How a French Supermarket Fridge Attack Became a Physical Cyber Crisis

Picture the early shift at a French supermarket on October 12, 2026. The freezer doors are closed, but the temperature is climbing. Staff start moving fresh and frozen products out of the cases—not because a compressor failed, but because commands sent to the refrigeration system changed overnight.

During the night of October 11–12, attackers forced refrigeration controls at supermarkets across France into defrost behavior. Defrost is normally a maintenance cycle that warms a cooling coil long enough to melt built-up ice. In this incident, some equipment reportedly reached 50°C, fires were reported, and stores had to discard food. By October 17, public reporting put the number of affected stores above 700. As of October 20, 2026, the attacker and exact entry path remained unknown. (apnews.com)

The dashboard was the real attack surface

The striking part is that the target was not a consumer smart appliance. It was a commercial refrigeration control system: a computer that coordinates sensors, compressors, fans, alarms, and defrost schedules across a store. An industrial control system, often shortened to ICS, is software and hardware that monitors or changes a physical process. Here, a web dashboard gave technicians a way to view and manage that process remotely.

A pre-attack scan from October 6–7 found 2,528 public IPv4 addresses showing a Danfoss StoreView dashboard. IPv4 is the most common system for assigning addresses on the Internet. France accounted for 1,331 of those addresses, while every other country and territory in the scan accounted for 1,197 combined. These are addresses, not confirmed store counts: one location can have more than one address, and not every address maps neatly to a single supermarket. Even with that limitation, the imbalance is hard to miss. (ipinfo.io)

The basic shape looked something like this:

public Internet
 |
store router or firewall
 |
web dashboard / system manager
 |
refrigeration controllers
 |
sensors, compressors, fans, defrost hardware

A dashboard being reachable does not prove that attackers broke into it. It does mean the control surface could be contacted from outside the store. Once the dashboard sits between the Internet and physical equipment, a web security problem can become a temperature problem.

Why defrost can cause real damage

Defrost is not a malicious feature. Ice naturally forms on cooling components, and a controlled defrost cycle removes it so the system can keep working. The danger comes from changing the timing, duration, or temperature settings without authorization.

This is what makes the incident cyber-physical. A cyber-physical system connects digital commands to something in the real world: heat, pressure, motion, electricity, or temperature. The attacker did not need to steal a customer database. Changing a setting in the control layer was enough to affect food, equipment, and store operations.

Old firmware made the exposure persistent

The scan also revealed a long-running software lifecycle problem. Firmware is the software built into a device, and it often stays in service far longer than a normal office application. Of the 1,331 French dashboards, 1,136—or 85%—were running software with known security flaws. That group included 527 older controllers that Danfoss no longer supports. Only 195 showed every known fix.

France was not dramatically worse at applying patches than the rest of the world. The flawed share elsewhere was about 84%. France stood out because far more of these systems were exposed online in the first place. The same pattern had been visible for months: 1,019 of the French addresses found in October were present at the same addresses on March 30. Among newer controllers, the share with every known fix rose from only 14% to 24% during that period. The data does not prove which vulnerability attackers used, but it shows that the opportunity was not created overnight. (ipinfo.io)

Danfoss product material places the AK-SM 800 on an end-of-life path in 2021 and lists the AK-SC 355 among products phased out in 2016. End-of-life equipment may continue running for years, but it no longer receives the updates needed to respond to new threats.

The newer AK-SM 800A also had security issues addressed through later releases. Researchers disclosed CVE-2025-41450, a public identifier for a known vulnerability involving authentication bypass, along with command-injection issues that could allow unintended operating-system commands after access was obtained. Danfoss listed fixes in versions 4.2 and 4.3.1. Those disclosures do not establish that the French attackers used those exact flaws, but they explain why an Internet-facing, outdated management interface deserves urgent attention. (assets.danfoss.com)

Why remote access stayed open

Remote access exists for a sensible reason. Refrigeration contractors need to receive alarms, inspect temperatures, and diagnose equipment without sending a technician to every store. Many retailers also rely on outside companies to install and maintain the systems, so the supermarket may not own every part of the network path.

That arrangement creates a familiar blind spot. The refrigeration controller may be physically inside a store, but its Internet exposure can be managed by a contractor, a telecom provider, a facilities team, and a central IT department. Each group sees one piece of the system. The full attack surface can remain unowned.

France’s national cybersecurity agency, CERT-FR, warned that direct Internet exposure was contrary to good practice. Its updated alert, dated October 16, advised operators to remove public access, use a secure virtual private network—a private encrypted tunnel—for remote service, update firmware, enable Danfoss Strict security mode, and replace default passwords. It also warned that attack campaigns might still be active. (cert.cyber.gouv.fr)

A safer arrangement for remote service

Remote maintenance does not need to disappear. It needs a boundary between the technician and the controller.

1. Inventory every exposed control panel. Include refrigeration, heating, building automation, cameras, and other equipment that may not appear in the central IT inventory.
2. Remove direct public access. Put the controller behind a firewall and a protected maintenance gateway. A source-IP allowlist can reduce risk during an emergency, but it is not a lasting replacement for a secure remote-access design.
3. Use supported software. Patch current controllers, replace end-of-life models, change unique passwords, and keep configuration backups. Firmware age should be tracked like the age of a server.
4. Separate viewing from changing. Read-only monitoring can be available to more people, while temperature, defrost, and safety settings require stronger authorization and an audit trail.
5. Plan for compromise. Disconnect affected units, inspect defrost schedules and other settings, reconfigure them carefully, and coordinate recovery with the vendor or incident-response team. A factory reset alone is not enough when the same unsupported device remains exposed.

The French supermarket attack matters because it did not need ransomware, stolen payment cards, or a spectacular data breach. A remote command changed temperature, and a digital weakness became spoiled inventory, damaged equipment, and public disruption.

The durable lesson reaches beyond refrigeration. Any connected controller that can heat food, stop a freezer, open a door, or silence an alarm is production infrastructure. It needs an owner, a supported lifecycle, restricted remote access, independent monitoring, and a safe way to fail.