Full Report
Stock spoiled at hundreds of stores as manufacturer says affected equipment ran outdated firmware
Analysis Summary
# Incident Report: French Supermarket Refrigeration Compromise
## Executive Summary
In October 2026, a series of cyberattacks targeted the Industrial Control Systems (ICS) of several major French supermarket chains, including Intermarché and Carrefour. By exploiting outdated firmware in refrigeration controllers, attackers manipulated temperatures to as high as 50°C (122°F), resulting in massive food spoilage, operational shutdowns, and potential fire hazards. The incident highlights the critical risk of exposing legacy ICS interfaces directly to the public internet.
## Incident Details
- **Discovery Date:** October 12, 2026
- **Incident Date:** October 2026 (Ongoing through Oct 13)
- **Affected Organization:** Intermarché (150 stores), Carrefour (80 stores), Monoprix (~25 stores), Coopérative U, and potentially Ahold Delhaize.
- **Sector:** Retail / Critical Infrastructure
- **Geography:** France (Primary), Netherlands (Suspected)
## Timeline of Events
### Initial Access
- **Date/Time:** Early October 2026.
- **Vector:** Exploitation of internet-exposed refrigeration controllers (Danfoss AK-SM 800A and AK-SC series).
- **Details:** Attackers targeted devices running outdated firmware, likely utilizing a known vulnerability involving a predictable daily authentication code that bypasses administrator passwords.
### Lateral Movement
- **Details:** While specific lateral movement within corporate IT networks was not confirmed for all retailers, the attackers successfully moved from the management interface to the physical control layer of the refrigeration units.
### Data Exfiltration/Impact
- **Impact:** Physical disruption rather than data theft. Refrigeration units were commanded to increase temperatures to 50°C.
- **Result:** Hundreds of stores forced to discard entire stocks of perishable goods; fresh produce sections closed; digital shelf labels disabled; potential fire risks reported.
### Detection & Response
- **Discovery:** Detected when store staff identified soaring temperatures and spoiled stock.
- **Response Actions:** CERT-FR issued an emergency alert (CERTFR-2026-ALE-012). Affected retailers took websites offline, and engineers began manual resets and firmware patching.
## Attack Methodology
- **Initial Access:** Exploitation of exposed Web UIs/Management Interfaces via the public internet.
- **Persistence:** Likely achieved through administrative access granted by the firmware vulnerability.
- **Defense Evasion:** Use of legitimate (though bypassed) administrative functions to alter hardware settings.
- **Discovery:** Shodan searches were used by researchers (and likely attackers) to identify over 4,500 exposed Danfoss controllers.
- **Impact:** Unauthorized modification of environmental controls (Heating/Cooling) leading to physical asset destruction (spoilage).
## Impact Assessment
- **Financial:** Significant losses due to mass disposal of fresh/frozen inventory and lost sales revenue.
- **Data Breach:** None reported; focus was on operational sabotage.
- **Operational:** Distribution systems disrupted; apps and online delivery services taken offline; physical store sections closed.
- **Reputational:** Public concern over food safety and supply chain stability.
## Indicators of Compromise
- **Network:** Unrecognized IP addresses accessing Danfoss AK-SM/AK-SC web interfaces on ports typically used for HTTP/HTTPS.
- **Behavioral:**
- Unexpected temperature spikes in cold storage logs.
- Administrative logins bypassing configured credentials using the "daily code" algorithm.
- Modification of set-point parameters to 50°C.
## Response Actions
- **Containment:** Disconnecting refrigeration controllers from the public internet.
- **Eradication:** Factory resets of compromised controllers and rotation of all administrative credentials.
- **Recovery:** Deployment of firmware patches (released August 2025) and manual reconfiguration of cooling parameters.
## Lessons Learned
- **Patch Management:** Critical ICS vulnerabilities disclosed and patched over a year prior (August 2025) remained unaddressed by major retailers.
- **Network Segmentation:** High-risk industrial controllers were connected directly to the internet for "convenience," providing a zero-skill entry point for attackers.
- **Predictable Authentication:** The use of date-based algorithms for "backdoor" or "service" access remains a critical failure in ICS security design.
## Recommendations
- **Immediate:** Conduct a Shodan/Censys audit to identify any internet-facing industrial equipment and move them behind a VPN or firewall.
- **Short-Term:** Apply all pending firmware updates to Danfoss AK-SM 800A and AK-SC platforms.
- **Long-Term:** Implement strict network segmentation (Purdue Model) to ensure OT (Operational Technology) systems are never directly reachable from the public internet.