Hackers Heated Supermarket Freezers to 50°C Overnight: A Timeline of the Attack on French Grocery Chains

Most cyberattacks steal data or lock files. This one spoiled food. Over one night, attackers took control of refrigeration at hundreds of French supermarkets and warmed it until stock had to be thrown away. The pieces are still being put together, so we have laid out what is known in date order, starting with the history that made it possible.

The timeline is drawn from Swati Khandelwal’s detailed reconstruction for The Hacker News, which gathers statements the retailers, Danfoss and French authorities gave to AFP, Reuters and others. One detail on how long the warming lasted comes from SecurityWeek.

Before the attack

2016 and 2021: two controllers reach the end of the road

Danish manufacturer Danfoss phased out its AK-SC 355 controller in 2016 and declared the AK-SM 800 end-of-life in May 2021. Both kept running in stores long after.

2022: earlier warnings

Danfoss’s own records mention attacks on the AK-SM 800 that year: 16 Russian supermarkets were targeted and 40 Israeli stores were hacked. Danfoss says all 40 lacked a proper firewall or VPN, and it names no software flaw in either case.

2025: fixes for the newer model, and a final notice

Danfoss fixed three flaws in the current AK-SM 800A: an authentication bypass in versions before 4.2, plus a command injection flaw and a denial-of-service flaw, both of which require a login and were fixed in 4.3.1. Researchers at Claroty later published details and said they had found thousands of AK-SM 800A management interfaces reachable from the internet. Their work was done in a lab and describes no real attacks. In an October 2025 newsletter, Danfoss said it would end all services for older products and urged customers to plan replacements.

The attack

Night of October 11, 2026: the cold cases warm up

Attackers remotely took over the controller that runs a store’s fridges and freezers, a Danfoss device that maintenance firms can manage from afar. Les Mousquetaires, owner of the Intermarché chain, says its units were put into defrost and heated to as much as 50°C (122°F). SecurityWeek reports that some equipment warmed for about six hours before employees noticed.

October 12: retailers count the damage and France issues an alert

Intermarché and Netto: at least 300 stores across both brands according to AFP, or about 150 according to Reuters. Affected stores had to discard all the products concerned.
Carrefour: 80 supermarkets.
Monoprix: about 30 stores.
E.Leclerc: several stores, after what it described as a cyberattack on one of its refrigeration equipment suppliers.

CERT-FR, the French government’s emergency response team, said it was aware of numerous compromises of Danfoss AK-SM and AK-SC controllers and told operators to disconnect them or tightly filter access. Danfoss said it was aware of incidents affecting “a limited number” of systems in France and that most units hit were older products that no longer receive updates, naming the AK-SM 800 and AK-SC 355. It later told trade publication Cooling Post that some newer AK-SM 800A units running outdated firmware were also hit.

October 13: the picture widens

Coopérative U said 80 of its 2,000 stores were reached, but that in most of them the cold chain held thanks to fast work by staff and refrigeration contractors.
Thierry Cotillard, head of Les Mousquetaires, told BFMTV he expects losses of tens of millions of euros, according to Reuters.
The Paris prosecutor’s office opened an inquiry, led by its cybercrime section, to count victims and link the attack to reported damage, which includes lost food and equipment that began to catch fire.
A Sekoia threat analyst told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected, without further detail.

Still unknown

As of October 13, no one had been named as responsible, and neither CERT-FR nor Danfoss had said how the attackers got in. No specific vulnerability or firmware version had been tied to the attack, and no indicators of compromise had been published. The 2025 flaws in the newer model have not been linked to it.

What France told operators to do

For any controller that may have been compromised, CERT-FR’s alert lists six steps in order: limit network access to service providers only, perform a factory reset, apply all available security fixes, change passwords and other secrets, review existing accounts, and fully reconfigure the device. For the two discontinued models, the patching step offers nothing new because Danfoss no longer issues fixes for them.

What this means for your company

You don’t have to run a supermarket to own equipment like this. Refrigeration, heating and cooling, access control, cameras and building management systems are often installed by a contractor who keeps a remote connection open for service calls. That connection is rarely on anyone’s security checklist.

List the equipment that talks to the outside world. Ask each facilities or equipment vendor how they connect remotely and from where.
Take management screens off the open internet. Route vendor access through a single managed entry point, such as a VPN with its own login, and restrict it to known addresses.
Change default passwords and remove old accounts on every controller, and ask vendors to confirm the firmware is current.
Plan to replace end-of-life devices. If the maker no longer issues fixes, isolation is the only protection left.
Keep an independent alarm on what matters most, such as a separate temperature sensor, so you aren’t relying solely on the device that could be tampered with.

Need help finding and fencing off the equipment your vendors manage remotely? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.