Coordinated Cyberattack Cripples Refrigeration Systems Across Hundreds of French Supermarkets

A sophisticated and widespread cyberattack targeting industrial refrigeration controllers has paralyzed operations at hundreds of supermarkets across France this week, leading to significant food spoilage and raising urgent questions about the security of critical supply chain infrastructure. The incident, which has prompted a formal investigation by the Paris prosecutor’s office, highlights a growing vulnerability in the interconnected systems that manage essential retail operations.

According to France’s national cybersecurity agency, ANSSI, the disruption extends beyond initial reports. While early focus centered on Danfoss systems, the agency’s incident response team, CERT-FR, confirmed that equipment manufactured by Copeland and its subsidiary brand, Dixell, were also targeted. This breadth of impact suggests a methodical campaign against the specific hardware that keeps perishable goods at safe temperatures across the retail sector.

A Rapidly Expanding Threat Landscape

The situation began to unfold on October 12, when CERT-FR issued an emergency alert regarding numerous compromises involving Danfoss AK-SM and AK-SC series refrigeration controllers. The urgency escalated the following day when the agency updated its advisory to include Copeland XWEB and Dixell XWEB systems.

While Copeland initially refrained from confirming the agency’s findings, the company has since acknowledged a vulnerability within its systems. "We are currently working with impacted customers to mitigate the risk," a company spokesperson stated, though details regarding the nature of the breach remain sparse.

The lack of clarity regarding how the attackers gained access has left industry experts and investigators searching for answers. CERT-FR has not officially linked the current wave of compromises to any specific vulnerability. Furthermore, both Danfoss and French authorities have refrained from connecting this incident to the 23 vulnerabilities in Copeland’s XWEB Pro controllers that were disclosed by researchers at Claroty earlier this summer. In that instance, Copeland had released firmware patches to address the security gaps. Similarly, Claroty had previously detailed critical flaws in the Danfoss AK-SM 800A controller. Whether the current attackers are exploiting these known, unpatched vulnerabilities or leveraging previously unknown "zero-day" exploits remains a primary focus of the ongoing investigation.

Danfoss has provided some context regarding the susceptibility of their equipment, noting that the majority of the affected devices were older AK-SM 800 and AK-SC 355 systems. These models have reached their "end-of-life" status, meaning they are no longer supported by the manufacturer and do not receive security updates. Support for the AK-SM 800 officially ceased in May 2021, while the AK-SC 355 was discontinued as far back as 2016. However, the incident also impacted some current-generation AK-SM 800A controllers that were running outdated firmware, underscoring the vital importance of consistent software maintenance in industrial environments.

The Scale of the Disruption

The human and economic toll of the attack has been substantial. On Tuesday, French Finance Minister Roland Lescure briefed lawmakers on the situation, revealing that approximately 700 of the country’s 10,000 supermarkets had been impacted by the breach. This figure marks a significant increase from initial reports that estimated the damage was limited to between 300 and 350 locations.

Prominent retail chains, including Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix, have confirmed that their systems were targeted. The operational impact varied by location, but the consequences were often severe. At Intermarché, for instance, approximately 150 stores were affected. According to the store’s owner, Les Mousquetaires, the refrigeration units were forced to run at 50 degrees Celsius for a period of six hours. This extreme temperature shift rendered the entire inventory of perishables unsafe, forcing the stores to discard massive quantities of food.

Other retailers reported similar challenges. The CEO of Coopérative U, Dominique Schelcher, noted that while 80 of the group’s stores were targeted, a combination of quick internal responses and the specific nature of the intrusion meant that only a minority of those locations suffered total inventory loss. Nevertheless, the financial impact is mounting. Two supermarkets in the Alsace region alone reported combined losses estimated at €270,000 ($300,000), a figure that is expected to rise as more retailers finalize their damage assessments.

Beyond the immediate financial loss, the nature of the attack has alarmed investigators. The Paris prosecutor’s office has confirmed that the cybercrime unit has opened a formal investigation, not only into the theft and sabotage of goods but also into reports that the attack triggered fires within some refrigeration units. According to reports from Le Monde, the attackers were able to manipulate the refrigeration cycles by extending the defrost periods from the standard one hour to as long as eight hours. This deliberate manipulation not only ruined the food but also effectively delayed the activation of temperature alarms, preventing store managers from intervening before the damage was irreversible.

Investigation and Industrial Response

One of the most perplexing aspects of the incident, according to sources familiar with the investigation cited by Reuters, is the complete absence of a ransom demand or any claim of responsibility. This lack of a clear motive—whether it be political, competitive, or purely destructive—has made the investigation significantly more complex.

The scope of the attack may also extend beyond France. Félix Aimé of the cybersecurity firm Sekoia indicated that stores in Spain, Portugal, Poland, Germany, and Belgium were also affected, though specific details regarding the extent of the damage in those regions remain limited. Meanwhile, the Dutch National Cyber Security Centre (NCSC) has clarified that a separate cyberattack involving Ahold Delhaize is not believed to be linked to the refrigeration system compromises.

Data from the search engine Censys provides a chilling look at the vulnerability of these systems prior to the attack. As of October 11, Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels, with more than 1,800 of those located within France. By October 14, following the public alert, the number of exposed panels in France had plummeted to 537, while numbers in other countries remained largely unchanged. Significantly, Censys noted that both patched and unpatched versions of the systems were disappearing from the public internet at roughly the same rate, suggesting that operators were disconnecting their controllers entirely to protect them, rather than taking the time to update them.

In light of these findings, CERT-FR has issued stern guidance to operators of affected controllers. The agency is urging all companies to take their systems off the public internet immediately. If remote access is required for operational reasons, it must be restricted to a secure VPN or a protected network environment. The agency explicitly stated that filtering connections by IP address—a common but relatively weak security measure—should only be used as a temporary, emergency stop-gap. For those operating end-of-life devices, the agency issued a stark warning: a factory reset is insufficient. Because the underlying vulnerabilities remain unpatched, these devices will remain susceptible to re-compromise if left exposed to the internet.

As the cleanup continues, the incident has ignited a fierce debate regarding corporate liability. Some retailers, including Les Mousquetaires, have pointed to the fact that the refrigeration systems were managed by the vendors themselves, suggesting that the responsibility for security failures—and the resulting losses—lies with the supplier. As the investigation moves forward, the legal and financial repercussions for both the retailers and the manufacturers of these critical industrial systems are likely to remain a focal point of the discourse surrounding industrial cybersecurity.