French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply

Supermarkets across France opened on Monday, October 12, to warm freezers and spoiled stock. Overnight, attackers had taken control of refrigeration controllers in hundreds of stores and forced them into defrost, heating equipment to as high as 50°C. Prosecutors confirmed fires, retailers estimated losses in the tens of millions of euros, and Coopérative U’s chief executive called the attack unprecedented.

The incident brings a long-discussed Operational Technology (OT) risk into the food supply chain. The affected controllers are mostly end-of-life Danfoss units that no longer receive updates, and passive analysis of internet scan data shows thousands of the same management interfaces still reachable from the internet in France. The attack also lands in a week of active hacktivist pressure on French organizations, though no group has claimed it.

Key Takeaways

• Attack: Overnight from October 11 to 12, 2026, attackers forced refrigeration controllers in hundreds of French supermarkets into defrost mode, heating fridges and freezers to as high as 50°C
• Victims: Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc stores were hit, and the Paris prosecutor’s office opened an investigation
• Vendor: Danfoss named its end-of-life AK-SM 800 and AK-SC 355 controllers, which no longer receive security updates, and said some current AK-SM 800A units on outdated firmware were also hit
• Official response: CERT-FR issued an alert on October 12 telling operators to disconnect AK-SM and AK-SC controllers or tightly filter access to them
• Attribution: No group has claimed the attack, and neither French authorities nor Danfoss has said who carried it out or how the attackers got in
• Exposure: SOCRadar found 2,898 Shodan results for Danfoss StoreView interfaces in France on October 13, about 65% of the global total
• Hacktivist pressure: Pro-Russian hacktivist group NoName057(16) continues its long-running #OpFrance DDoS campaign this week and claims to have manipulated a small French hydroelectric plant; nothing links it to the supermarket attack

At a Glance

What Happened in the French Supermarket Cyberattack

Attackers remotely triggered forced defrost cycles on supermarket refrigeration systems across France overnight from Sunday, October 11, to Monday, October 12. A spokesman for Les Mousquetaires, owner of Intermarché and Netto, told Bloomberg that fridges and freezers heated to 50°C for around six hours.

Affected stores had to discard all fresh and frozen products. The Paris prosecutor’s office described a large-scale attack on connected refrigerators at several major food retailers, causing food losses and fires.

The financial impact is significant:

• Les Mousquetaires: CEO Thierry Cotillard told BFMTV he expected losses of tens of millions of euros across France
• Haguenau, Alsace: BFMTV reported that one Intermarché and one Super U store alone lost €270,000 in merchandise

Retailers framed the incident as a supplier compromise. Les Mousquetaires said the systems were under Danfoss’s management and that filing a complaint would fall to the supplier. E.Leclerc said a cyberattack had affected one of its refrigeration equipment suppliers. Coopérative U CEO Dominique Schelcher called the attack unprecedented and unacceptable.

The impact extended beyond France. Spain, Portugal, Poland, Germany and Belgium were also affected.

Danfoss Systems Involved and What Is Known About the Vulnerability

Danfoss named two affected models: the AK-SM 800, declared end of life in May 2021, and the AK-SC 355, phased out in 2016. Neither receives software or security updates. Some units of the current AK-SM 800A were also hit, and Danfoss said those were running outdated firmware without naming the versions. The company described the incidents as affecting a limited number of refrigeration management systems.

Four further points are on record:

• CERT-FR alert: On October 12, CERT-FR, part of ANSSI, said it was aware of numerous compromises affecting Danfoss AK-SM and AK-SC controllers and told operators to disconnect them or filter access in its alert
• ANSSI: A person close to Prime Minister Sébastien Lecornu said France’s cybersecurity agency had identified a vulnerability in software supplied by a Danish company and contacted the vendor
• No intrusion path named: As of October 13, neither CERT-FR nor Danfoss had named a vulnerability, CVE or way in, and Danfoss’s security advisories page listed no advisory about the attack

Prior Research on Danfoss Controllers

In August 2026, Claroty Team82 disclosed three vulnerabilities in the newer Danfoss AK-SM 800A system manager in its research:

Danfoss covered the flaws in DSA-2025-03-01 and DSA-2025-08-01 and advises AK-SM 800A operators to keep firmware up to date.

No authority or vendor has linked these CVEs to the incident. Claroty’s testing covered only the AK-SM 800A, not the two end-of-life models Danfoss named. The research does show that thousands of these management interfaces were reachable from the internet well before the attack.

These controllers have been attacked before. Danfoss’s October 2025 newsletter records attacks on AK-SM 800 systems at 16 Russian supermarkets and 40 Israeli stores in 2022, and notes that all 40 Israeli sites lacked proper firewall or VPN protection.

