top of page

EPA AIM Act  enforcement is live. Violations: up to $59,114 per day, per violation. Are you compliant? →

What France's Supermarket Refrigeration Attack Means for U.S. Grocers

Amrit Robbins
2 days ago
12 min read

Updated: 1 day ago

Refrigeration controller security: illustrative overnight case temperatures across many stores climbing toward a 50°C (122°F) defrost setpoint while controller alarms are disabled

CYBERSECURITY | OCTOBER 2026


How Should Grocery Retailers Secure Refrigeration Controllers Across Every Brand in Their Fleet?


Key Takeaways

  • Overnight on October 11–12, 2026, attackers forced refrigeration controllers in hundreds of French supermarkets into defrost at a 50°C (122°F) setpoint, in some units reportedly stretching defrost from one hour to eight. Controllers hold temperature alarms during defrost, so at many stores the alarms came hours after the food was lost. France's finance minister put the count at about 700 stores.

  • The exposure spans leading controller brands, including Danfoss and Copeland, and some older controllers will never get a security fix.

  • This was not a generic hack. Whoever ran it understood refrigeration control well enough to pick defrost, the one routine that warms a case on purpose while holding its alarms.

  • AI can be used to attack or defend: it lowers the skill an attacker needs next time, and it lets defenders find weak controllers first.



Do you know which firmware version is running on the refrigeration controller in your busiest store tonight, and whether its login page is reachable from the public internet?


Last week, four people texted me some version of the same question: could this happen here? My read is that the ingredients are already here. The French attack needed no exotic exploit; it needed old controllers left open on the public internet and a defrost function that was functioning normally (as designed). Scans so far find dozens of exposed U.S. controllers, not the thousands counted worldwide. That is a fixable list.


Where Axiom stands, up front: we don't sell controllers. Our monitoring sits on top of every brand as a redundant layer: it reads the data your controllers already produce, then applies its own logic and alerting, so it doesn't rely on any controller's built-in alarms. We bring refrigeration control expertise plus AI and cloud engineering under one roof. We work for the operator.


Stat: 75% of organizations have building management system devices affected by known exploited vulnerabilities, and 51% have devices that are both vulnerable and insecurely connected to the internet (Claroty Team82, State of CPS Security, 2025).

What actually happened in French supermarkets?

Thierry Cotillard, president of Intermarché's parent Les Mousquetaires, told AFP the attackers put "all our refrigerated cases into defrost" and raised them "up to 50 degrees" Celsius, or 122°F (translated from French). He put losses, on BFM TV, at "tens of millions of euros nationwide in a single day." The Paris prosecutor opened a criminal investigation, and the night after, a Leclerc store emptied its cases following an attack on Dixell equipment: a second night and a second product line.


In some ways, the method of the attack was more worrisome than the consequences. Le Monde, as cited by TIME, reported that the attackers extended the defrost cycle in some freezers and cold rooms "from one hour to eight hours to delay alarms." Temperature alarms are disabled during defrost, because a case is supposed to warm while its coils clear. Nobody had to touch the alarm settings: a stretched defrost keeps them quiet until the food is already gone. When the controller's own alarms are part of the attack, you need a redundant monitoring layer that doesn’t rely on the controller’s built-in alarms.


Timeline of the French supermarket refrigeration cyberattack, October 11–16, 2026, showing two nights of controller attacks and CERT-FR alerts

Store counts vary from about 250 in early reports to about 700, the figure France's finance minister gave Parliament on October 13. As of October 16, nobody has claimed the attack and no known software flaw has been publicly tied to it.


Has anything like this happened in the U.S.?

Nobody knows yet. Since late August, commissaries (grocery stores on military bases) on at least six U.S. installations have lost refrigeration. Stars and Stripes reported that some appliances "went into defrost mode, causing thousands of dollars of food to spoil." Army and Air Force investigators are looking into the outages.


No cause, controller vendor or link to France has been established; Reuters said only that the French attacks "resemble" the commissary disruptions.


