French Supermarket Cyberattack Puts Refrigeration Access and Response Times in Focus

The most useful lesson from France’s supermarket refrigeration attack isn’t which controller was targeted. It’s how differently stores handled the same kind of disruption. Some lost their stock; others kept the cold chain intact because someone spotted the problem and acted in time. For operators, that points to three practical questions: who can change refrigeration settings remotely, which alerts catch those changes, and who owns the replacement plan for aging equipment?

Response time decided what was lost

On the night of 11 October, remote changes put cold cases in several hundred Intermarché and Netto supermarkets into defrost. Les Mousquetaires said the fridges and freezers rose to about 50°C and remained there for roughly six hours. By morning, stores were discarding meat, frozen products and vegetables, with the cooperative expecting losses in the tens of millions of euros.

The impact varied across the sector. Coopérative U reported that 80 of its roughly 2,000 stores were affected, but said the cold chain held at most locations. Chief executive Dominique Schelcher told RTL that only a minority lost stock after responding too slowly. He credited store employees and refrigeration contractors with limiting the damage. Intermarché, by contrast, said affected stores had to throw everything away.

A second wave struck during the night of 12 to 13 October and reached stores using Dixell controllers as well. Similar equipment and timing produced different outcomes. That points to response capability as a factor operators can examine now, even though key details of the intrusion remain unknown.

CSO has reported which systems were hit and the steps CERT-FR recommends. No group has claimed responsibility, and no ransom demand has surfaced. Investigators have not established how the attackers gained access. Exposed management interfaces, known vulnerabilities and stolen contractor credentials remain possible routes; neither CERT-FR nor Danfoss has identified one as the cause.

Remote maintenance makes the contractor part of the security boundary

Refrigeration controllers are often supplied, configured and maintained by contractors. Schelcher said Coopérative U buys services from refrigeration contractors rather than Danfoss directly. Those firms may retain remote access so they can adjust settings without sending a technician to each store. E.Leclerc told AFP that the attack reached its stores through a refrigeration equipment supplier.

That setup has a clear operational benefit: remote support can turn an urgent callout into a quick adjustment. It also means the contractor’s access path can determine whether a controller is reachable from outside the store. The contractor may manage the connection, while the retailer owns the inventory exposed if something goes wrong. That division of responsibility can be easy to miss in a maintenance agreement.

Danfoss documented earlier attacks involving the AK-SM 800 in its October 2025 technical newsletter. The incidents affected 16 Russian supermarkets and 40 stores in Israel in 2022. The newsletter said the Israeli sites lacked proper firewall or VPN protection. The AK-SM 800 had reached end of life in May 2021, yet similar equipment remained internet accessible in France years later.

The contractual dependency is significant enough that CERT-FR’s alert, updated on 16 October, advises operators to review insurance terms before disconnecting a contractor’s internet link. A data feed or connection may be part of the service agreement, with possible implications for monitoring duties or policy conditions. The financial protection may also be limited: brokers and underwriters told Reuters that cyber policies typically exclude physical losses. Intermarché told AFP that its policy did not cover this incident.

Operators need a current inventory of every route into each refrigeration controller: a store network, contractor VPN, cellular router or port forwarding rule, for example. If the answer lives only with the contractor, the retailer lacks a clear view of its own exposure.

The maintenance agreement can make that access accountable. It should identify approved remote connections, require access through a retailer-controlled gateway or VPN, tie accounts to named technicians and provide the retailer with logs. It should also set out how the contractor reports unsupported equipment and newly disclosed vulnerabilities, and how access can be revoked without disrupting refrigeration service. Controllers can remain in use for decades; their service contracts should reflect the security consequences of that lifespan.

Temperature alarms don’t explain why a system changed

Defrost is a normal refrigeration function, which is part of what makes a malicious or unauthorized defrost command difficult to distinguish from routine operation. In the second wave, setpoints were reportedly moved to values the cases could not reach. Some controllers can suppress temperature alarms during defrost and for a delay afterward, preventing scheduled cycles from triggering overnight alerts. That configuration can be sensible for routine maintenance, but it may also delay notice of a forced change. There’s no evidence establishing whether alarm suppression contributed to the French incidents; Coopérative U said alarms reached staff at most affected stores.

