Skip to main content

French Supermarket Fridge Attack: What Our Data Shows and What It Means for You

Monadnock Cyber

Monadnock Cyber Intelligence and Analysis · 13 October 2026

On the night of Oct. 11–12, attackers hijacked refrigeration controls in hundreds of French supermarkets, heated display cases to 50°C (122°F) and destroyed the stock. The warning was public 52 days earlier. The threat extends beyond one manufacturer. For U.S. organizations, the greater risk is not exposed equipment but the contractors who service it: the same door attackers used against Target in 2013. This time they came to break things, not to steal.

Exterior of an Intermarché Super supermarket in Remollon, France

An Intermarché supermarket in Remollon, France, in 2014. Intermarché reported about 300 stores hit in the attack; this photo predates it and does not show an affected store. Editorial credit: Alastair Wallace / Shutterstock.com

What happened

About 300 Intermarché and Netto stores were hit, along with 80 Coopérative U, 80 Carrefour, about 30 Monoprix and "several" E.Leclerc stores (The Hacker News, BleepingComputer).

The attackers turned the equipment against itself. Cooler controllers periodically warm the coils to melt ice. The attackers switched that defrost cycle on, left it on and raised the temperature.

The controllers are made by Danfoss. Danfoss says most were older models, the AK-SM 800 and AK-SC 355, that no longer receive security updates. Some newer AK-SM 800A units running outdated software were also hit (franceinfo). On Oct. 12, CERT-FR, France's national cyber emergency team, reported "numerous" compromises and told operators to take the controllers off the internet. The Paris prosecutor is investigating.

Our key judgments

1. France was the bullseye. Of 4,635 Danfoss web interfaces reachable from the internet on Oct. 13, 2,902 (63%) were in France. South Africa followed with 525, then the U.S. (143), Portugal (140), Belgium (115) and Poland (113). Source: Monadnock Cyber count using Shodan, a search engine for internet-connected devices.

2. The warning was public 52 days before the attack. On Aug. 20, Zscaler reported flaws Danfoss had fixed in 2025, cited a U.S. government (CISA) advisory, counted 3,726 exposed Danfoss interfaces and used a supermarket chain as its example of an operator at risk. We collected it that day.

Assessment: The newer AK-SM 800A had a fix for more than a year. The older models, which made up most of those hit, have none; the only defense is disconnecting or replacing them. The risk was known. No one has confirmed the attackers used those 2025 flaws.

3. It is not just Danfoss. On Oct. 13, an E.Leclerc store in Lescure-d'Albigeois lost refrigeration and discarded its stock. Reports say it uses Dixell equipment (France 3 Occitanie). Dixell has not confirmed a compromise.

Assessment: Coverage that names only Danfoss likely understates the scope. Treat every internet-connected refrigeration controller as at risk until the entry method is known.

4. U.S. exposure is low. The contractor risk is not. We found 143 Danfoss interfaces and 12 Copeland/Dixell XWEB controllers reachable from the U.S. (XWEB worldwide: 7,151, mostly in Italy, Greece and Israel.) Intermarché blamed a compromised service provider that manages its refrigeration (BleepingComputer). Its parent group, Les Mousquetaires, said the systems were managed by Danfoss (Bloomberg). Danfoss has not confirmed this, and no contractor has been publicly named. The leading alternative: attackers logged in directly to controllers exposed on the internet, possibly through built-in maintenance access, with no provider breached.

Assessment: The evidence leans toward Danfoss, or a Danfoss-run service, as the managing provider for at least Intermarché's stores. If the single point of failure was the manufacturer's own remote-management service, the U.S. lesson widens: the question of who can reach your systems must include the equipment maker, not just the installer. Either way, the larger U.S. risk is a provider with always-on remote access. That path works whether or not the equipment faces the internet.

The pattern is not new. In 2013, attackers most likely phished Fazio Mechanical Services, Target's heating and refrigeration contractor. They used its vendor-portal login to reach Target's checkout systems and exposed some 40 million card accounts (Senate Commerce Committee). In France, the refrigeration itself appears to have been the target.

Assessment: Thirteen years later, contractor access to building systems is still the open door. Attackers now use it to cause damage, not only to steal.

5. No one has claimed it. No affected company appears on the ransomware leak sites we track, and we found no earlier underground discussion of these controllers.
Assessment: No ransom and no data theft. This is likely disruption, not extortion.

