Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)
Danfoss AK-SM / AK-SC refrigeration controllers, Copeland and Dixell xweb controllers
Overnight on Oct 11 to 12, attackers took remote control of internet-exposed refrigeration controllers at hundreds of French supermarkets (Intermarché and Netto, Coopérative U, E. Leclerc and others), forcing fridges and freezers into continuous defrost with setpoints around 50°C, spoiling fresh and frozen stock and reportedly causing small fires. CERT-FR names Danfoss AK-SM and AK-SC series plus Copeland and Dixell xweb controllers, says campaigns are probably still ongoing, and tells operators to take every controller off the public internet. Most affected Danfoss units are end-of-life models (AK-SM 800, AK-SC 355) that get no fixes; the entry vector and attacker are still unconfirmed.
Why this severity: Physical sabotage at roughly 700 stores with losses in the tens of millions of euros; NCSC Switzerland rates it actively exploited; end-of-life units have no fix; no CVE confirmed as the entry vector
- Started
- Oct 11, 2026
Affected
- Danfoss AK-SM 800 (end of life since 2021, no fixes)
- Danfoss AK-SC 355 (phased out 2016, no fixes)
- Danfoss AK-SM 800A on outdated firmware
- Copeland / Dixell XWEB EVO (end of life, no security patches)
Fixed in
- No fix for end-of-life units: remove internet exposure and replace them
- Danfoss AK-SM 800A: update to current firmware, security level Strict, change default passwords (CERT-FR)
Timeline6
Dark Reading reports a little over 700 stores were hit in one night; a Sekoia analyst told Reuters Spain, Portugal, Poland, Germany and Belgium were also affected, and Les Mousquetaires (Intermarché, Netto) said the attack came through a refrigeration service provider.
SourceCERT-FR publishes a third version with separate steps for compromised and uncompromised units: remove internet exposure, check defrost ranges, restore access only via VPN, and reset and reconfigure compromised Danfoss units.
SourceCERT-FR revises the alert to add Copeland xweb and Dixell xweb controllers, warns campaigns are probably still ongoing, and says a factory reset alone leaves end-of-life units vulnerable to recompromise.
SourceCoopérative U CEO Dominique Schelcher confirms on X that a cyberattack hit the refrigeration installations of several stores overnight, calling it unprecedented and unacceptable.
SourceCERT-FR publishes alert CERTFR-2026-ALE-012 on numerous compromises of Danfoss AK-SM and AK-SC refrigeration controllers. Danfoss says affected units ran outdated firmware and urges migrating legacy systems.
SourceOvernight, attackers remotely hijack supermarket refrigeration controllers across France, forcing continuous defrost with setpoints around 50°C; Intermarché, Coopérative U and E. Leclerc confirm the attack.
Source
Advisories1
News & write-ups4
- Cyberattacks hit European supermarket chains and disrupt refrigeration systemsAP · Oct 13, 2026
- Hackers force French supermarket fridges to heat up to 50C in 'unprecedented' cyber-attackThe Guardian · Oct 12, 2026
- Unplug your smart fridges, French supermarkets warned after cyberattackCSO Online · Oct 14, 2026
- EU grocers pay for unpatched fridge firmwareDark Reading · Oct 22, 2026
Posts2
Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU. Nos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra permettre de faire toute la lumière sur cette attaque. S’attaquer à des équipements essentiels à la conservation des produits frais et à l’approvisionnement alimentaire des Français est d’une extrême gravité et est inédit. C’est inacceptable.
🇫🇷 🚨 UPDATE: FRANCE REFRIGERATION ATTACKS EXPAND TO COPELAND AND DIXELL CONTROLLERS Follow-up to our Oct 12 coverage of the Danfoss supermarket refrigeration attacks. On Oct 13, 2026, CERT-FR revised alert CERTFR-2026-ALE-012, adding Copeland xweb and Dixell xweb controllers to t.co/rqk69Vq9an t.co/GzehBfwh39
Notes & caveats
No source confirms the entry vector or attacker. Censys and NCSC Switzerland point to three 2025 Danfoss AK-SM 800A flaws (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452) as possibly related, but Danfoss and French authorities have not tied the attack to them, so they are not listed as this incident's CVEs. Store counts vary by outlet (300+ Intermarché/Netto, about 100 Coopérative U; roughly 700 total).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
