Congélateurs vitrés d'un commerce alimentaire, illustrant l'attaque contre la réfrigération connectée des supermarchés français

Connected refrigeration hacked: what the French supermarket attack teaches SMBs

Overnight from Sunday, October 11 to Monday, October 12, 2026, attackers took control of the systems that remotely run refrigeration at hundreds of supermarkets in France. They forced a continuous defrost cycle: at Intermarché, display cases climbed to 50°C for six hours. Stock thrown out, small fires, losses in the millions of euros.

This attack on connected refrigeration isn’t exotic for a local SMB. Restaurant, grocery, bakery, pharmacy, warehouse: the walk-in cooler, the heat pump or the cameras are often reachable over the internet so a technician can work without driving over. The question isn’t “am I a supermarket?” but “who can talk to my devices from the internet?”

Connected refrigeration hacked: the incident card

📋 Incident card — French supermarkets, October 2026

When

Overnight from Sunday, October 11 to Monday, October 12, 2026.

Where

France: between 350 and 500 supermarkets depending on the count (Intermarché and Netto, Carrefour, Monoprix, Coopérative U, E.Leclerc…). A Sekoia researcher quoted by BetaNews also reports cases in Spain, Portugal, Poland, Germany and Belgium.

What

Attackers took over the controllers that run refrigeration remotely and forced a continuous defrost cycle. At Intermarché, display cases reached 50°C for six hours. All affected stock was thrown out; a few small fires were reported.

Equipment

Danfoss AK-SM and AK-SC controllers, then Copeland xweb and Dixell xweb (added by CERT-FR on October 13).

Cause

Not disclosed. According to Danfoss, most affected units were end-of-life models (AK-SM800, end of life in 2021; AK-SC355, phased out in 2016) or AK-SM800A units running outdated firmware. CERT-FR points out that exposing a management interface to the internet goes against good practice.

Losses

Two stores in Alsace alone reported €270,000 in losses (BFMTV, quoted by the BBC). Paris prosecutors opened an investigation. No claim of responsibility as of October 13.

🔎 The flaws were documented

As early as 2025, CISA published an advisory on Danfoss AK-SM 8xxA controllers (ICSA-25-140-03): an authentication bypass (CVE-2025-41450, fixed in R4.2) and a post-authentication command injection (CVE-2025-41451, fixed in 4.3.1), documented by Claroty Team82 researchers. Note, however, that CERT-FR has tied the attack to no specific flaw. The known common thread is internet-reachable interfaces, often on end-of-life or unpatched devices.

The floor plan: where connected refrigeration hides in an SMB

Here’s a typical 12-employee food business (fictional example). Each badge marks a device that may be reachable from outside. The legend says what to check.

🗺️ Typical food business — overview

Back room / kitchen

1Walk-in cooler and display case controller

2Wi-Fi temperature probe (text alerts)

Roof / mechanical room

3Connected HVAC thermostat or heat pump

Sales floor

4IP cameras and video recorder

5Point of sale and payment terminal

Office

6Router or firewall (port forwarding)

7Manager’s PC with the contractor’s remote access software

Legend: the question to ask for each device

1The French attack scenario. Installed by the refrigeration contractor, often reachable over the internet for remote maintenance. Who knows the password? Was it ever changed?
2Small device, big access: it sits on the same Wi-Fi as your PCs. Is it on a separate network?
3Same logic as refrigeration: the HVAC provider adjusts settings remotely. Through what path?
4Internet-exposed video recorders are among the most scanned devices. Default password?
5Should be isolated from the rest of the network (a common payment provider requirement).
6This is where a “port forward” opened five years ago makes a device visible from the internet.
7A remote access tool left open permanently is a prime entry point (see our decision tree on hijacked remote access tools).

Exposed, filtered or VPN: 3 ways to open the door for the technician

Your refrigeration or HVAC contractor needs remote access, that’s normal. What matters is how that access is opened.

🔴 Interface exposed to the internet

The controller has a public IP address
Anyone can find it with a simple scan
Often: factory password, firmware never updated

This is the situation CERT-FR’s alert targets. Shut it off first.

🟡 IP address filtering

The firewall only lets the contractor’s addresses through
Sharply reduces short-term risk
Fragile: addresses change, exceptions pile up

Acceptable in an emergency, but “should not be considered permanent” (CERT-FR).

🟢 VPN or protected network

The contractor connects through a VPN with multifactor authentication
The device sits on a network separate from your PCs
Logged access, current firmware, changed passwords

The target recommended by CERT-FR and Danfoss.

CERT-FR’s 5 recommended steps, translated for an SMB

Remove internet exposure from every controller reachable through a public IP address. Before cutting the data feed to the contractor, check your maintenance contract and insurance: CERT-FR flags this explicitly.
Review the entire configuration, especially defrost schedules and temperature set points.
If the device was compromised, factory-reset it, then reconfigure it. On an end-of-life device that isn’t enough: it will remain vulnerable and “will certainly be compromised again,” CERT-FR warns.
Restore contractor access only through a VPN or protected network. IP filtering can help in an emergency, nothing more.
Apply the manufacturer’s best practices: current firmware, “Strict” security level on Danfoss devices, default passwords changed. And plan to replace models that no longer get updates.

📋 SMB box: 4 questions to ask your refrigeration or HVAC contractor this week

Which of our devices are reachable over the internet, and through what path (public IP, manufacturer cloud, VPN)?
What model and firmware version is our controller? Is it still supported?
Was the factory password changed, and who on your side knows it?
Do we get an alert if a temperature set point or defrost schedule is changed remotely?

These devices are part of your network, even if another provider installed them. At NeoTech, we add them to the inventory, isolate them on a separate network, route contractor access through a VPN and include them in proactive monitoring of your systems, which helps spot an unusual connection or a device suddenly visible from the internet. See also our business network support and, in the same spirit, why an internet-exposed server always gets found.

Book your free cyber check

During the free cyber check, we list the connected devices on your premises with you (refrigeration, HVAC, cameras, point of sale) and check which ones are visible from the internet, without changing anything on your end.

👉 Book your free cyber check

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Sources

Photo: Daniel & Hannah Snipes, Pexels (Pexels licence).