# Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB) · pwn.watch > Overnight on Oct 11 to 12, attackers took remote control of internet-exposed refrigeration controllers at hundreds of French supermarkets (Intermarché and Netto, Coopérative U, E. Leclerc and others), forcing fridges and freezers into continuous defrost with setpoints around 50°C, spoiling fresh and frozen stock and reportedly causing small fires. CERT-FR names Danfoss AK-SM and AK-SC series plus Copeland and Dixell xweb controllers, says campaigns are probably still ongoing, and tells operators to take every controller off the public internet. Most affected Danfoss units are end-of-life models (AK-SM 800, AK-SC 355) that get no fixes; the entry vector and attacker are still unconfirmed. Page: https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks · generated 2026-10-23T03:54:42.456Z ## Status - Severity: critical · status: live · patch: partial - Product: Danfoss AK-SM / AK-SC refrigeration controllers, Copeland and Dixell xweb controllers - Started: 2026-10-11 - Affected: Danfoss AK-SM 800 (end of life since 2021, no fixes); Danfoss AK-SC 355 (phased out 2016, no fixes); Danfoss AK-SM 800A on outdated firmware; Copeland / Dixell XWEB EVO (end of life, no security patches) - Fixed in: No fix for end-of-life units: remove internet exposure and replace them; Danfoss AK-SM 800A: update to current firmware, security level Strict, change default passwords (CERT-FR) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks/feed.xml - JSON Feed: https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks.json - This file: https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks/llms.txt ## Updates (newest first) - 2026-10-22: Dark Reading reports a little over 700 stores were hit in one night; a Sekoia analyst told Reuters Spain, Portugal, Poland, Germany and Belgium were also affected, and Les Mousquetaires (Intermarché, Netto) said the attack came through a refrigeration service provider. (https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware-french) - 2026-10-16: CERT-FR publishes a third version with separate steps for compromised and uncompromised units: remove internet exposure, check defrost ranges, restore access only via VPN, and reset and reconfigure compromised Danfoss units. (https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/) - 2026-10-13: CERT-FR revises the alert to add Copeland xweb and Dixell xweb controllers, warns campaigns are probably still ongoing, and says a factory reset alone leaves end-of-life units vulnerable to recompromise. (https://www.csoonline.com/article/4235107/unplug-your-smart-fridges-french-supermarkets-warned-after-cyberattack.html) - 2026-10-12: Coopérative U CEO Dominique Schelcher confirms on X that a cyberattack hit the refrigeration installations of several stores overnight, calling it unprecedented and unacceptable. (https://x.com/schelcher/status/2109564928881308012) - 2026-10-12: CERT-FR publishes alert CERTFR-2026-ALE-012 on numerous compromises of Danfoss AK-SM and AK-SC refrigeration controllers. Danfoss says affected units ran outdated firmware and urges migrating legacy systems. (https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/) - 2026-10-11/12: Overnight, attackers remotely hijack supermarket refrigeration controllers across France, forcing continuous defrost with setpoints around 50°C; Intermarché, Coopérative U and E. Leclerc confirm the attack. (https://www.theguardian.com/world/2026/oct/12/cyber-attack-defrosts-refrigerators-france-supermarket-chains-intermarche-cooperative-u) ## Fix brief # Security brief: Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB) Source: https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks · status: live · severity: critical · updated Oct 23, 2026, 03:53 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Overnight on Oct 11 to 12, attackers took remote control of internet-exposed refrigeration controllers at hundreds of French supermarkets (Intermarché and Netto, Coopérative U, E. Leclerc and others), forcing fridges and freezers into continuous defrost with setpoints around 50°C, spoiling fresh and frozen stock and reportedly causing small fires. CERT-FR names Danfoss AK-SM and AK-SC series plus Copeland and Dixell xweb controllers, says campaigns are probably still ongoing, and tells operators to take every controller off the public internet. Most affected Danfoss units are end-of-life models (AK-SM 800, AK-SC 355) that get no fixes; the entry vector and attacker are still unconfirmed. Severity detail: Physical sabotage at roughly 700 stores with losses in the tens of millions of euros; NCSC Switzerland rates it actively exploited; end-of-life units have no fix; no CVE confirmed as the entry vector - Product: Danfoss AK-SM / AK-SC refrigeration controllers, Copeland and Dixell xweb controllers ## Affected versions - Danfoss AK-SM 800 (end of life since 2021, no fixes) - Danfoss AK-SC 355 (phased out 2016, no fixes) - Danfoss AK-SM 800A on outdated firmware - Copeland / Dixell XWEB EVO (end of life, no security patches) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - No fix for end-of-life units: remove internet exposure and replace them - Danfoss AK-SM 800A: update to current firmware, security level Strict, change default passwords (CERT-FR) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Latest updates - Oct 22, 2026: Dark Reading reports a little over 700 stores were hit in one night; a Sekoia analyst told Reuters Spain, Portugal, Poland, Germany and Belgium were also affected, and Les Mousquetaires (Intermarché, Netto) said the attack came through a refrigeration service provider. - Oct 16, 2026: CERT-FR publishes a third version with separate steps for compromised and uncompromised units: remove internet exposure, check defrost ranges, restore access only via VPN, and reset and reconfigure compromised Danfoss units. - Oct 13, 2026: CERT-FR revises the alert to add Copeland xweb and Dixell xweb controllers, warns campaigns are probably still ongoing, and says a factory reset alone leaves end-of-life units vulnerable to recompromise. - Oct 12, 2026: Coopérative U CEO Dominique Schelcher confirms on X that a cyberattack hit the refrigeration installations of several stores overnight, calling it unprecedented and unacceptable. - Oct 12, 2026: CERT-FR publishes alert CERTFR-2026-ALE-012 on numerous compromises of Danfoss AK-SM and AK-SC refrigeration controllers. Danfoss says affected units ran outdated firmware and urges migrating legacy systems. - Oct 11/12, 2026: Overnight, attackers remotely hijack supermarket refrigeration controllers across France, forcing continuous defrost with setpoints around 50°C; Intermarché, Coopérative U and E. Leclerc confirm the attack. ## Advisories - [Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (CERTFR-2026-ALE-012)](https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/) (CERT-FR) ## Write-ups & news - [Cyberattacks hit European supermarket chains and disrupt refrigeration systems](https://apnews.com/article/france-cyberattack-supermarkets-refrigeration-systems-78a813a8efd466b360655339f96083dc) - [Hackers force French supermarket fridges to heat up to 50C in 'unprecedented' cyber-attack](https://www.theguardian.com/world/2026/oct/12/cyber-attack-defrosts-refrigerators-france-supermarket-chains-intermarche-cooperative-u) - [Unplug your smart fridges, French supermarkets warned after cyberattack](https://www.csoonline.com/article/4235107/unplug-your-smart-fridges-french-supermarkets-warned-after-cyberattack.html) - [EU grocers pay for unpatched fridge firmware](https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware-french) ## Caveats No source confirms the entry vector or attacker. Censys and NCSC Switzerland point to three 2025 Danfoss AK-SM 800A flaws (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452) as possibly related, but Danfoss and French authorities have not tied the attack to them, so they are not listed as this incident's CVEs. Store counts vary by outlet (300+ Intermarché/Netto, about 100 Coopérative U; roughly 700 total). --- Machine-readable: https://pwn.watch/i/french-supermarket-refrigeration-controller-attacks.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.