Summary

• Reuters counted at least 350 affected supermarkets. Les Mousquetaires, which runs Intermarché and Netto, reported at least 300 of its stores hit.
• The attackers did not steal data or demand a ransom. They changed refrigeration settings so units heated instead of cooling, and food had to be thrown away.
• Danfoss said many affected units had reached end of life and no longer receive security updates, or were running outdated firmware.
• Losses are estimated in the millions of euros. Two stores in Alsace alone reported about 270,000 euros of discarded stock.
• The Paris prosecutor’s office opened an investigation, and France’s national cybersecurity agency, ANSSI, is coordinating with other European agencies.

Danfoss AK-SM 800A administration panel kiosk remote access

What happened in the French supermarket refrigeration attack?

Attackers reached the Danfoss controllers that manage store refrigeration and changed their configuration. Units were switched to a continuous defrost cycle, which heats the coils, and temperatures rose for several hours before staff arrived on Monday morning.

Les Mousquetaires said its units were heated to as much as 50°C. One photo from an affected store showed an ice cream shelf at 26°C. The investigation also covers equipment that began to catch fire.

The scale is still being counted. Reports from AFP, Reuters and the chains themselves name the stores below:

No group has claimed the attack and there has been no ransom demand, which investigators have called unusual. A threat intelligence analyst told Reuters that stores in Spain, Portugal, Poland, Germany and Belgium were also affected, without giving details.

Danfoss AK-SM 800A administration panel

Why were the Danfoss controllers vulnerable?

The controllers were reachable from the internet, and many could not be patched. That combination turns a refrigeration system into a remote target.

Three Danfoss product lines are involved:

In August 2026, researchers at Claroty’s Team82 reported flaws in the AK-SM 800A, including an authentication bypass in versions before 4.2 (CVE-2025-41450) and a command injection that can lead to remote code execution (CVE-2025-41451), fixed in version 4.3.1. Claroty found thousands of these management interfaces reachable from the internet. Authorities have not confirmed which flaw, if any, was used in the French attack.

Why does this attack matter beyond supermarkets?

Any business that runs connected equipment can lose physical operations, not just data. Refrigeration, heating, ventilation, building access and production lines often run on operational technology (OT) controllers that were installed years ago and never updated.

Supermarkets have been hit this way before. In 2022, attackers targeted 16 supermarkets in Russia and 40 stores in Israel; the Israeli stores had no firewall or VPN in front of their systems.

OT is also often managed by outside maintenance companies with remote access. Each of those connections is a path an attacker can use if it is exposed or poorly secured.

How can retailers protect refrigeration and other OT systems?

Keep management interfaces off the public internet and patch or replace what you cannot. These steps follow guidance from Danfoss and CERT-FR, the French government’s computer emergency response team:

1. Disconnect or filter. Take AK-SM and AK-SC controllers off the internet, or limit access to trusted IP addresses as a temporary measure.
2. Update supported units. Move AK-SM 800A controllers to current firmware. Version 4.3.1 or later fixes the Claroty flaws; units on 3.x must move to 4.x before going further.
3. Replace end-of-life models. AK-SM 800 and AK-SC 355 units get no fixes and should not be reachable from any external network.
4. Route remote access through one managed entry point, such as a VPN with multi-factor authentication (MFA), and limit it to named service providers.
5. Change default passwords when equipment is installed.
6. Separate OT from other networks, so refrigeration, HVAC and point-of-sale systems cannot reach each other.
7. Alert on unsafe commands. A fridge set to heat to 50°C should page a person immediately.

If a controller was compromised, CERT-FR recommends this order: restrict access to service providers, factory reset, apply all fixes, change all secrets, review accounts and reconfigure the system fully.

What scams can follow an attack on a retailer?

Big incidents give scammers a story. After an attack like this, expect fake refund or compensation offers, fake vouchers “to apologize for the disruption” and fake food safety recall messages that use the retailer’s name to collect card details or logins. Retailers can warn customers through official channels and state clearly that they will not ask for payment details by email or text. Retail and E-Commerce accounted for 5.2% of confirmed brand impersonation cases in PhishFort’s Digital Threat Intelligence Report for January to June 2026 (PhishFort internal data).

How PhishFort helps retailers after an incident

PhishFort Brand Protection for retail detects and takes down fake shops, fake promotions, and impersonator accounts that use a retailer’s name to collect card details from its customers.

Frequently asked questions