French Supermarket Refrigeration Attack Exposes Gaps in Contractor Access and OT Response
The October attacks on French supermarkets exposed a weakness that sits between operational technology and routine maintenance: refrigeration systems can be remotely managed by contractors, while store operators bear the cost when that access is abused. The practical divide was stark. Some stores lost their stock; others got a warning and intervened in time.
On the night of 11 October, someone remotely switched cold cases at several hundred Intermarché and Netto supermarkets into defrost. Refrigerators and freezers reportedly reached about 50°C and stayed there for roughly six hours. Les Mousquetaires, the group behind the stores, expects losses in the tens of millions of euros. Staff were left discarding meat, frozen food and vegetables.
Coopérative U reported that 80 of its roughly 2,000 stores were affected. Chief executive Dominique Schelcher told RTL that most stores kept their cold chains intact. A smaller group reacted too late and lost stock; store employees and refrigeration contractors helped limit the damage elsewhere. Intermarché said affected stores had to discard everything. A second attack wave, on the night of 12 to 13 October, reached stores using Dixell controllers as well.
Those different outcomes point to an operational question more useful than speculation about the attackers’ motive: how quickly can a store detect an unauthorized change and get someone with the authority to reverse it? No group has claimed responsibility, and no ransom demand has emerged. Investigators have not established how the attackers got in. Exposed management interfaces, known software flaws and stolen contractor credentials remain possible routes, according to the source reporting. The response lessons hold regardless.
Contractor access is part of the store’s security boundary
Supermarkets often buy refrigeration equipment and support from contractors, rather than directly from the controller manufacturer. Schelcher said Coopérative U stores do not buy from Danfoss. Their refrigeration contractors provide and configure the controllers, then retain remote access to adjust settings without travelling to each site. E.Leclerc told AFP that the attack reached its stores through a refrigeration equipment supplier. The controllers’ embedded web servers serve this kind of remote maintenance, and contractors may depend on the data feed for performance guarantees.
That arrangement can make maintenance faster, but it also gives a supplier access to systems that control valuable inventory. A contractor may favor a public IP address because it makes a quick remote adjustment easy. The store absorbs the loss if that path is misused. Unless the agreement spells out who can connect, how they connect and what happens when support ends, the operator may not know what access it has effectively granted.
This is not the first reported targeting of these systems. Danfoss’s October 2025 technical newsletter describes attacks on AK-SM 800 controllers in 2022, affecting 16 Russian supermarkets and 40 stores in Israel. The newsletter says all 40 Israeli sites lacked proper firewall or VPN protection. The AK-SM 800 had been out of support since May 2021, yet the same model was still exposed to the internet in France four years later.
The dependency reaches into contracts as well as networks. CERT-FR’s alert, updated on 16 October, advises operators to review insurance terms before severing an internet connection to a refrigeration contractor. Remote data feeds may be part of monitoring obligations or policy conditions. Meanwhile, brokers and underwriters told Reuters that cyber policies typically exclude physical losses. Intermarché said its insurance does not cover this incident.
Operators need a current inventory of every remote route into refrigeration equipment: the store network, a contractor VPN, a cellular router or a port forwarded through the store router. Maintenance agreements should identify permitted routes, require access through an operator-controlled gateway or VPN, tie accounts to named technicians, provide access logs and require notice when equipment loses vendor support or a vulnerability is disclosed. They should also define how access can be revoked while keeping refrigeration service available.
Watch for commands, not just rising temperatures
Defrost is a standard refrigeration function, but a legitimate feature can still cause damage when someone triggers it without authorization. The second wave reportedly included setpoints pushed to values the cases could not reach. Many controllers can also suppress temperature alarms during defrost and for a delay afterward, preventing routine cycles from waking staff overnight. That setting is sensible for scheduled maintenance, but it can also make a forced cycle harder to catch. The available reporting does not establish whether alarm suppression contributed to the French incidents. Coopérative U’s experience indicates that alarms did reach people at most affected stores.
A temperature alarm says the product is warming. It does not explain why, or whether the command came from an authorized technician. The stronger signal is an unexpected change to a mode or setpoint, especially outside a maintenance window. Several refrigeration circuits changing at once, or multiple stores served by the same contractor changing together, should raise the priority further. CERT-FR’s revised alert specifically tells operators to review defrost schedules.
Some controllers may not export the events needed for that monitoring. Where they cannot, an independent temperature logger can provide a separate warning about the result. But an alert only helps if someone receives it, understands it and can act. The overnight chain may involve a store employee, an external technician and a central operations desk. If nobody knows whom to call, response time gets spent sorting out responsibility.
A refrigeration technician in Gironde told Le Monde that his team reached a store near Bordeaux in time to prevent any disposal. Schelcher said a minority of Coopérative U stores lost stock because they reacted too slowly. The reported difference was the time between an actionable warning and intervention.
Operators can measure that interval. Alert on unannounced remote changes, with higher urgency for overnight activity or coordinated changes across circuits. Use the controller where it supports event reporting and the contractor’s monitoring platform where it does not. Keep a temperature logger off the controller’s network, document a named overnight call chain and run a test: ask the contractor to change a setpoint on a test circuit and record how long it takes for an authorized person to reverse it. That response time gives management a concrete measure of readiness.
Unsupported equipment needs a replacement plan
Claroty’s Team82 published three flaws in the current AK-SM 800A model in August and said all were fixed in firmware 4.3.1 or earlier. The researchers counted 2,765 of the model’s management interfaces reachable from the internet. No evidence links those flaws to the supermarket attacks. Danfoss says most affected units were older AK-SM 800 and AK-SC 355 controllers, with some AK-SM 800A units running outdated firmware.
For the older models, patching is no longer an option. Danfoss ended updates for the AK-SM 800 in May 2021 and the AK-SC 355 in 2016. CERT-FR advises operators to remove AK-SM, AK-SC and XWEB controllers from the public internet, then restore access through a VPN or protected network. For compromised Danfoss equipment, the alert recommends a restart or, if that fails, a factory reset and reconfiguration before returning the device to service. A reset removes persistence but does not fix the underlying vulnerability; CERT-FR warns the campaign may still be active.
The immediate work is to list each controller by model, firmware and support status. Publicly reachable management interfaces should be removed from the internet, and supported devices should receive current firmware. Unsupported units need an assigned owner, a replacement date and a budget. Replacing a controller costs money and may require engineering work and downtime, so the decision can stall unless a business leader is accountable for accepting the risk or funding the change. In this case, that risk includes spoiled stock that may not be insured.
Nothing in the reporting proves that hardware or firmware differences explain which stores kept their products cold. What is documented is that some warnings reached people who could intervene before the cold chain failed. That capability can be tested ahead of time. Sekoia told Reuters that cases were also reported in Spain, Portugal, Poland, Germany and Belgium. The same controller families are used in warehouses and pharmaceutical distribution, often under similar contractor arrangements.
For operators, two steps can quickly reveal the shape of the problem: search Shodan or Censys for exposed refrigeration management interfaces, then ask the contractor how it reaches each site. The answer should identify a controlled route, named access and a response process. If it instead depends on a public address and a password, the gap is already visible—and the response plan needs to start there.
