The French Supermarket Fridge Hack: What It Means for IoT, SCADA, and Remote Industrial Systems

The short answer: Between 500 and 700 French supermarkets lost their refrigerated stock after attackers reached refrigeration controllers that were exposed to the internet and switched them into forced defrost. Most of the hijacked units were end-of-life Danfoss models or ran old firmware. No new zero-day was needed. The same pattern of internet-facing controls, default settings, and skipped updates puts IoT devices, building systems, and SCADA in every industry at risk.

Most cyberattacks steal data or lock it up. This one destroyed physical goods. Food was thrown out by the ton, some cases melted or caught fire, and Intermarché’s CEO estimated losses in the tens of millions of dollars in a single day.

The target wasn’t a bank or a power plant. It was the box on the wall that tells a freezer when to defrost. Your business probably has boxes like it: HVAC controllers, building management dashboards, PLCs on a production line, pumps at a water site, cameras, badge readers, solar inverters. If any of them has a web page someone can reach from the internet, it’s in the same category.

This post covers what happened in France, how the attack worked, and the wider threat to IoT, SCADA, and other remotely operated systems. Then it breaks out what it means for three readers: whoever runs the facility, the IT manager who owns the network, and the executive who signs off on risk.

What happened

On the night of Sunday, October 11, 2026, while stores were closed, refrigeration controllers at hundreds of French supermarkets were switched into forced defrost. No alarms fired. By morning, some cases had reached 122°F, and one store in Normandy reportedly hit 176°F. Some equipment melted or caught fire, and sprinklers added water damage.

Counts vary by outlet, and the totals run from about 500 to 700 stores.

The cost. Two stores in Alsace alone reported about $300,000 in losses, and an Intermarché in Issy-les-Moulineaux threw out several tons of food. Intermarché’s CEO put the national figure in the tens of millions of dollars for a single day.

The response. France’s cybersecurity agency, ANSSI, issued an alert on October 12 telling operators to disconnect the affected controllers from the internet. Prime Minister Sébastien Lecornu ordered ANSSI to investigate with European partners, and the Paris prosecutor’s cybercrime unit opened a case. A Sekoia analyst told Reuters that Spain, Portugal, Poland, Germany, and Belgium were also hit.

Who did it. As of October 17, no suspects had been named and no group had claimed it. One researcher suggested it could be opportunists, since the access was easy. Others note that state-backed groups have both the capability and a motive. For defenders, the answer matters less than you’d think: the same open door works for anyone.

How the attack worked

Think of a supermarket refrigeration controller as the thermostat for an entire store. It runs dozens of cases and freezers, schedules defrost cycles, and raises alarms. Technicians like to check on it remotely, so many come with a built-in web dashboard. That convenience is the opening.

Investigators pointed to Danfoss AK-SM 800 and AK-SC 355 system managers, plus some newer AK-SM 800A units on old firmware. Copeland and Dixell XWEB controllers were also named. The attack chain, as reported so far:

1. Find it. The controllers’ web dashboards were reachable from the open internet, mostly straight from store broadband lines with no VPN in front.
2. Get in. The exact method hasn’t been confirmed. The candidates are weak or default logins and known flaws in old firmware. Neither requires anything new.
3. Use a normal feature. The attackers didn’t need malware. They triggered forced defrost, a legitimate maintenance function, at scale.
4. Pick the timing. Overnight, stores were empty and no alarms fired. By the time staff arrived, the stock was gone.

The products were past their support dates. Danfoss phased out the AK-SC 355 in 2016 and ended support for the AK-SM 800 in May 2021. Neither gets updates. Danfoss says it had advised customers to upgrade.

The flaws were public. Claroty’s Team82 documented three AK-SM 800A vulnerabilities: an authentication bypass (CVE-2025-41450, fixed in firmware 4.2), command injection leading to remote code execution (CVE-2025-41451), and denial of service (CVE-2025-41452). The last two require a login, which the bypass supplies, so they can be chained; both are fixed in 4.3.1. Authorities have not said these specific CVEs were used in this attack.

The exposure was measurable. A pre-attack scan by IPinfo on October 6–7 found 2,528 Danfoss StoreView dashboards online across 73 countries. France had 1,331 of them, more than every other country combined. About 85% of the French units ran software with known flaws, and only 195 had every fix. Three days after the attack, 76% of the French dashboards had gone dark. Stores mostly unplugged them rather than patched them.

Why this pattern keeps working: none of these steps is advanced. The equipment was listed, reachable, and outdated before anyone touched it. As we covered in Attack-Path Analysis: Why Isolated CVEs Miss Your Real Risk, real risk comes from combining severity, exploitation, and where the flaw sits in your environment. A controller on a public IP is the worst place it can sit.

It’s not about fridges: the threat to IoT, SCADA, and remote industrial systems

The French attack is the latest case of a pattern that keeps repeating. Equipment built to control physical things gets connected for convenience, then left reachable, unpatched, and on its factory settings. The labels differ, but the risk is the same.

The same playbook, again and again

Notice what’s missing from the “how they got in” column: zero-days. Every entry is an exposed interface, a default password, or a device past its support date. A joint US, Canadian, and UK advisory called the hacktivist activity “unsophisticated” and warned it could still cause physical harm in poorly secured environments.

Why these systems are hard to secure

• They outlive their support. Controllers run for 15 years or more. The AK-SC 355 was phased out in 2016 and was still running French stores in 2026.
• Patching means downtime. You can’t reboot a freezer bank, a pump station, or a production line on a Tuesday afternoon.
• Vendors need remote access. Installers and service contractors often set up their own remote connections, and nobody tracks them.
• Old protocols trust everyone. Modbus, the protocol FrostyGoop abused, has no authentication. Anything that can reach the device can command it.
• Nobody owns them. Facilities thinks IT handles security. IT doesn’t know the device exists. The scanner never looks at it.
• The damage is physical. Data can be restored from backup. Spoiled food, burst pipes, and burned-out compressors can’t.

