French Supermarket Fridge Attack: The Risk of Remote Control

Overnight on 11-12 October 2026, several French retailers were hit by a cyberattack that manipulated their connected refrigeration systems. Refrigerators and freezers were driven up to 50 °C, spoiling food and, according to reports, also causing fires. We are writing on 13 October 2026: information is still incomplete and should be treated with caution.

What happened and how far it extends

The figures published so far vary by retail brand and come from company statements or the press:

• Les Mousquetaires (the group that controls Intermarché) reports around 150 stores affected, with units heated for six hours overnight.
• Carrefour reports 80 supermarkets affected.
• Monoprix says 5% of its roughly 490 stores in France were hit.
• Other sources cite more than 100 Coopérative U stores.

The French national cybersecurity agency, ANSSI, has been tasked with investigating, and the authorities are assessing whether the exposure is broader. Neither the attacker nor the point of entry has been confirmed.

A possible Danfoss link, not yet proven

In August, Claroty's Team82 published research on the Danfoss AK-SM 800A, a central manager for refrigeration controllers with a web interface for remote maintenance. A Censys scan found 2,765 devices exposed to the internet. Three vulnerabilities were identified:

• CVE-2025-41450: login bypass via a hidden "code-of-the-day";
• CVE-2025-41451: command injection leading to remote code execution;
• CVE-2025-41452: Nginx configuration injection, which can cause denial of service.

Danfoss has released firmware R4.3.1 to fix them. It should be stressed, however, that there is no confirmation that the attackers exploited these particular flaws: the connection is a hypothesis to be verified, not an established fact.

What the experts say

Amir Preminger, CTO of Claroty, observed that refrigeration controllers are an overlooked target. Many are assumed to sit on isolated networks, yet they are directly reachable from the internet because remote access lowers maintenance costs. His recommendations: keep management interfaces off the internet, restrict administrative access to trusted management networks or VPNs, and apply network segmentation.

A cyber-physical attack can damage product and safety without ever touching the checkout systems.

Why it matters even if you don't sell food

The incident shows how the convenience of remote maintenance on controllers and system managers can become a real risk. The same scenario applies to any temperature-sensitive operation: cold rooms, warehouses, pharmaceuticals and chemicals. The damage does not come from stolen data, but from a physical effect on goods and equipment.

What to do in practice

A few low-cost actions to start right away:

• Check internet exposure: inventory devices and web interfaces reachable from outside, including those installed by vendors and maintenance contractors.
• Update firmware: monitor manufacturer advisories and schedule patches even for equipment considered "field devices".
• Segment networks: separate controllers from the IT network and allow administration only from trusted management networks or via VPN.
• Add independent protections: temperature alarms and hardwired limits that do not depend on the networked controller, so that a malicious command cannot push the plant beyond dangerous thresholds.

We will follow the developments of the ANSSI investigation. In the meantime, the case is a reminder of a well-known design principle: functional safety must never depend entirely on a network-reachable device.