The exposure includes the U.S. A passive scan by Flare Research, published October 15, found at least 84 U.S. addresses exposing a refrigeration system manager to the public internet, and 65% of confirmed controller addresses also exposed other services such as remote desktop or VPN gateways.


Why does it matter that whoever did this understood refrigeration?

Plenty of attackers can break into a web interface left open on the public internet. Few would know what to do once inside a refrigeration controller. Whoever ran this attack did. Shutting compressors off would have raised high-temperature alarms within the hour, so they chose defrost instead: the one routine that warms a case on purpose and tells the controller to hold its alarms while it runs. Then they stretched it long enough to outlast every alarm delay, across hundreds of stores, overnight. That is refrigeration control strategy rather than network hacking. As Joshua Steinman, CEO and co-founder of Galvanick, put it: "Defrost isn't an exploit; it's functionality, and there is no attack signature for a feature doing what it was designed to do."


Why did such a simple attack work across hundreds of stores?

The technical barrier was low. Danfoss said most affected units were end-of-life models that "no longer receive software or security updates," and a login bypass for those legacy controllers has been public since 2023. Claroty Team82 counted 2,765 AK-SM 800A interfaces reachable from the public internet in its August report. Days after the attack, the Shadowserver Foundation still counted about 350 AK-SM 800A units online with its own fingerprint, a different scan from Claroty's, along with 1,173 Copeland XWEB controllers, and Censys saw more than 2,900 Danfoss StoreView hosts.


Danfoss is one brand of several. CERT-FR's alert names Danfoss and Copeland, including Copeland's Dixell line. Researchers disclosed 23 vulnerabilities in Copeland XWEB Pro controllers in February 2026, and Copeland's E2, end-of-life since October 2024, carries a critical flaw for which Copeland's answer is migration to E3. Patches are available for some flaws, but they never get installed. Some flaws never receive patches at all.


Why are refrigeration and HVAC controllers the most overlooked IoT devices in your portfolio?


Ask who owns controller firmware at your company, then follow the answer around the room. IT says the controllers are facilities' equipment. Facilities says they sit on IT's network. The refrigeration contractor holds the remote login, but patching isn't in the contract. The store manager is the one who hears the alarm, and has no way to fix it. Everyone points to someone else, and the firmware update never gets deployed.


Most retailers have already moved HVAC and refrigeration controllers onto a network separate from the point-of-sale system. That stops an attacker from hopping from a controller to the registers. It does nothing about the other ways in: a contractor's cellular modem, remote-access software on a store PC, or a controller left reachable from the public internet.


How much does one night of compromised refrigeration cost?

Now do the math. FMI puts the average U.S. supermarket at $668,377 in weekly sales and a 2.1% net profit, or about $14,036 of profit per store, per week. French store managers reported write-offs of about €50,000 to more than €200,000 per location, and retail food safety guidance is blunt: the Conference for Food Protection's emergency action plan for food retailers gives food that has warmed to 60°F (16°C) four hours to get back under 41°F (5°C) before it must be cooked or discarded. The French cases spent hours far hotter than that.


Chart showing how one night of spoiled inventory from a refrigeration cyberattack erases 3.6 to 14.2 weeks of an average supermarket's net profit

Treat the euro figures as dollars; at this week's rate of about $1.12 per euro that understates the U.S. equivalent, so the math that follows is conservative. Applied to a U.S. store, a $50,000 loss erases 3.6 weeks of profit; a $200,000 loss erases 14.2 weeks. Hit 150 stores in one night, roughly what Intermarché reported, and the inventory loss alone reaches $7.5 million, before fire damage and lost sales. Don't assume insurance covers it: insurers and brokers told Reuters that cyber policies typically exclude physical losses such as spoiled food. Ask your broker whether you carry perishable-stock cover that responds to a cyber event.


The product is only the cost you can count the next morning. Store teams then lose days emptying, sanitizing and restocking every case.


