Oct 18, 2026

Tags:

The Fridge Is OT: What the French Supermarket Defrost Attack Teaches Every Operator

Alright, mi gente. If you ever thought the refrigeration controller in the back of a grocery store was “just facilities,” this week should change your mind.

Overnight from Sunday, October 11 to Monday, October 12, attackers got into refrigeration remote controllers at French supermarkets and drove them into continuous defrost. Cases warmed up. In some stores temperatures reportedly hit 50 C. Staff threw out meat and frozen goods. Fires were reported too.

That’s a physical process getting manipulated remotely. That’s OT, familia.

What we actually know

CERT-FR published alert CERTFR-2026-ALE-012 on October 12 and updated it on October 13. It says there have been numerous compromises of remote refrigeration controllers and that campaigns are probably still under way.

Version one named Danfoss AK-SM and AK-SC controllers. Version two added Copeland xweb and Dixell xweb. Dixell is a Copeland brand, and a Copeland spokesperson declined to confirm to Reuters.

CERT-FR’s line on exposure is blunt: putting a management interface on the internet goes against good practice. Claro.

The Paris prosecutor opened an investigation through its cybercrime section, with OFAC working the case. Part of that job is establishing the link between the attack and the food losses and fires. ANSSI reportedly identified a vulnerability in the Danish vendor’s software and contacted the vendor.

What we don’t know yet

Mira, this part matters as much as the facts.

The entry vector isn’t confirmed. Nobody has claimed responsibility. There’s no confirmed attacker or motive. And no source has confirmed which CVE, if any, was used.

The store count is a mess too. Here’s what different outlets reported:

At least 300 Intermarché and Netto stores (retailers to AFP), while The Register put Intermarché at around 150.
Coopérative U: over 100 per AFP, fewer than 100 per Le Monde Informatique, and 80 of 2,000 per its CEO via The Register.
Carrefour around 80, and Monoprix around 25 to 30 (The Register, GovInfoSecurity, Le Monde Informatique).
Totals from at least 350 (Reuters) to around 500 (Cooling Post).

So I’ll just say hundreds of stores.

One more wrinkle. Coopérative U’s CEO told RTL that U isn’t a Danfoss customer. So don’t assume every hit store ran Danfoss gear. CERT-FR’s v2 alert names more than one vendor for a reason.

Losses are estimates only, from “millions” (Cooling Post) to “tens of millions of euros” (a Coopérative U executive via GovInfoSecurity). No official total. No fire count. No injuries reported in any source I’ve seen.

Old gear, open doors

Danfoss told outlets the majority of affected units were legacy products that no longer get software or security updates. The AK-SM800 hit end of life in 2021. The AK-SC355 was phased out in 2016. Where current AK-SM800A units were involved, Danfoss says they were running outdated firmware.

And exposure isn’t small. The Register and Reuters each found at least 4,500 internet-facing Danfoss interfaces on Shodan this week, with The Register saying more than half were in France. That’s a quick journalist search, not an audit, and exposed doesn’t mean compromised. Still.

Here’s the CERT-FR point I want every operator to tattoo somewhere: if you keep an unpatched end-of-life device exposed to the internet, a factory reset alone won’t save you. It clears the attacker’s persistence, but the device stays vulnerable and will almost certainly be compromised again.

Reset is not recovery.

About those earlier CVEs

You’ll see Claroty’s Team82 research everywhere this week. They previously found flaws in the Danfoss AK-SM800A, fixed in firmware R4.2 and R4.3.1 (CISA ICSA-25-140-03), and separate issues in Copeland XWEB controllers, fixed in firmware 1.13 (CISA ICSA-26-057-10). Researchers called the earlier Danfoss flaws easy to script.

That’s background, not the cause. The Register reports authorities have not identified the entry point or confirmed exploitation of the Claroty findings. CERT-FR also names legacy models Claroty didn’t cover.

What Claroty’s CTO said still lands, though: these controllers are often assumed to sit on isolated networks, and plenty of them are directly on the public internet.

Why this is a contractor problem too

Refrigeration contractors monitor these systems remotely. That’s the business model, and it’s why the controllers end up reachable from outside.

CERT-FR even tells operators to check their insurance terms before cutting the contractor’s data feed. That’s how tied together this stuff is. Its guidance is to get the units off the public internet, check the whole configuration with defrost schedules first, and bring remote access back only through a VPN or protected network. Filtering contractor IPs on a firewall is fine in an emergency, but don’t treat it as the fix.

This isn’t the first time a building contractor path showed up in a retail breach story. It is the clearest case I’ve seen of that access turning into physical damage at this scale.

Bottom line

Supervisory controllers that contractors reach remotely are physical-process systems. End-of-life gear on the internet is a business risk, not an IT footnote.

Put refrigeration, HVAC and building controllers on your OT inventory, with model and firmware, and find out from your contractor in writing what’s reachable from a public IP.
Isolate or replace end-of-life units. A reset alone just buys time before the next compromise.
Watch the process, not just the network. Independent temperature alarms catch a forced defrost even when the controller is lying to you.

Stay sharp out there, familia.

Javier