On the night of October 11 to 12, 2026, refrigeration systems in hundreds of French supermarkets were compromised by cyber attackers. The intruders pushed the units into 'defrost' mode—a state where cooling components are heated to melt ice—causing some equipment to reach temperatures as high as 50°C (122°F). The attack resulted in significant losses, with several retail chains reporting that they were forced to discard large quantities of fresh and frozen food. Major retailers including Carrefour, Intermarché, Netto, and Monoprix confirmed they were affected, with some chains reporting hundreds of stores impacted.

The primary hardware involved in the breach consists of refrigeration controllers manufactured by the Danish company Danfoss. Specifically, the attack targeted the AK-SM 800 and AK-SC 355 models, both of which are considered legacy equipment. Danfoss declared the AK-SM 800 end-of-life in 2021 and phased out the AK-SC 355 in 2016, meaning these units no longer receive security updates or software support. While some newer AK-SM 800A models were also affected, they were running outdated firmware that lacked critical security patches released in 2023 and 2025.

Data analysis indicates that these systems were vulnerable to the public internet long before the attack occurred. Internet scans conducted in early October 2026 showed that France had more exposed fridge dashboards online than the rest of the world combined, with 85% of those dashboards running software with known security flaws. Many of these systems remained at the same internet-facing addresses for at least six months prior to the incident. Following the attack, a significant majority of these dashboards were taken offline, suggesting that retailers reacted by disconnecting the controllers from the public internet to prevent further unauthorized access. French cybersecurity agency CERT-FR has advised operators to disconnect these controllers or restrict access to secure private networks (VPNs).

A chart illustrating the prevalence of exposed refrigerator dashboards in France.
Data analysis revealed that France had a disproportionately high number of exposed fridge dashboards compared to the rest of the world.ipinfo.io

The chart visualizes the high concentration of internet-exposed refrigeration systems in France prior to the cyber attack.

A timeline showing how long refrigeration dashboards remained open to the public internet.
Many of the compromised systems remained accessible on the public internet for at least six months before the incident occurred.ipinfo.io

This timeline highlights the prolonged period of vulnerability for the targeted refrigeration controllers.