How is AI changing the odds for attackers and defenders?

AI lowers the skill needed to find and use these weaknesses. Investigating an intrusion at a Mexican water utility, Dragos found that "the adversary did not demonstrate meaningful knowledge of OT or ICS. Claude provided that context autonomously." AI can supply the operational know-how an attacker lacks. And the patch window has collapsed: Mandiant's M-Trends 2026 puts mean time to exploit at an estimated minus seven days, so exploits now routinely arrive before the patch.


Chart of mean time to exploit falling from 63 days in 2018–19 to an estimated -7 days in 2025, showing why IoT device security cannot wait for patch cycles

The same AI helps defenders spot weak controllers and unusual behavior across a whole fleet first. Finding flaws is getting cheap; fixing them across hundreds of stores and several controller brands is the bottleneck, and many controllers will never get a patch at all.


What should you do about controllers that can never be patched?

Rank the risk rather than treating every old controller as an emergency. Two questions sort almost every controller in a fleet: does its manufacturer still support it, and can it be reached from the public internet? CERT-FR warns that end-of-life equipment left open on the public internet faces "a very high probability of compromise" (translated from French).


Flowchart sorting refrigeration controllers into four risk tiers (urgent, plan replacement, patch, monitor) by manufacturer support and public internet exposure.

Closing public access does not mean going dark. CERT-FR's own guidance is to restore access "only via a secure VPN or protected network" (translated), which is how most monitoring and service vendors should be connecting anyway. As a stopgap, CERT-FR also allows a firewall rule that admits only your refrigeration contractors' addresses, while warning that this is not a lasting fix.


Tier

What it describes

What to do

Urgent

Unsupported or unpatched, and reachable from the public internet

Close public internet access now, keep approved vendors and monitoring on a secure VPN, then schedule replacement

Plan replacement

Unsupported, not reachable from the public internet

Keep every connection on a secure VPN or approved encrypted cloud link, then replace on a schedule

Patch

Supported, but on outdated firmware

Plan the firmware update and the strictest login settings with every vendor that connects to the controller, so monitoring doesn't drop at cutover

Monitor

Current firmware, strict settings, no public internet access

Keep connections on a secure VPN or approved cloud link, and watch for changes

Apply the same standard to every brand in the fleet. A rule that flags one manufacturer's obsolete controllers but not another's is not a security standard.


Replacing hundreds of controllers takes quarters or years. The real exposure lives in that gap.


What kind of partner does this threat call for?

The attacker brought refrigeration expertise and cheap tools. Defense needs the same pairing, at fleet scale. OT security tools see network traffic, not refrigeration: they can flag an exposed controller, but not whether a defrost setpoint is normal for that case. Most refrigeration teams, for their part, don't run security operations. U.S. grocers need a partner with deep refrigeration expertise and deep cloud, IT and AI expertise: someone who knows what each controller function means for the rest of the system, and the tooling to watch every store at once. That combination is what Axiom is built on.


It also matters that the partner doesn't sell controllers. Every controller manufacturer has a reasonable answer to this attack, and it is usually its newest controller. That advice is shaped by what each company sells, and most fleets run more than one brand. Axiom sells no controllers and applies the same standard to a Danfoss AK-SM and a Copeland E2.


Any vendor connected to your controllers should be able to state exactly what it adds to your attack surface and how it limits it. Axiom reads controller data through secure integrations: direct connections to databases or application APIs, encrypted IKEv2/IPsec site-to-site VPNs, or Zero Trust Network Access (ZTNA). On a VPN, your team decides who can bring up the tunnel (us, you or either side) and allowlists our fixed set of addresses. Access is read-only by default, with write access enabled only at a customer's request. Credentials sit in a managed secrets vault, and Axiom has a current SOC 2 Type 2 report. None of these paths exposes a controller to the public internet.


Axiom doesn't push firmware and cannot prevent an attack on its own. Because it already connects to the controllers in every store without new hardware, it can help run the program:

  • Size the problem. Turn "replace everything" into a ranked list of stores with unsupported or outdated controllers, which firmware each runs and, with your IT team, which are reachable from the public internet.