SOCRadar Exposure Snapshot: Danfoss StoreView in France

Thousands of Danfoss refrigeration management interfaces in France remained reachable from the internet more than a day after the attack. Searching Shodan for the Danfoss StoreView page title, the interface title Claroty highlighted in its August research, SOCRadar found 2,898 results in France, about 65% of the 4,481 found worldwide.

Censys returned 881 unique hosts in France for the same fingerprint. The two figures measure different things: Shodan counts service banners, so one device answering on several ports counts more than once, while Censys counts hosts. A fair range is roughly 900 exposed devices and 2,900 exposed services.

The country distribution overlaps with the spillover reported. Portugal, Belgium and Poland are among the five countries with the most exposed interfaces, though exposure alone does not confirm compromise.

Exposure is not evidence of how this attack happened. The figures come from passive internet scanning data only, and may cover several AK-SM generations under the same page title.

Hybrid Threat: Pressure on French Infrastructure

The supermarket attack remains unattributed, and nothing in the public record ties it to a state or hacktivist actor. It does, however, land in a week of sharp escalation against digital infrastructure in the Russia-Ukraine war and sustained pro-Russian hacktivist activity against France. Read together, these developments offer useful context for defenders, even where no direct link exists.

Digital Infrastructure, Kinetic Strike

Between October 8 and 11, Ukrainian drone strikes hit three Yandex data centers in Sasovo, Kaluga and Vladimir, taking Yandex Cloud and Yandex Pay offline across parts of Russia. Reuters described the first strike as the first major attack on a Russian data hub, following a wave of Russian strikes on Ukrainian data centers.

These were kinetic attacks with no cyber component reported. They matter here because they mark data and cloud infrastructure as legitimate military targets in the conflict. Historically, pro-Russian hacktivist groups have answered symbolic losses with retaliatory campaigns against countries supporting Ukraine, and France is among the most visible of them.

NoName057(16) and the #OpFrance Campaign

Pro-Russian hacktivist group NoName057(16) has targeted French organizations persistently since it emerged in March 2022, and #OpFrance is a recurring campaign for the group. Its posts this week carry the hashtags #OpFrance, #TimeOfRetribution and #FuckEastwood. The table below covers a sample of its most recent claims from its English-language Telegram channel, and none of them mentions the supermarket attack.

The #FuckEastwood hashtag refers to Operation Eastwood, the July 2025 international operation against NoName057(16) coordinated by Europol and Eurojust, which took more than 100 systems offline. The group stayed active after it.

The DDoS posts follow the group’s usual format, citing check-host.net reports as proof. Several note targets as “closed by geo,” likely meaning the sites were restricting access by geography. These reports show reachability at a moment in time and do not confirm meaningful disruption.

The Hydroelectric Plant Claim

The most notable recent post claims “full control” of a small French hydroelectric plant’s control system through a Weintek industrial HMI. The group says it gained access to settings including pool levels, turbines, valves and oil systems, and that “volunteers of the DDoSia Project” switched the system to manual mode and changed parameters, triggering protection systems and alarms. It published a video of an HMI screen as evidence.

This claim is unverified. No operator or authority has confirmed an incident, and the plant is not named. Pro-Russian hacktivist groups have increasingly posted HMI tampering claims against small, internet-exposed industrial sites, and such claims often overstate impact.

SOCRadar Assessment

The points below are analytical judgments, offered to help defenders prioritize. None of them attributes the supermarket attack.

• Target selection follows strategic priorities: This week’s claimed targets cluster around France’s defense-industrial base (Eurenco, GICAT, SAGEM), energy (GTT, the hydroelectric plant) and state services, which matches the group’s long-standing focus on countries supporting Ukraine
• Physical effects are the new signaling currency: Whether or not the hydroelectric claim holds up, the group is presenting itself as able to touch physical processes, a step beyond its DDoS core; the supermarket attack showed how much disruption real access to exposed OT can cause
• Ambiguity serves hybrid objectives: An unattributed attack on food supply, surrounded by hacktivist claims that French infrastructure is vulnerable, erodes public confidence regardless of who is responsible; the hydroelectric post itself closes by saying French critical infrastructure “has once again demonstrated its vulnerability”
• Opportunistic claims are likely: A hacktivist group may claim the supermarket attack in the coming days to borrow its impact, and any such claim should be weighed against technical evidence before it is accepted

Insights and Open Questions

Less than two days in, the attack raises more questions than the public record answers. These are the ones that matter most for defenders and for how the incident is read.

How Did the Attackers Reach the Controllers?

Retailers describe a supplier-side incident, and the controllers are typically managed remotely by refrigeration maintenance firms. At the same time, thousands of StoreView interfaces remain directly reachable online, and CERT-FR’s alert warns against that exposure without saying it was the route. A compromised contractor or vendor management channel would expose every customer on that channel at once, while direct exploitation of exposed devices would point to opportunistic mass targeting.