What we don't know

  • Who did it. Nothing has been attributed.
  • How they got in, and whether the 2025 flaws were used.
  • How far it spread. A Sekoia analyst reported affected sites in Spain, Portugal, Poland, Germany and Belgium (The Hacker News).

What to do this week

  1. Take inventory. Have your facilities staff and vendors list every refrigeration, heating, cooling and building-control system reachable from outside the building, and who can reach each one: the installer, a service contractor or the equipment maker itself.
  2. Close the open door without locking out your contractor. The computer that runs your coolers has its own login page. In the attacked stores, anyone on the internet could reach it. Only people in the building, or your contractor over a private, locked connection, should. Your contractor or IT provider does the work. Ask them four questions:
    • "Can our refrigeration controls be reached from the internet?" A router change often fixes it. Some controllers bypass the router through their own cellular modem or line. Units that no longer get security updates may need replacing.
    • "How do you connect to our systems?" Only through a private connection that requires a password and a second step. Never through an open web page.
    • "Who at your company can log in, and when?" One account per technician. Access switched on only when needed. A written commitment to notify you within 24 hours of a breach. Ask the same of the manufacturer if it runs the remote service.
    • "Can we verify it's closed?" Use an independent outside check, not the people who made the change.
    • Don't just unplug it. That connection often carries temperature alarms, and your service contract or insurance may require it. Check both first. Move the contractor to a secure connection; don't cut them off.
  3. Check the settings, especially defrost schedules and temperature limits. In France, the attackers changed settings, not hardware.
  4. Update and lock down. Install current firmware, set Danfoss units to Strict security mode and change default passwords. Replace units that no longer receive updates.

Can you answer question one today?

Most organizations cannot. Outside vendors install and maintain the systems that run your building, and those systems rarely appear on a security inventory. Monadnock Cyber finds them, maps who can reach them and hardens them without disrupting operations.

For more information, or for help hardening your own environment, contact Monadnock Cyber at monadnockcyber.ai or 1-888-299-6615.

Sources and references

Monadnock Cyber LLC · At the intersection of AI and Security

Labels:

Comments

Post a Comment

Popular posts from this blog

Am I a Target? Daily Cyber Brief MONADNOCK CYBER • Monday, September 21, 2026

Am I a Target ? Daily Cyber Brief MONADNOCK CYBER  •  Monday, September 21, 2026  •  At the intersection of AI and Security What happened in cyber in the last 24 hours — verified, graded, and stripped of hype. Confirmed facts and unverified claims are labeled throughout. ● Foreign desk · raw & unevaluated China Desk: what Beijing is saying about cyber today New this week: we’re pulling foreign-language coverage into collection. This is a first, unfiltered look — machine-translated, not yet source-graded, and it includes Chinese state media. Read it as raw signal, not a finished assessment. China is running its annual National Cyber Security Awareness Week (launched September 14, nationwide). This year’s theme centers on the “intelligent era” — AI security (“智能时代 网安护航”). Coverage across state and commercial outlets (China.com.cn [1] , Guangming, Baidu) carries these themes: AI at machine speed. A widely-run piece frames it as the “attack-and-defense battle” of ...
Post a Comment
Read more

Above the Fold What foreign press tells its own public · a Monadnock Cyber summary

  Above the Fold What foreign press tells its own public · a Monadnock Cyber summary 26 September 2026 · ATF-2026-09-26 · TLP:CLEAR Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation. Global Cyber Weather Report · 26 September 2026 OUTLOOK Expect increased volatility driven by AI-enabled attacks and persistent state-sponsored activity. CONDITIONS NOW Ransomware activity remains high with 235 incidents in the last seven days. Clop, thegentlemen, and qilin are the most prolific crews. A cross-cutting signal indicates AI is integrated into attacks, specifically for autonomous skimming of payment ca...
Post a Comment
Read more

Above the Fold | What foreign press tells its own public | A Monadnock Cyber summary 24 September 2026 ·

  Above the Fold What foreign press tells its own public · a Monadnock Cyber summary 24 September 2026 · ATF-2026-09-24 Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation. In this issue 01   Iran   From data theft to sabotage: Iran's banks under service-disruption attacks 02   Russia   Under siege, wearing an AI mask: NightEagle and AI-crawler disguise 03   China   National Cyber Security Week: AI Safety Governance Framework 3.0 04   European Union   Cutting the cord: Europe moves to wean its governments off US clouds 05   Brazil   Braz...
Post a Comment
Read more