If you run the facility

You don’t need to understand SCADA protocols. You need to know which of your equipment can be reached from outside the building, and who has the keys.

Store owners, plant managers, and property managers usually inherit these systems from an installer. The refrigeration contractor set up remote monitoring. The HVAC company added a cloud dashboard. The solar installer put an inverter online. Each one may have opened a door that nobody wrote down.

What an attack could mean for you in practice:

• A weekend of spoiled inventory you can’t sell and may not be insured for.
• Damaged compressors, pumps, or motors with weeks-long replacement times.
• A food-safety, safety, or environmental incident you have to report.
• A closed store or stopped line while you switch to manual operation.

Questions to ask your equipment vendors and service contractors:

1. Which of our systems can be reached over the internet, and how?
2. Who has remote access, and is it through a VPN with individual logins and MFA?
3. Have the default passwords been changed on every controller, HMI, and router?
4. Which models are past end-of-life or no longer receive firmware updates?
5. Will we get an alert if set points change, a system goes offline, or temperatures drift overnight?
6. What’s the manual fallback, and has staff practiced it?

If nobody can answer the first question, start there.

If you’re an IT manager who came up through networking

This is a reachability problem, and that’s your home turf. Investigators haven’t confirmed how the attackers got past the login, but whatever they used, they could only try it because the controllers were sitting on public IPs.

The shift is scope. Your inventory probably covers laptops, servers, switches, and firewalls. It may not include the refrigeration manager on the store’s broadband line, the BMS server the facilities team bought, or the cellular modem a vendor installed for remote support.

A practical triage order:

1. Internet-facing OT and IoT management interfaces. Take them offline or put them behind a VPN now. This is what ANSSI told French operators to do on day one.
2. End-of-life controllers. No patch is coming. Isolate them, restrict access to known IPs, and plan the replacement budget.
3. Known-exploited flaws on reachable devices. Check vendor advisories and the CISA KEV catalog for anything you run.
4. Default and shared credentials. Rotate them, remove vendor accounts nobody uses, and turn on MFA where the device supports it.
5. Flat networks. Segment OT away from corporate IT and guest Wi-Fi so a compromised camera can’t reach a PLC.

Where network instincts help most:

• Find it from the outside first. Search Shodan or Censys for your own public IP ranges. Attackers already have.
• Inbound rules aren’t everything. Cellular modems and cloud-connected devices dial out, which bypasses your firewall’s inbound rules.
• Monitor for changes, not just logins. A set-point change or forced defrost at 2 a.m. is your alarm.

Where to watch out: Don’t run aggressive active scans against live controllers. Some older PLCs and HMIs fall over when probed. Use passive discovery or schedule scans with the vendor during a maintenance window.

If you’re in the C-suite

This attack changed the conversation from “data breach” to “physical loss.” A single night cost French retailers an estimated tens of millions of dollars, and the systems involved were never on most boards’ risk registers.

Why it reaches your desk:

• Operational resilience. Revenue now depends on equipment that IT may not even know exists.
• Regulation. In the EU, NIS2 brings food production and distribution, water, and energy under cybersecurity obligations. US water utilities face growing EPA and CISA scrutiny.
• Cyber insurance. Policies may treat spoiled stock or physical damage from a cyber event differently from data loss. Check yours.
• Vendor risk. Your equipment suppliers and service contractors are part of your attack surface. Contracts should say who patches what, and when.

Metrics worth asking for:

The one question to ask your team: “If someone changed the settings on our equipment tonight, who would know, and how fast?” If the answer is “staff, when they arrive in the morning,” that’s the gap that cost French retailers their stock.

A short checklist, whatever your role

• List every connected controller, HMI, BMS, camera, and IoT device, and who owns each.
• Check what’s reachable from the internet, using an outside scan of your own IP ranges.
• Take management interfaces off the public internet, or put them behind a VPN with MFA.
• Change every default password, including on routers and modems vendors installed.
• Identify end-of-life devices and budget for replacement.
• Segment OT and IoT away from corporate IT and guest networks.
• Inventory vendor remote-access paths and remove the ones nobody uses.
• Set alerts for set-point changes, unexpected modes, and overnight drift.
• Practice the manual fallback.

Sources

• Hundreds of supermarkets in France hit by ‘unprecedented’ cyberattack — Al Jazeera (chains, temperatures, losses, ANSSI, Sekoia)
• French fridge fright: Why supermarkets have become target for hackers — Al Jazeera (affected models, Danfoss statement)
• Attackers Heat French Supermarket Fridges Up to 50°C — The Hacker News (end-of-life dates, CVEs, CERT-FR alert, 2022 incidents)
• Five days before the French supermarket fridge attack — OffSeq Radar, citing IPinfo (exposure counts before and after)
• 2026 French supermarket refrigerator hack — Wikipedia (Normandy 176°F, Alsace losses, other countries)
• Fridge Hack Probe — Tech Insider (investigation status as of Oct 17)
• Global agencies alert on pro-Russia hacktivist OT activity — Industrial Cyber (May 2024 advisory)
• CISA responds to exploitation of Unitronics PLCs — Industrial Cyber (Aliquippa, Nov 2023)
• FrostyGoop and unauthenticated Modbus TCP — WaterISAC, citing Dragos (Lviv, Jan 2024)
• Tureby Alkestrup Waterworks attack — RISI (Denmark, 2024)