  • Harden what can be hardened. Flag supported controllers on old firmware or default passwords, plan the fixes with your contractors and every connected vendor, then confirm from the data that they took. A controller with no published vulnerability is not the same as a secure one.

  • Watch the gap. France and the commissary reports share one visible pattern: many units in defrost at once, across many stores. Axiom watches for it as a redundant layer that reads the temperatures and defrost states your controllers already report, applies its own logic and sends a cloud-based alert that doesn't depend on the controller's alarm settings or delays. An attacker can quiet one store's alarms; hiding the same pattern across a fleet is much harder.

  • Secure connections without going dark. The January 2026 NCSC and CISA principles favor brokered vendor access and connections started from inside your network. Ask each vendor whether your side can be the one that brings up the connection, and limit it at your firewall to named addresses and only the controllers it needs.

  • Sequence and verify replacements. Rank replacements by exposure and age, time them with planned refrigeration work, then confirm each new controller runs current firmware with its strictest settings on.


None of this replaces network segmentation or your IT security team's review, and no platform makes a fleet immune.


What should you do this week?

Four steps need no capital and can start this week:

  • Have IT scan your public IP ranges and search Shodan or Censys for controller login pages; a controller behind a contractor's cellular modem won't be in your ranges.

  • List every remote-access path into your controllers, including each contractor modem and remote-desktop tool.

  • Change default and shared passwords on every controller, store by store, with every contractor and vendor told the day before.

  • Pull every controller's maximum defrost duration and defrost-overrun alarm setting from one fleet-wide export, and flag any controller with the overrun alarm off.


Then ask your team:

  1. Which stores run controllers that are end-of-life or on firmware older than the vendor's latest security release?

  2. Can any controller's management interface be reached from the public internet, directly or through a contractor's remote-access device?

  3. Who holds remote login credentials for your controllers, and when were default passwords last changed?

  4. If someone pushed every case in a store into defrost overnight, would your alarm center or service contractor ever hear about it?

  5. If IT shut off public internet access to every controller tomorrow, which vendor connections would break, and would you still have visibility into every store?

  6. Who on your security team knows what a defrost setpoint does, and who on your refrigeration team sees your security alerts?


If you can't answer all six, you don't know your exposure yet.


Your refrigeration controllers are part of your attack surface. Treat them that way.

France's warning cost millions in spoiled food and shopper goodwill, and the controllers involved run grocery fleets everywhere. Whoever hit France understood refrigeration. The fleets that answer with the same depth, and put monitoring on top of every controller that doesn't depend on its own alarms, will read about the next attack rather than live it.


Send the six questions above to your CIO and your refrigeration lead; you need both sets of answers.


Reach out to our refrigeration and AI team for a walkthrough of how Axiom finds the exposed and outdated refrigeration and HVAC controllers across your stores, whatever brand they are, and how we help you close those gaps.



Sources:

3. Danfoss moves to mitigate cyberattack - Cooling Post, Oct 12, 2026, updated Oct 13, 2026

9. Authentication bypass in Danfoss System-Managers models SM800 and SC255 - Synacktiv, May 22, 2023, updated Oct 31, 2023

14. Supermarket facts - FMI, The Food Industry Association, 2025

17. How low can TTE go? Analysis of 2023 time-to-exploit trends - Google Cloud / Mandiant, Oct 2024

18. M-Trends 2026 - Google Cloud / Mandiant, 2026

21. Refrigeration hack affected about 700 French supermarkets, government says - ComplexDiscovery (citing AP), Oct 14, 2026

24. Secure connectivity principles for operational technology - UK NCSC with CISA, FBI and partners, Jan 2026

27. Thousands of refrigerator devices remain exposed following French cyberattack - Cybersecurity Dive, Oct 15, 2026 (citing Shadowserver Foundation)

Comments

bottom of page