Full Report
Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said. The attackers reached them through the controller that runs all of a store's fridges and freezers, a device made by Danish company Danfoss that maintenance firms can manage remotely. Les Mousquetaires
Analysis Summary
# Incident Report: Hijacking of French Supermarket Refrigeration Systems
## Executive Summary
On the night of October 11, 2026, unidentified attackers gained remote access to Danfoss refrigeration controllers at hundreds of French supermarkets, including Intermarché and Carrefour. By remotely overriding temperature settings to as high as 50°C, the attackers forced massive food disposals and operational disruptions. The incident highlights the critical vulnerability of internet-exposed Industrial Control Systems (ICS) and legacy hardware.
## Incident Details
- **Discovery Date:** October 12, 2026
- **Incident Date:** October 11, 2026
- **Affected Organization:** Multiple (Les Mousquetaires/Intermarché, Coopérative U, Carrefour, Monoprix, E.Leclerc)
- **Sector:** Retail / Critical Infrastructure
- **Geography:** France
## Timeline of Events
### Initial Access
- **Date/Time:** Night of October 11, 2026
- **Vector:** Exploitation of internet-exposed refrigeration management controllers.
- **Details:** Attackers targeted Danfoss AK-SM and AK-SC series controllers, many of which were legacy models (End-of-Life) accessible via the public internet.
### Lateral Movement
- **Details:** Information not fully disclosed; however, the attack leveraged the controllers' intended remote management functionality used by maintenance firms to control entire store fridge/freezer arrays.
### Data Exfiltration/Impact
- **Impact:** No data exfiltration reported. The primary impact was physical/operational; controllers were set to "defrost" mode, heating units to 50°C, leading to the destruction of perishable inventory.
### Detection & Response
- **Discovery:** Store staff discovered rising temperatures and thawing goods; maintenance alerts triggered by the abnormal heat settings.
- **Response actions:** ANSSI (CERT-FR) issued an urgent alert (CERTFR-2026-ALE-012) on October 12, advising immediate disconnection of controllers from the internet.
## Attack Methodology
- **Initial Access:** Exploitation of exposed remote management interfaces on Danfoss controllers.
- **Persistence:** Remote control via hijacked administrative access.
- **Discovery:** Scanning for internet-facing ICS devices (likely using tools like Shodan or Censys).
- **Impact:** Manipulation of ICS parameters (temperature set-points) to cause physical spoilage and financial loss.
## Impact Assessment
- **Financial:** Estimated losses in the "tens of millions of euros" due to discarded stock and lost sales.
- **Data Breach:** None reported.
- **Operational:** Hundreds of stores forced to suspend sales of fresh/frozen goods; emergency maintenance required for refrigeration resets.
- **Reputational:** High public visibility due to food safety concerns and waste.
## Indicators of Compromise
- **Network indicators:** Traffic originating from unauthorized IPs to Danfoss controller ports (e.g., web interfaces or proprietary management ports).
- **Behavioral indicators:** Sudden temperature set-point changes to 50°C or "Defrost" mode activated across multiple sites simultaneously during non-operational hours.
## Response Actions
- **Containment:** Disconnecting affected Danfoss AK-SM 800 and AK-SC 355 units from the public internet.
- **Eradication:** Filtering access via firewalls/VPNs for current models (AK-SM 800A).
- **Recovery:** Manual reset of temperatures by refrigeration contractors; disposal of compromised food stock to meet safety regulations.
## Lessons Learned
- **Legacy Risk:** End-of-Life (EoL) hardware (some phased out in 2016) remains a massive liability if not isolated from the internet.
- **Patch Management:** Even current models were compromised due to outdated firmware.
- **IoT/ICS Exposure:** Critical infrastructure components should never be directly accessible via the public internet without a VPN or zero-trust gateway.
## Recommendations
- **Isolation:** Place all ICS/refrigeration controllers behind a secure VPN; disable direct NAT/Port Forwarding.
- **Hardware Lifecycle:** Accelerate the replacement of EoL controllers (AK-SM 800 / AK-SC 355) that no longer receive security updates.
- **Monitoring:** Implement alerting for "impossible" temperature shifts (e.g., changes exceeding 10°C in a short window) to trigger immediate manual overrides.