Coordinated OT attack on Danfoss refrigeration controllers hits hundreds of French supermarkets, causing fires and stock losses
A coordinated attack on the operational technology behind supermarket refrigeration hit hundreds of stores in France from the night of 11-12 October 2026. Intermarché/Netto reported at least 300 affected shops, Coopérative U more than 100 and Carrefour 80, with Monoprix, E.Leclerc and Auchan also reporting impacted stores. Per BFM TV, attackers remotely forced refrigeration units into continuous defrost cycles, raising temperatures to 50°C. Paris prosecutors said the attack also caused fires. No group has claimed responsibility, and there is no evidence of a ransom demand or data theft. Sekoia reports stores in Spain, Portugal, Poland, Germany and Belgium were also affected.
Technical Details
- The equipment was traced to Danfoss refrigeration management systems. Danfoss said most compromised units were legacy products that no longer receive updates, naming the AK-SM800 and AK-SC355 controllers, and said an affected AK-SM800 ran outdated firmware.
- ANSSI reportedly identified a vulnerability in Danfoss software. The article gives no CVE identifiers, but notes known flaws in the control software dating back to 2023, some rated critical, with patches available. In August, Claroty published research on authentication-bypass flaws in Danfoss systems.
- Reports suggest attackers may have used Shodan to locate exposed devices, some connected via 3G cards for remote monitoring.
- The exact access method is still unclear.
- Intermarché's CEO estimated losses of tens of millions of euros nationwide in a single day. Coopérative U said larger stores could each lose €180,000-200,000 in stock.
- The Paris prosecutor's cybercrime unit has opened an investigation, and ANSSI is coordinating with European counterparts.
Remediation
- Identify controllers and management interfaces reachable from the internet and remove unnecessary exposure.
- Upgrade or replace end-of-life Danfoss models, and apply available firmware and software updates.
- Replace default passwords, restrict remote access, and enable MFA where supported.
- Segment OT control networks from other networks and monitor for unusual changes in system behaviour.
- Inventory third parties holding remote access, and test the ability to switch to manual operation.
Linha do tempo
-
Coordinated OT attack on Danfoss refrigeration controllers hits hundreds of French supermarkets, causing fires and stock losses
ler a análise desta fonte ocultar
A coordinated attack on the operational technology behind supermarket refrigeration hit hundreds of stores in France from the night of 11-12 October 2026. Intermarché/Netto reported at least 300 affected shops, Coopérative U more than 100 and Carrefour 80, with Monoprix, E.Leclerc and Auchan also reporting impacted stores. Per BFM TV, attackers remotely forced refrigeration units into continuous defrost cycles, raising temperatures to 50°C. Paris prosecutors said the attack also caused fires. No group has claimed responsibility, and there is no evidence of a ransom demand or data theft. Sekoia reports stores in Spain, Portugal, Poland, Germany and Belgium were also affected.
Technical Details
- The equipment was traced to Danfoss refrigeration management systems. Danfoss said most compromised units were legacy products that no longer receive updates, naming the AK-SM800 and AK-SC355 controllers, and said an affected AK-SM800 ran outdated firmware.
- ANSSI reportedly identified a vulnerability in Danfoss software. The article gives no CVE identifiers, but notes known flaws in the control software dating back to 2023, some rated critical, with patches available. In August, Claroty published research on authentication-bypass flaws in Danfoss systems.
- Reports suggest attackers may have used Shodan to locate exposed devices, some connected via 3G cards for remote monitoring.
- The exact access method is still unclear.
- Intermarché's CEO estimated losses of tens of millions of euros nationwide in a single day. Coopérative U said larger stores could each lose €180,000-200,000 in stock.
- The Paris prosecutor's cybercrime unit has opened an investigation, and ANSSI is coordinating with European counterparts.
Remediation
- Identify controllers and management interfaces reachable from the internet and remove unnecessary exposure.
- Upgrade or replace end-of-life Danfoss models, and apply available firmware and software updates.
- Replace default passwords, restrict remote access, and enable MFA where supported.
- Segment OT control networks from other networks and monitor for unusual changes in system behaviour.
- Inventory third parties holding remote access, and test the ability to switch to manual operation.