Attackers remotely took over refrigeration controllers at French supermarkets and forced defrost cycles that warmed cold cases. This is an operational-technology incident, not a stolen-laptop story. Food was thrown out. Some reports also described fires in affected stores.
What happened
The intrusion ran overnight from 11 to 12 October 2026. Les Mousquetaires, which owns Intermarche, said cases were put into defrost and heated to as much as 50C. Retailers named in French reporting include Intermarche, Netto, Cooperative U, Carrefour, Monoprix, and E.Leclerc. Store counts differ by chain. Intermarche cited about 150 of its stores. Carrefour said about 80 of its stores. Two Alsace shops told reporters they lost about 270,000 euros of stock. No group has claimed the attack. Paris prosecutors opened an inquiry.
CERT-FR published alert CERTFR-2026-ALE-012 on 12 October. It said it knows of numerous compromises of Danfoss AK-SM and AK-SC series controllers, and that a management interface on the internet is against good practice. Danfoss told French media that most affected units are end-of-life models, including AK-SM 800 and AK-SC 355, which no longer receive software or security updates. Some current AK-SM 800A units on old firmware were also hit. ANSSI is coordinating with European counterparts because the same controllers are used outside France.
Who is affected
- Sites running Danfoss AK-SM or AK-SC refrigeration controllers, especially if the management interface is reachable from the internet
- End-of-life AK-SM 800 and AK-SC 355 units, which will not get a new security update
- Current AK-SM 800A units still on outdated firmware
What to do now
Disconnect AK-SM and AK-SC controllers from the internet, or restrict them to known maintainer addresses, then factory-reset any unit you suspect was reached. CERT-FR's recovery order is filter access, factory reset, apply every available fix, rotate secrets, review accounts, and reconfigure the unit. Replace end-of-life hardware. Do not leave a cold-store controller on a public IP because a contractor finds it convenient.
Source: CERT-FR CERTFR-2026-ALE-012.
Also on the blog
- GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE
- SonicWall CVE-2026-102255 SMA1000 SSRF probed
- Midnight Mimosa: budget Android phones ship with uninstallable malware
- Ledger finds implant in a CryptoBilis-sold wallet
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.