A temperature alert reports a process condition: a case is warming. It does not identify whether an authorized person caused that condition. The more useful signal is an unexpected change in operating mode or setpoint, especially outside a maintenance window. Several circuits changing together, or multiple stores served by the same contractor changing at the same time, should increase the urgency of the alert.

CERT-FR’s updated guidance specifically asks operators to review defrost schedules. That focus makes sense: checking the control configuration can reveal suspicious activity that a thermometer alone cannot explain. Some older controllers may not export useful event data. In those cases, an independent temperature logger can provide an early warning about the physical effect, provided it does not rely on the same controller.

An alert only helps if it reaches someone who can act. At 3 a.m., that might mean a store employee, an external refrigeration technician and a central operations desk. If responsibilities and call order aren’t written down, the first minutes can disappear while people work out who owns the response.

A refrigeration technician in the Gironde told Le Monde that his team reached a store near Bordeaux in time to prevent product loss. Schelcher said a minority of Coopérative U stores did not respond quickly enough. The reports point to a practical measure of readiness: the time between the first actionable warning and an intervention.

Operators can test that interval with an unannounced setpoint change on a test circuit. Alerts should cover remote changes that technicians haven’t scheduled, with extra weight for nighttime activity or simultaneous changes across circuits. Where the controller can’t provide those events, the contractor’s monitoring platform may be the only place that can spot patterns across its customer sites. An independent temperature logger offers a second source of warning. A written overnight call chain should name the people involved, and a drill should measure how long it takes someone with authority to reverse a change.

End-of-support equipment needs an owner and a replacement date

The attack has not been linked to known software flaws, but the systems deserve scrutiny. Claroty’s Team82 published three vulnerabilities in the AK-SM 800A in August and said they were fixed in firmware 4.3.1 or earlier. The researchers counted 2,765 of the model’s management interfaces reachable from the internet. Danfoss said most affected units were older AK-SM 800 and AK-SC 355 controllers, with some AK-SM 800A units running outdated firmware.

The older devices can’t receive new updates: Danfoss ended support for the AK-SM 800 in May 2021 and the AK-SC 355 in 2016. CERT-FR’s advice therefore starts with limiting exposure. Operators should remove AK-SM, AK-SC and XWEB controllers from the public internet, then provide access through a VPN or protected network. For compromised Danfoss equipment, the alert recommends restarting the device or, if needed, restoring factory settings and reconfiguring it before returning it to service.

A reset can remove an attacker’s persistence, but it doesn’t fix the weakness that made the equipment vulnerable. CERT-FR warned that the campaign was probably continuing. For equipment that remains supported, operators should check firmware and install current updates. For unsupported devices, replacement becomes a planning and budget decision: it takes engineering time and may require downtime, but leaving the decision without a named owner can keep it postponed indefinitely.

A useful register should record each controller’s model, firmware version and support status. Publicly reachable management interfaces should be taken offline promptly, while supported devices receive current firmware. For equipment beyond support, the organization should set a replacement date, assign an owner and fund the work. Security teams can explain the exposure, but the business owner needs to understand that accepting the risk also means accepting the possibility of product loss.

Turn readiness into something measurable

Available reports don’t show that a particular model or firmware version determined which stores lost stock. They do show that some teams received a warning and reached the equipment before the cold chain failed. That is an operational capability, and it can be measured through alert drills, access reviews and response times.

Sekoia told Reuters that cases were also reported in Spain, Portugal, Poland, Germany and Belgium. The same controller families are used in warehouses and pharmaceutical distribution, often with remote maintenance provided by contractors. Retailers and other operators can start with two checks: search Shodan or Censys for their own refrigeration management interfaces, then ask each contractor how it connects to their sites.

If the answer is a public IP address and a password, with no protected access path or clear record of who logged in, the operator has found a gap that should be addressed. The next useful number is how many minutes it takes a real person to detect an unexpected change and reach someone who can reverse it.