No Malware Required: What the French Supermarket Refrigeration Attack Reveals

By Denrich Sananda 22-10-2026 7 min read

On Monday 12 October 2026, French supermarket chains confirmed that attackers had reached their refrigeration control systems and raised temperatures overnight while stores were closed. More than 500 shops were affected. Intermarché and its Netto brand reported at least 300 sites, Coopérative U more than 100, Carrefour 80 of its roughly 6,000 stores, and Monoprix around 5 percent of its estate. E.Leclerc was also hit. Retailers described millions of euros of spoiled stock, and Paris prosecutors confirmed the attack started fires.

It would be easy to file this as a retail story. It is not. This is one of the cleanest examples of a cyber-physical attack on record: a remote intrusion that produced heat, destroyed physical goods and ignited equipment. For anyone responsible for industrial or facility control systems, there are four lessons here, and only one of them is about refrigeration.

What the reporting establishes

Confirmed	Detail
Scale	More than 500 shops and supermarkets across France, across at least five separate retail groups.
Method	Temperatures raised remotely overnight, reported as high as 50 degrees Celsius. BFM TV reported the attackers appeared to trigger a forced defrost function.
Consequence	Fresh and frozen stock destroyed. Fires and melted equipment at some sites, confirmed by Paris prosecutors.
Systems involved	France's cybersecurity agency identified a vulnerability in software from a Danish manufacturer. Danfoss refrigeration controllers have been named in reporting, with the AK-SM800 and AK-SC355 noted.
Vendor position	Danfoss said most affected equipment was legacy and no longer receives software or security updates, that a version of the AK-SM800 was running outdated firmware, and that it had long advised supermarkets to move off those models.
Attribution	Nobody has been identified. An investigation is open.

Two things worth stating plainly because they are circulating loosely. No attribution has been established, so claims about who did this are speculation. And the vendor's account is a lifecycle and exposure problem rather than a product defect: equipment out of support, firmware not updated, and guidance that existed but had not been acted on.

Lesson one: no malware was needed

If the forced defrost detail holds, the attackers did not deploy a payload or exploit a memory bug. They used a function the system was built to perform. Forced defrost is a feature. That is the hardest category of attack to detect, because nothing anomalous happens at the protocol level. A valid command arrives through an authorized interface and the controller does exactly what it was designed to do. Signature-based detection sees nothing. Anomaly detection only helps if you have baselined what normal setpoint changes look like, and almost nobody has done that for refrigeration.

Lesson two: these are assets nobody owns

Ask who is responsible for the security of a supermarket's refrigeration controllers and the honest answer in most organizations is nobody. They are not IT, because IT does not manage refrigeration. They are not facilities, because facilities manage temperature rather than firmware. And they fall outside most OT security programs, because OT is assumed to mean production equipment.

This is the same ownership gap we report in other sectors. In medical device and pharmaceutical plants it is the environmental monitoring and sterilization systems. In commercial buildings it is HVAC and access control. The pattern is identical: control systems with physical consequences, sitting between two departments, appearing on no asset register. Our guide to non-disruptive OT asset discovery covers how to find them, and the first step is accepting that your inventory is incomplete.

Lesson three: internet exposure plus legacy equals pre-breached

The vendor had advised customers to move off the affected models. That advice did not translate into action across hundreds of sites, which is the ordinary outcome rather than an unusual failure. Guidance that is not actioned is not a control.

What makes this worse is that for equipment out of support, patching is not the remedy, because there is nothing to patch. The remedy is removing internet reachability, and France's cybersecurity agency advised exactly that: disconnect affected systems from the internet or restrict access to them, alongside applying available updates. For any legacy controller you cannot patch, network position is the only control you have left. Our guidance on OT patch management covers how to handle equipment that cannot be patched at all.

Lesson four: a distributed estate has no local defender

A refinery has engineers on site who notice when something is wrong. Five hundred supermarkets do not. No individual store has an OT engineer, a control room or anyone who would question a temperature trend at 2am. The attackers chose overnight hours when stores were closed, which removed the only remaining detection layer: a human noticing.

That structural difference matters when designing controls. In a plant you can lean on local competence and shift coverage. Across a distributed retail or branch estate you cannot, so detection and response have to be centralized, and the center has to be monitoring something. Our guide to building an OT monitoring program covers that design problem.

What to do about it this week

Find your equivalents. Refrigeration, HVAC, building management, UPS, access control, environmental monitoring. Any controller with a physical consequence that is not on your OT inventory.
Check what is internet-reachable. Not what should be. What is. This is a scan of your external footprint, and it is usually a short piece of work with uncomfortable results.
List what is out of vendor support. For anything in that category, network position is your only control.
Ask who owns each one. If the answer takes more than a moment, that is the finding.
Baseline setpoint changes. If a legitimate command is the attack, then knowing what normal looks like is the only way to spot an abnormal one.

For operators in food production rather than retail, our guides to ICS security for food and beverage manufacturing and cyber hygiene for food producers address the plant-side equivalent of this problem.

Why Choose Arista Cyber

We assess control systems with physical consequences, including the auxiliary and facility systems most programs leave out, and we work to IEC 62443 zones and conduits so network position is a designed control rather than an accident. Our consultants hold functional safety credentials alongside OT security certification, which is the right background when the consequence of a compromise is heat, pressure or fire. See our OT cybersecurity services and our case studies.

Next Steps

Start with the external footprint check and the ownership question. Both can be answered in days, neither needs procurement, and together they tell you whether you are carrying the same exposure that put 500 stores in the news. An OT risk assessment is the right next step if the answers are uncomfortable.

Common Questions

What actually happened to the French supermarkets?

Attackers reached refrigeration control systems remotely and raised temperatures overnight across more than 500 stores, destroying fresh and frozen stock. Paris prosecutors confirmed the attack also started fires. BFM TV reported the attackers appeared to trigger a forced defrost function.

Who was responsible?

Nobody has been identified and an investigation is open. Any claim about attribution at this stage is speculation.

Was this a product vulnerability?

France's cybersecurity agency identified a vulnerability in software from a Danish manufacturer, and Danfoss controllers have been named in reporting. The vendor's position is that most affected equipment was legacy, no longer receiving updates, and that it had long advised customers to move off those models. That makes it primarily a lifecycle and internet-exposure problem.

Could this happen outside retail?

Yes, and the exposure is wider than refrigeration. Any internet-reachable controller with a physical consequence that sits outside your OT inventory presents the same risk, including HVAC, building management and environmental monitoring in plants, hospitals and commercial buildings.

What is the single most useful thing to do now?

Establish what control equipment you have that is reachable from the internet and out of vendor support. For that equipment, network position is the only control available, because there is nothing left to patch.

Do you know which of your controllers are reachable from the internet?

Arista Cyber assesses the auxiliary and facility control systems most OT programs leave out: discovery, external exposure, support status, ownership and the network position that protects equipment you cannot patch.

Request an exposure assessment