Was France the Target, or the Largest Pool of Exposed Devices?

France accounts for about two thirds of the StoreView results SOCRadar found on Shodan worldwide. An attack sweeping a vendor’s installed base would hit France hardest by default, so the geographic concentration alone says little about intent. Sekoia’s report of victims in five other countries fits that reading, pending confirmation.

What Was the Goal?

None of the reporting so far mentions a ransom demand or data theft. Heating equipment to 50°C causes physical and financial damage with no direct payoff to the attacker, which fits sabotage or disruption more closely than financially motivated crime.

Will Anyone Claim It?

Hacktivist groups, including NoName057(16), are active against French targets this week, and claims sometimes appear days after an impact. A claim alone would not prove responsibility, since these groups regularly take credit for incidents they did not cause.

Why Were End-of-Life Controllers Still Online?

Danfoss declared the AK-SM 800 end of life in May 2021 and phased out the AK-SC 355 in 2016, and says it long advised supermarkets to move off those models. Both were still running in French stores years later. Refrigeration systems are often installed and maintained by third-party contractors, which leaves a gap between vendor guidance and what actually runs on the shop floor.

Is Food Supply Now an Established Target?

EU food and agriculture commissioner Christophe Hansen said the exploitation of food had become a reality. Whoever is behind this attack has shown that store-level refrigeration can be disrupted at national scale in a single night, and others will have noticed.

Recommendations for Retail and OT Operators

Operators of refrigeration controllers and other building or process systems should treat their management interfaces as critical assets this week:

• Follow the CERT-FR alert: Disconnect Danfoss AK-SM and AK-SC controllers from the internet or filter access tightly, limiting remote administration to trusted IP addresses as a first step
• Treat exposed units as possibly compromised: CERT-FR advises limiting network access to service providers, factory resetting the device, applying available fixes, changing its secrets, checking accounts and reconfiguring it completely
• Replace end-of-life models: The AK-SM 800 and AK-SC 355 receive no fixes, so they need compensating controls now and a replacement date
• Update the AK-SM 800A: Move to the latest firmware package Danfoss lists, which was 5.3.x on October 13; systems on 3.x must step through 4.x first
• Review contractor access: Audit which refrigeration contractors and service providers hold remote access, rotate their credentials and route them through a single managed entry point
• Close adjacent services: Check for VNC, RDP or other remote access services exposed on the same hosts or networks
• Add independent temperature alarms: A compromised controller can misreport conditions, so out-of-band sensors provide a second source of truth
• Monitor for claims: Watch Dark Web forums and hacktivist Telegram channels for claims naming your organization, suppliers or sector

Frequently Asked Questions

Who Is Behind the French Supermarket Cyberattack?

No group has claimed the attack as of October 13, 2026. Neither French authorities nor Danfoss has named a suspect or disclosed how the attackers reached the refrigeration controllers.

Did NoName057(16) Claim the Supermarket Attack?

No. NoName057(16) has claimed DDoS attacks on French targets and an intrusion at a small hydroelectric plant in recent days, as part of a campaign against France that predates this week, but its posts do not mention the supermarket attack.

Which Supermarkets Were Affected?

Intermarché and Netto, Coopérative U (Super U, Hyper U), Carrefour, Monoprix and E.Leclerc reported affected stores. Intermarché and Netto were hit hardest, with reported counts from about 150 to at least 300 stores, followed by Coopérative U and Carrefour with 80 each.

Which Danfoss Systems Were Affected?

Danfoss named the AK-SM 800 and AK-SC 355, both end-of-life models that no longer receive software or security updates. Some current AK-SM 800A units running outdated firmware were also hit.

Were the Claroty-Disclosed Danfoss Vulnerabilities Used in the Attack?

There is no confirmation. CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452 affect the AK-SM 800A, Claroty’s research did not cover the two end-of-life models Danfoss named, and no authority or vendor has linked the flaws to this incident.

How Many Danfoss Controllers Are Exposed in France?

On October 13, 2026, SOCRadar found 2,898 Danfoss StoreView results in France on Shodan and 881 unique hosts on Censys. France accounts for about 65% of exposed StoreView interfaces worldwide.

Were Countries Other Than France Affected?

Sekoia analyst Felix Aime said Spain, Portugal, Poland, Germany and Belgium were also affected. Retailers in those countries had not confirmed incidents at the time of writing.

What Should Refrigeration System Operators Do Now?

Follow CERT-FR’s alert: disconnect AK-SM and AK-SC controllers from the internet or filter access tightly, treat exposed units as possibly compromised, replace end-of-life models, audit contractor remote access and add independent temperature alarms.