Field note 09 · Equipment and infrastructure · Last checked 13 October 2026

The French refrigeration attack: what US owners should check.

In brief

Overnight on 11–12 October 2026, refrigeration at hundreds of French supermarkets was forced into defrost through the remote controllers that manage it. Intermarché’s owner reported temperatures of up to 50°C (122°F); food was lost. France’s CERT-FR issued an alert on internet-exposed refrigeration controllers, naming Danfoss models and later Copeland and Dixell ones, and Danfoss said most affected units were older products that no longer receive security updates.

The same kinds of refrigeration, building and HVAC controllers run in US grocers, cold storage, pharmacies and food distributors. Owners should know which controllers they have, which can no longer be updated, and whether any can be reached from the internet. Today.

General information, not legal advice. This is a developing story; where facts are reported but not confirmed, the note says so. Checked against the sources listed at the foot of this page on 13 October 2026.

What happened

  • The night. Overnight from Sunday 11 to Monday 12 October 2026, refrigeration units at supermarkets across France were switched into defrost. Carrefour, Monoprix, Intermarché, Coopérative U and E.Leclerc stores were affected. Reported store counts vary by chain and outlet; all agree it was hundreds.
  • The damage. A spokesman for Les Mousquetaires, Intermarché’s owner, said units reached about 50°C. The Paris prosecutor’s office cited food losses and fires; one retailer reported smoke but no fires. The prosecutor has opened an investigation.
  • The official alert. CERT-FR, the French government’s computer emergency response team, issued an alert on 12 October (revised 13 October) about attacks on the remote controllers of refrigeration installations. It names Danfoss AK-SM and AK-SC controllers and, since the revision, Copeland and Dixell xweb, and treats management interfaces exposed to the internet as contrary to good practice.
  • The maker. Danfoss said it was aware of incidents affecting a limited number of refrigeration management systems and that most affected units were legacy products that no longer receive software or security updates; some newer units were running outdated firmware.
  • Who did it. No one has been named and no one has claimed it.

Why it matters in the US

Refrigeration management and building controllers of the same kinds run in US supermarkets, cold storage, pharmacies, restaurants and food distributors. Many were installed by a refrigeration contractor years ago, are managed remotely by that contractor, and appear on no one’s IT inventory. A unit that can no longer be updated stays vulnerable for as long as it stays in service. The French incident shows the cost is physical: product, equipment and possibly safety, not only data.

What owners should check today

  1. Make an inventory of controllersEvery refrigeration, building management and HVAC controller, by site: maker, model and firmware version. Ask your refrigeration and HVAC contractors for theirs; they often hold the only list.
  2. Mark what can no longer be updatedCheck each model against the maker’s support and end-of-life notices. Plan replacement for anything that no longer receives security updates.
  3. Find out what can be reached from the internetAsk your contractors and your network provider whether any controller’s management interface is reachable from the internet, and how remote access works. CERT-FR’s first advice is to take these interfaces off the internet.
  4. Read the advisories for your modelsThe maker’s security advisories and CISA’s ICS advisories. Apply the updates that exist.
  5. Separate the controllers from everything elseControllers on their own network segment, with remote access only through a controlled, logged route.
  6. Write the incident planWho notices a temperature excursion at 3 a.m., who can switch a store to manual control, who calls the contractor, and how product is moved or written off.

The warning signs were public

Nothing here required secret knowledge. CISA published an ICS advisory on the Danfoss AK-SM 8xxA series in May 2025 (ICSA-25-140-03, updated August 2025), with fixed firmware. Claroty’s Team82 researchers published a detailed write-up of weaknesses in those controllers on 9 August 2026, two months before the attack. Neither French authorities nor Danfoss have linked those specific findings to this attack, and Danfoss says most affected units were older models those advisories do not cover. But the pattern was visible: remotely managed controllers, some past their supported life, some reachable from outside. An owner who knew what was installed, and read the advisories for it, had time to act.

Questions people ask

What happened to French supermarket fridges in October 2026?
Overnight on 11 to 12 October 2026, refrigeration at hundreds of French supermarkets, including Carrefour, Monoprix, Intermarché, Coopérative U and E.Leclerc stores, was forced into defrost through remote controllers. Intermarché's owner reported temperatures of up to 50°C, and food was lost. The Paris prosecutor has opened an investigation.
Which refrigeration controllers were involved?
France's CERT-FR alert of 12 October 2026, revised on 13 October, names Danfoss AK-SM and AK-SC controllers and Copeland and Dixell xweb, and warns against exposing their management interfaces to the internet. Danfoss said most affected units were legacy products that no longer receive security updates.
Could this happen in the US?
The same kinds of refrigeration, building and HVAC controllers are used in US grocers, cold storage, pharmacies and food distributors. Owners reduce the risk by knowing which controllers they run, replacing those that no longer receive updates, keeping management interfaces off the internet, segmenting the controllers and reading the maker's and CISA's advisories.
Was the Claroty Team82 research the cause?
Not as far as anyone has said. Claroty's Team82 published research on weaknesses in Danfoss AK-SM 800A controllers on 9 August 2026, and CISA published an advisory on that series in 2025, but neither French authorities nor Danfoss have linked those findings to the attack.

Sources

General information, not legal advice. BSJ Ventures publishes methods; it never publishes clients, cases or verdicts, and it claims no relationship with any agency, company or maker named here.

← All field notes
Free equipment advisories

Run refrigeration or building controllers? Get the advisories that name them.

Sign up with the makers and models you run and we’ll set you up within a week; you’ll get CISA advisories matched to the equipment you list. Free. Model names only; never send addresses or network details.

Sign up for equipment advisories

How it works: CISA advisories for the equipment you own.