportedly lost its entire frozen stock, an estimated 50,000 euros, and a Leclerc store about 30 kilometers away in Wasselonne reportedly discarded frozen and fresh goods worth around 220,000 euros.
For example, an Intermarché in Haguenau lost its entire frozen stock, estimated at 50,000 euros, while a Leclerc store about 30 kilometers away in Wasselonne had to discard around 220,000 euros worth of fresh and frozen goods.
infrastructure 4,500 endpoints
Shodan searches for internet-facing Danfoss controller interfaces indicated that more than 4,500 endpoints were exposed as of Monday, with more than half of those located in France.
organisation BFM TV
BFM TV said France’s largest supermarket chain E. Leclerc was also affected, with hackers “managing to remotely trigger the forced defrosting of the refrigeration systems in numerous stores”.
organisation Intermarche
AFP reports: Major French supermarket chains Intermarche and Cooperative U were hit by a cyberattack that caused their refrigerators to defrost, the two retailers told AFP Monday.
organisation Separate Cybersecurity Incident
Dutch Retailer Reports Separate Cybersecurity Incident A separate retail disruption is also affecting Ahold Delhaize brands in the Netherlands and Belgium, although no public evidence currently links it to the French refrigeration attack.
organisation Capital
French outlets including Clubic , 01net and Capital reported that around 150 Intermarché stores may have been affected.
organisation the Ahold Delhaize
For now, the French refrigeration attack and the Ahold Delhaize disruption should be treated as separate incidents unless investigators or the companies say otherwise.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, French supermarkets)
organisation AK-SC
CERT-FR published an alert reporting numerous compromises of Danfoss AK-SM and AK-SC controllers, which were not mentioned in Claroty's original reporting nor in Danfoss's advisories at the time.
organisation CTO
However, our research found many of these devices are directly exposed to the public internet," said Amir Preminger, CTO at Claroty.
organisation Danfoss’s AK-SM 800A
This summer, Claroty detailed flaws in Danfoss’s AK-SM 800A , along with 23 vulnerabilities in Copeland’s XWEB Pro controller.
organisation Dixell Electronics
Recent developments suggest that the incident does not only impact Danfoss refrigeration controllers, but also temperature regulation devices from Dixell Electronics, an Italian brand owned by American heating and cooling equipment provider Copeland.
organisation APN
His advice was to keep critical devices off the public internet and restrict access through measures such as corporate virtual private networks (VPNs) or even access point name (APN) gateways.
‎October 14
By October 14, the French count had dropped to 537, while the number elsewhere barely changed.
target_region France
By October 14, the French count had dropped to 537, while the number elsewhere barely changed.
Tactical Metrics
Metrics
infrastructure
4,500
Endpoints
Shodan searches for internet-facing Danfoss controller interfaces indicated that more than 4,500 endpoints were exposed as of Monday, with more than half of those located in France.
Metrics
infrastructure
4,980
Hosts
An update from International Cyber Digest on October 13 reports a total of 4,980 hosts identified, with 2,911 located in France and 517 in South Africa.
These findings […] The post Danfoss Refrigeration Hack Update – 4,980 Hosts Found Exposed to Internet appeared first on Cyber Security News .
Danfoss Refrigeration Hack Update – 4,980 Hosts Found Exposed to Internet.
Metrics
infrastructure
‎Ios
Affected Product
Available with  Malwarebytes Premium Security  for all your devices, and in the  Malwarebytes app for iOS and Android .
Metrics
infrastructure
‎Android
Affected Product
Available with  Malwarebytes Premium Security  for all your devices, and in the  Malwarebytes app for iOS and Android .
Metrics
financial
50,000
€ Worth
In Haguenau, Alsace, an Intermarché store reportedly lost its frozen-food stock, worth about €50,000.
In Haguenau, an Intermarché reportedly lost its entire frozen stock, an estimated 50,000 euros, and a Leclerc store about 30 kilometers away in Wasselonne reportedly discarded frozen and fresh goods worth around 220,000 euros.
For example, an Intermarché in Haguenau lost its entire frozen stock, estimated at 50,000 euros, while a Leclerc store about 30 kilometers away in Wasselonne had to discard around 220,000 euros worth of fresh and frozen goods.
Metrics
infrastructure
‎3.1
Software Version
Claroty disclosed these vulnerabilities to Danfoss, which subsequently patched them in firmware version R4.3.1.
Metrics
financial
220,000
Euros
In Haguenau, an Intermarché reportedly lost its entire frozen stock, an estimated 50,000 euros, and a Leclerc store about 30 kilometers away in Wasselonne reportedly discarded frozen and fresh goods worth around 220,000 euros.
For example, an Intermarché in Haguenau lost its entire frozen stock, estimated at 50,000 euros, while a Leclerc store about 30 kilometers away in Wasselonne had to discard around 220,000 euros worth of fresh and frozen goods.
Intelligence Sources
Security Affairs 2026-10-13
TheRecord 2026-10-11
The Cyber Express 2026-10-14
SecurityWeek 2026-10-15
Malware Bytes 2026-10-13
AlienVault OTX 2026-10-13
Data Breaches 2026-10-12
Schneier on Security 2026-10-14
The Register - CSO 2026-10-13
Infosecurity-Magazine 2026-10-14