Full Report
Following reports of cyberattacks on French supermarket refrigeration systems that disrupted hundreds of stores overnight from Oct. 11... The post French supermarket cyberattack exposes risks of unsecured remote access and legacy refrigeration systems appeared first on Industrial Cyber.
Analysis Summary
# Incident Report: French Supermarket Refrigeration Control Attacks (October 2026)
## Executive Summary
Between October 11 and 12, 2026, attackers manipulated remote-controlled refrigeration systems in French supermarkets, raising cold-room and freezer temperatures and extending defrost cycles, which delayed alarms and intervention. Roughly 300 Intermarché and Netto stores, about 100 Coopérative U outlets, 80 Carrefour stores, about 30 Monoprix locations, and several E.Leclerc stores were affected, and food was discarded across many sites. As of the article's October 16, 2026 publication, no French or European authority had attributed the attacks, and nationwide losses were expected to reach several million euros or potentially tens of millions.
## Incident Details
- **Discovery Date:** Not precisely stated. Reports emerged following the overnight disruption of October 11–12, 2026.
- **Incident Date:** October 11–12, 2026 (overnight)
- **Affected Organization:** Multiple retailers, including Intermarché, Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc. The article does not name a single victim organization.
- **Sector:** Retail / food distribution (supermarkets)
- **Geography:** France (stores across the country, including Gradignan in southwestern France)
## Timeline of Events
### Initial Access
- **Date/Time:** Overnight, October 11–12, 2026
- **Vector:** Not confirmed in the article. The article points to remote-access exposure of refrigeration controllers, including units reachable via public IP addresses, and to obsolete equipment that no longer receives security updates.
- **Details:** The article says the attack exploited refrigeration control software supplied by Danish company Danfoss. Affected products reportedly include the Copeland xweb, Danfoss AK-SC series, Danfoss AK-SM series, and Dixell xweb. Danfoss had issued security alerts in March and August 2025 for software vulnerabilities that could allow control of refrigeration systems. The article does not state whether these alerts were applied at the affected sites.
### Lateral Movement
- Not described in the article. The impact appears to have been reached through the refrigeration controllers' own control functions, and the article does not report movement across store or corporate networks.
### Data Exfiltration/Impact
- **Operational manipulation:** Attackers raised temperatures in cold rooms and freezers to as high as 50°C and extended defrost cycles from one hour to eight hours. Temperatures reportedly reached 80°C at one store.
- **Product loss:** Stores discarded fresh and frozen food. At an Intermarché in Gradignan, losses reached €21,000 at purchase value.
- **Store closures:** Some stores temporarily closed while staff cleared affected products to address food safety risks.
- **Data exfiltration:** None reported.
### Detection & Response
- **Detection:** Reports of the disruption surfaced after the overnight temperature anomalies, which were delayed by the extended defrost settings.
- **Response actions:**
- Affected stores disconnected refrigeration systems from networks as a precaution.
- Staff cleared products to prevent food safety risks.
- France's National Cybersecurity Agency (ANSSI) opened an investigation and issued an alert (CERTFR-2026-ALE-012).
- The Operational Technology Cyber Coalition (OTCC) published guidance.
## Attack Methodology
*The article does not provide a detailed attacker methodology. The entries below reflect only what is reported or clearly implied.*
- **Initial Access:** Likely through remotely accessible refrigeration controllers, some on public IP addresses. Specific method not disclosed.
- **Persistence:** Not reported.
- **Privilege Escalation:** Not reported.
- **Defense Evasion:** The extended defrost cycles reportedly delayed alarms and intervention. Whether this was deliberate evasion is not stated.
- **Credential Access:** Not reported. The article's guidance on changing default passwords suggests default credentials may have been a relevant risk factor, but this is not confirmed as the cause.
- **Discovery:** Not reported.
- **Lateral Movement:** Not reported.
- **Collection:** Not reported.
- **Exfiltration:** None reported.
- **Impact:** Manipulation of temperature and defrost control settings, resulting in spoiled food, store closures, and financial loss.
## Impact Assessment
- **Financial:** €21,000 in losses at one Gradignan store. Nationwide losses expected to total several million euros, potentially tens of millions. These are estimates reported in the article.
- **Data Breach:** None reported.
- **Operational:** Hundreds of stores affected, with food discarded, temporary closures, and refrigeration systems taken offline as a precaution.
- **Reputational:** Significant public attention in France, with media and regulator involvement and questions about food safety and retailer security practices.
## Indicators of Compromise
- **Network indicators:** None published in the article.
- **File indicators:** None published in the article.
- **Behavioral indicators:**
- Unexpected increases in cold-room or freezer temperatures (up to 50°C, with one reported case at 80°C)
- Defrost cycles extended beyond normal settings (one hour extended to eight hours)
- Suppressed or delayed temperature alarms
- Unexpected configuration changes to refrigeration controllers
- **Reference:** ANSSI alert CERTFR-2026-ALE-012 (cert[.]cyber[.]gouv[.]fr)
## Response Actions
**Containment**
- Disconnect affected refrigeration systems from networks.
- Remove internet exposure of affected units and any other units reachable on public IP addresses.
- Check contractual insurance conditions before cutting data transmission to the refrigeration service provider.
**Eradication**
- Review the full configuration, including defrost ranges.
- If equipment is compromised, perform a factory reset.
**Recovery**
- Restore access only through a secure VPN or protected network.
- Use source-IP filtering of service provider addresses on firewalls only as a short-term emergency measure.
- Reconfigure equipment before returning it to service.
- Apply manufacturer guidance, including firmware updates, Strict security mode, and changing default passwords (per Danfoss recommendations).
## Lessons Learned
- **Key takeaways:**
- Internet-exposed operational technology controllers are a significant risk, particularly in retail environments with many distributed sites.
- Obsolete equipment that no longer receives security updates creates persistent exposure.
- Patch advisories (Danfoss alerts from March and August 2025) must be tracked and applied across all sites.
- Safety-related settings, such as defrost ranges and alarm thresholds, need monitoring and independent alerting.
- **What could have been done better:**
- Removing internet exposure of remote controllers before the incident.
- Replacing or isolating legacy units that cannot be patched.
- Changing default credentials and enforcing secure remote access.
- Monitoring temperature trends and configuration changes with alerts that do not depend on the controllers themselves.
## Recommendations
- **Eliminate direct internet exposure** of refrigeration and other OT controllers. Require access through a secure VPN, jump host, or protected network with multi-factor authentication.
- **Inventory all refrigeration controllers** across sites, including model, firmware version, and public IP exposure. Prioritize obsolete units for replacement or compensating controls.
- **Apply vendor security guidance**, including firmware updates, Strict security mode, and removal of default passwords.
- **Monitor safety-critical parameters** (temperatures, defrost cycles, alarm states) with independent alerting that cannot be silenced through the controller itself.
- **Establish out-of-band alerting** so that temperature excursions reach staff even if controller alarms are delayed or disabled.
- **Review third-party service provider access** and require contractual security controls, logging, and incident notification.
- **Develop an OT incident response playbook** for food-safety-critical systems, including stock disposal procedures, store closure criteria, and coordination with regulators such as ANSSI.
- **Review insurance coverage** for operational technology incidents and clarify the contractual conditions that affect remediation decisions.