# Cyberattack Spoils Food in Hundreds of French Supermarkets

> An extensive cyberattack on October 11-12, 2026, targeting older Danfoss refrigeration systems caused significant food spoilage and millions in losses across French grocery chains.

By PrimaryBrief newsroom · Published 2026-10-19T02:17:30.458660Z
Canonical: https://primarybrief.com/article/cyberattack-spoils-food-in-hundreds-of-french-supermarkets-ec40b2a8

A cyberattack targeting older Danfoss refrigeration control systems between October 11 and 12, 2026, resulted in widespread food spoilage across hundreds of French supermarkets, leading to estimated losses of tens of millions of euros [1][3][4]. This incident highlights critical vulnerabilities in operational technology connected to the internet, posing a direct threat to food supply chains and consumer safety.

## What the records show
Malicious actors exploited vulnerabilities in older Danfoss AK-SM and AK-SC series refrigeration controllers, which were no longer receiving software or security updates [1][3][4]. The attack caused refrigerators and freezers in hundreds of stores to overheat, with temperatures reportedly reaching up to 50°C by manipulating defrost functions [1][4]. The French National Cybersecurity Agency (ANSSI) and the Paris prosecutor's office confirmed the incident, with France's Office anti-cybercriminalité (OFAC) leading a criminal investigation to identify victims and link the attack to reported food losses and fires [1][4].

Several major supermarket chains were affected. Les Mousquetaires (Intermarché) reported approximately 150 affected stores, Coopérative U nearly 100, Carrefour around 80, and Monoprix about 5% of its 490 French stores, with some E.Leclerc stores also impacted [3][4]. Thierry Cotillard, CEO of Les Mousquetaires, estimated national losses of "tens of millions of euros nationwide in a single day" [4].

## The timeline
In August 2026, security researchers at Claroty's Team82 identified and reported three significant vulnerabilities in Danfoss AK-SM 800A series controllers [5]. These included an authentication bypass (CVE-2025-41450), a command injection flaw (CVE-2025-41451) that could lead to remote code execution, and a denial-of-service vulnerability [5]. Claroty demonstrated how these flaws could be chained to disable cooling and falsify temperature readings [5]. They also noted thousands of Danfoss AK-SM 800A management interfaces were publicly accessible over the internet [5].

The attack itself unfolded overnight between October 11 and October 12, 2026 [1][3]. By October 12, France's CERT-FR, a component of ANSSI, issued an alert about numerous compromises affecting Danfoss AK-SM and AK-SC controllers [4]. The Paris prosecutor's office opened an investigation on October 12 [1][4]. By October 13, Danfoss advised keeping firmware updated for AK-SM 800A controllers and suggested migrating legacy systems [4].

## What changed and for whom
CERT-FR advised operators to disconnect affected Danfoss AK-SM and AK-SC controllers or filter access, also recommending basic cybersecurity practices like using secure VPNs, changing default passwords, and applying available firmware updates [4][3]. Danfoss advised migrating legacy systems to current-generation solutions [4]. The incident raised broader concerns about operational technology (OT) cybersecurity and food security, prompting ANSSI to collaborate with European counterparts due to potential risks in other countries using similar software [1][2][6]. U.S. cybersecurity stakeholders noted the incident as a reminder of the importance of baseline cybersecurity measures for OT and called for U.S. agencies to take action in critical infrastructure sectors [2][7].

## What the subject has said publicly
Danfoss acknowledged that its equipment was targeted, stating that most affected units were "legacy" products which were "no longer receiving software or security updates" [3][4][6]. Danfoss also stated it had long advised supermarkets to update firmware and migrate legacy systems [7]. The French National Cybersecurity Agency (ANSSI) and the Paris prosecutor's office confirmed the incident [1].

## What we could not confirm
The precise method attackers used to gain access to the refrigeration systems remains unclear [6]. The total number of Danfoss units affected across all supermarkets was not specified by Danfoss [3]. French and European authorities have not attributed the attacks to any specific entity [2].

## Evidence cited
1. Cyberattack on French supermarkets tells us more about food security than AI safety (www.politico.eu) — https://www.politico.eu/article/cyberattack-french-supermarkets-food-security-ai-safety/
2. OT Cyber Coalition Statement on French Food Sector Attacks (otcybercoalition.org) — https://otcybercoalition.org/
3. Outdated Firmware: How Legacy Equipment Became the Attack Surface (shattered.io) — https://shattered.io/
4. Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers (thehackernews.com) — https://thehackernews.com/
5. Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers - Claroty (claroty.com) — https://claroty.com/
6. French supermarket attack highlights risks of legacy IoT in critical infrastructure (iotinsider.com) — https://iotinsider.com/
7. Hack of Danfoss refrigeration controllers in Europe causes tens of millions in food losses (facilitiesdive.com) — https://facilitiesdive.com/
8. Cyberattack on French Supermarkets Spoils Food | TIME (time.com) — https://time.com/
9. Cyberattack Shuts Down Refrigerators French Supermarkets Danfoss Controllers 2026 (aviatrix.ai) — https://aviatrix.ai/
10. Attackers defrosted refrigeration in 400+ French supermarkets on 11-12 Oct 2026. What Danfoss, prosecutors and retailers have said, and how to check your own connected controllers (redteampartner.com) — https://redteampartner.com/
11. Several supermarkets hit by cyberattack targeting refrigeration systems in France - CBS News (cbsnews.com) — https://cbsnews.com/
12. October 2026 French Supermarket Cyber Attack – A Case Study on International Law and Cyber Operations (diplomacyandlaw.com) — https://diplomacyandlaw.com/
13. Hundreds of French supermarkets hit by ‘unprecedented’ cyber-attack (theguardian.com) — https://theguardian.com/
14. French supermarket cyberattack exposes risks of unsecured remote access and legacy refrigeration systems (industrialcyber.co) — https://industrialcyber.co/
15. Internet-Exposed Danfoss Controllers Drop 71% After French Supermarket Cyber-Attack (infosecurity-magazine.com) — https://infosecurity-magazine.com/