Danfoss · Breach

CERT-FR widens alert: attack heated fridges in about 400 French supermarkets

Oct 10, 2026 · 1 min read

Attackers took over internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers and forced fridges to 50C for six hours, according to Intermarché. About 400 stores in France were hit, with food discarded, small fires and losses estimated in the millions of euros; CERT-FR has expanded its alert to the Copeland/Dixell models. End-of-life units will get no fix: remove internet exposure, update the AK-SM 800A, enable Strict mode and change default passwords.

By HIFY Radar newsroom Updated 10/26/2026 01:34 PM Get this every day →← Back to the feed 11 sources

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Attackers remotely took over supermarket refrigeration systems in France and forced fridges to heat to 50C overnight, according to Intermarché. About 400 stores of chains such as Intermarché, Coopérative U, Carrefour and Monoprix were hit, with food losses, small fires and a cybercrime investigation opened by the Paris prosecutor's office. CERT-FR has issued an alert and expanded the list of affected controllers.

Why it matters

Fresh and frozen food had to be discarded to avoid health risks; two stores in Alsace reported 270,000 euros in losses. End-of-life cold-chain remote management gear will never be patched, so replacement is the only option for those models. The case also shows OT equipment installed by facilities contractors often escapes security oversight.

What to do

Disconnect every refrigeration controller with a public IP from the internet; reconnect only through a secure VPN after reviewing the configuration. Update Danfoss AK-SM 800A firmware, set security level to Strict and change default passwords. Plan replacement of end-of-life models (AK-SM 800, AK-SC 355, XWEB EVO).

For the technical team

Affected: Danfoss; Copeland/Dixell Controladores de refrigeração Danfoss AK-SM / AK-SC e Copeland/Dixell XWEB · Danfoss AK-SM 800 (end of life since 2021, no fixes); Danfoss AK-SC 355 (phased out 2016, no fixes); Danfoss AK-SM 800A on outdated firmware; Copeland/Dixell XWEB EVO (end of life, no security patches); Dixell XWEB version 1.12.1 or older.
Exploitation: In-the-wild attack reported by CERT-FR (CERTFR-2026-ALE-012), start date 2026-10-11. Victims: Intermarché/Netto (180 stores per BBC, about 150 per Guardian), Coopérative U (over 100), Carrefour (80 of 6,000), Monoprix (5% of its 400-plus stores); E.Leclerc per BFMTV, unconfirmed. No CVE, PoC or attribution cited; Paris prosecutors and ANSSI investigating.
Fix: No fix for end-of-life units: remove internet exposure and replace them (CERT-FR). AK-SM 800A: update to current firmware, security level Strict, change default passwords. Dixell XWEB: upgrade systems on 1.12.1 or older, change weak or default passwords and enable password policies. CERT-FR: disconnect public-IP systems and reconnect via secure VPN after verifying configuration, restoring factory defaults if necessary; emergency IP filtering limited to supplier addresses, not for long-term use.
Vector: Refrigeration controllers reachable from the internet with public IP addresses (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB). Attackers logged into exposed control panels running outdated firmware and default passwords, then triggered forced defrost keeping units hot (50C for six hours, per Intermarché). ANSSI identified a vulnerability in Danfoss software, per The Guardian.
More details: Danfoss said it is aware of incidents in France affecting a limited number of systems and that affected units were running outdated firmware. PM Sébastien Lecornu instructed ANSSI to investigate and France is coordinating with European counterparts. Ahold Delhaize reported a separate security issue with no confirmed link to this attack. Tom Hegel (SentinelOne) says thousands of these interfaces remain online, expects more incidents, and notes exposed control panels leave almost no forensic trace.