The claim. “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented.” Dominique Schelcher, chief executive of Coopérative U, October 12, 2026.
The record. “Forty stores were hacked. All affected stores lacked proper firewall or VPN protection, and all used AK SM 800.” Danfoss customer bulletin, October 31, 2025, describing Israel in 2022.
Overnight on Sunday, someone reached into the refrigeration controllers of hundreds of French supermarkets and switched on the defrost cycle. Cabinets built to keep food frozen climbed as high as 50 degrees Celsius, several stores reported fires, and Intermarché’s chief executive put the damage at “tens of millions of euros nationwide in a single day.” The retailers have settled on one word for it, unprecedented, and most coverage has repeated it. The manufacturer’s own paperwork says otherwise. A bulletin Danfoss sent customers on October 31, 2025 lists two earlier waves of store hacks through the same controller, says that controller reached end of life in May 2021, and announces that the company is ending all service on it. That document settles who was warned. It will help settle who pays.
What Happened Overnight
The Paris prosecutor’s office opened an investigation on Monday into what it called a “large-scale” attack “affecting connected refrigerators in several major food retailers across France.” Les Mousquetaires, the group behind Intermarché and Netto, counted about 150 stores where cabinets sat at 50 degrees for six hours. Carrefour said 80. Coopérative U reported roughly 100, Monoprix about 5% of its 490 shops, and E.Leclerc several.
It was planned. Time’s reconstruction has the attackers stretching the defrost cycle from one hour to eight, which delayed the alarms, and one Intermarché recording 80 degrees, hot enough to melt equipment. Prime Minister Sébastien Lecornu ordered the national cybersecurity agency, ANSSI, to investigate. Sekoia analyst Felix Aime said stores in Spain, Portugal, Poland, Germany and Belgium were hit as well.
The Bulletin From October 2025
Danfoss, the Danish company that makes the controllers, said this week that the affected units “were running outdated firmware.” It told AFP that most were legacy products that no longer receive software or security updates, and it named two: the AK-SM 800 and the AK-SC 355. Both statements are true. Neither tells you how long the company had been saying so.
The bulletin does. Under the heading “End of service and end of life for multiple products,” Danfoss wrote that the AK-SM 800 “was officially declared End of Life in May 2021” and that the SC 355 was “phased out in 2016.” Then it offered what it called real world examples. “Russia, 2022: Sixteen supermarkets using AK SM 800 were targeted by cyberattacks at the start of the war.” Israel, the same year: forty stores, none with a proper firewall or VPN, every one of them on the AK SM 800. The recommended action in both cases was to replace the unit.
Fifty-six stores, four years ago, on the same box.
Seven Years of Notice
The bulletin is one entry in a longer file.
- February 2019: TechCrunch reported that refrigeration systems at supermarkets and hospitals, run on controllers from Britain’s Resource Data Management, could be defrosted remotely by anyone who typed in a default password.
- May 2021: Danfoss declares the AK-SM 800 end of life.
- 2022: the Russian and Israeli store hacks later listed in the Danfoss bulletin.
- May 2025: a CISA advisory flags an authentication bypass in the successor model, the AK-SM 800A, and tells operators to keep such devices off the open internet.
- August 9, 2026: Claroty researchers count 2,765 exposed devices reachable from the public internet.
- Late August 2026: about a dozen U.S. military commissaries lose food after their refrigeration is disrupted, a detail carried in the same CNN report.
- October 12, 2026: Predicta Lab’s Baptiste Robert finds 2,752 Danfoss systems exposed online, 1,590 of them in France.
France accounts for nearly six in ten of those exposed systems. The CNN account explains the habit behind the number: store control panels are left reachable over the internet so maintenance companies can adjust them from anywhere.
Why a Security Law Ended the Updates
The strangest passage in the bulletin is about law. Danfoss told customers it was “enforcing a hard End of Service” on legacy products, “driven by recent European cybersecurity legislation,” because continuing to service them “would place Danfoss under new legal obligations to maintain security updates.” Even the minor file updates it had kept supplying for the AK-SM 800 were, it said, “no longer permitted under the new legislation.”
Read that as an incentive. Europe wrote rules to make manufacturers patch what they sell. For hardware already past its end of life, this manufacturer’s answer was to stop touching it, because touching it is what would create the duty. Danfoss did not name the statute. The EU’s Cyber Resilience Act began requiring manufacturers to report actively exploited vulnerabilities on September 11, one month before the French attack. A legal regime built to keep products patched gave a vendor a reason to cut its oldest ones loose while they were still bolted to the walls of working stores.
Who Owns the Freezers
Follow the bill. Intermarché is a banner, and behind it sits Les Mousquetaires, a cooperative of roughly 3,000 owner-operators. Coopérative U and E.Leclerc are built on the same model of independent shopkeepers. The owner carries the profit and loss, the cabinets and the maintenance contract. So the decision to keep a controller its maker retired in 2021, and to leave it reachable from the internet, was made one store at a time. The loss will land the same way.
It is already large. Store managers have described write-offs of €50,000 to more than €200,000 a site. Intermarché has warned that some policies may not cover this type of in-store incident, and Gallagher’s John Farley told Insurance Business part of the reason: traditional property policies often carve out physical damage from a cyber event. Standalone cyber policies, for their part, often exclude physical damage altogether. Meanwhile Intermarché’s statement pointed at “a service provider that manages refrigeration systems in stores,” and the French retail federation demanded “full transparency” from Danfoss.
Everyone in the chain is naming someone else.
Where We Come Down
Unprecedented is the wrong word, and it is doing a job. If nobody could have seen this coming, nobody is responsible. The record says the retailers were told in writing, by the vendor, with examples, nearly a year ago, and that the remedy was a replacement they did not buy. That is on the store owners, and on the cooperatives that negotiate for them and could have funded the swap centrally.
Danfoss does not walk away clean. It knew retired controllers were still in service, it knew supermarkets in two countries had already been hit through them, and its response was a paragraph in a product newsletter and a withdrawal of service justified by its own legal exposure. A manufacturer that can count its exposed devices should be phoning those customers. Regulators should take the lesson as well. A patching mandate that a vendor can exit by declaring end of service will produce more orphaned hardware in more stores, and the next group of shopkeepers will call that unprecedented too.
Questions Readers Are Asking
Which supermarket chains were hit?
Intermarché and Netto (about 150 stores, by their owner’s count), Carrefour (80), Coopérative U (roughly 100), Monoprix (about 5% of 490 stores) and several E.Leclerc outlets. A Sekoia analyst said stores in five other European countries were affected.
How did the attackers heat the freezers?
They triggered the built-in defrost function through each store’s refrigeration controller and extended the cycle to eight hours. French authorities have not published how access was gained. A source close to the prime minister has said ANSSI identified a vulnerability in Danfoss software.
Was a security fix available?
For the current AK-SM 800A, yes: the CISA advisory lists firmware 4.3.1 as the fixed version. For the AK-SM 800 and AK-SC 355 there is none. Danfoss says those models no longer receive updates, and its guidance is to replace them.
Could this happen to U.S. grocers?
It may already have. CNN’s report says the French attacks resemble disruptions at about a dozen U.S. military commissaries in late August. Insurance Business reports no indication that any U.S. store was hit this week. The CISA guidance is the same for everyone: do not leave these controllers reachable from the internet.