13 October 2026 · Reporting checked on this date
Imagine arriving at work and discovering that the food in your freezers has started to thaw. The doors are closed. The electricity is on. But someone, somewhere, has interfered with the system that keeps everything cold.
Now imagine that happening across hundreds of supermarkets.
Overnight from 11 to 12 October 2026, a cyberattack disrupted refrigeration at French supermarket chains. By Monday, affected stores were removing fresh and frozen products from sale. Intermarché, Coopérative U and E.Leclerc were among the retailers that confirmed disruption. AFP reporting via CNA
For the people working in those shops, cybersecurity suddenly meant clearing shelves and throwing away stock.
My concern is whether organisations understand which connected systems their operations depend on, who controls them and how they would recover if those systems failed. The incident gives us a reason to ask those questions across IT, operational technology and connected devices.
What Actually Happened?
The attack targeted the systems used to manage refrigeration. Reporting described attackers remotely activating defrost functions, causing food to warm. Intermarché told BleepingComputer that affected display units had been taken out of service and products were being removed. BleepingComputer
France’s national cybersecurity response team, CERT-FR, issued an alert on 12 October confirming numerous compromises of Danfoss AK-SM and AK-SC systems. It advised disconnecting or filtering network access to the affected systems. CERT-FR alert
Reports also described extreme temperatures and fires; their relationship to the attack remained under investigation. Sky News, AFP via CNA
Reports described hundreds of affected stores, although counts varied.
How Does a Fridge Become a Cybersecurity Problem?
Think of a refrigeration management system as a control desk. It helps operators monitor equipment and change how it runs. Danfoss’s AK-SM 800A, for example, brings information from multiple devices into a web interface used to monitor and configure an installation. Claroty Team82
That is useful when the right person is at the controls.
But if an attacker gains control, the consequences can leave the screen and reach the shop floor. A changed setting can affect the equipment. The equipment affects the food. The shop then has a problem that restarting a computer cannot undo.
This is the kind of risk covered by operational technology, usually shortened to OT: systems that monitor or control physical processes.
What We Still Shouldn’t Assume
There is an important difference between finding a weakness in a product and proving that a particular attack used it.
Claroty’s Team82 published research in August 2026 describing vulnerabilities in the AK-SM 800A management interface, including ways to bypass authentication and execute commands. The researchers said Danfoss addressed their findings in updated firmware. That is relevant background; it does not establish which vulnerability was used in France. Team82 research
CERT-FR’s incident alert does not name a specific exploited vulnerability or attacker. CERT-FR, Sky News
Treat claims about the culprit, an exact exploit, or a single coordinated campaign accordingly.
“It Still Works” Can Hide Another Problem
A freezer can keep doing its everyday job while the software managing it has fallen out of support.
Danfoss’s October 2025 technical newsletter said the AK-SM 800 had reached end of life in May 2021 and discussed ending service for several older products. It encouraged customers using those systems to plan replacements. The AK-SM 800 and AK-SM 800A are distinct product names; their support status should not be treated as interchangeable. Danfoss technical newsletter
That leaves a practical question for a business owner: who checks the software’s support life while everyone else checks whether the equipment is still running?
An organisation needs a clear answer. Otherwise, the maintenance contractor may expect IT to handle it, IT may expect the supplier to handle it, and the shop may assume both already have.
Five Questions to Ask About Your Own Equipment
You do not need to become a refrigeration engineer to start this conversation. Get your operations team, IT team and maintenance provider together and ask:
- What is connected, and who owns it? Ask for an inventory with a named owner, software or firmware version and support date for each system. Include equipment outside the usual laptop and server list. If nobody can provide that information, assign someone to establish it.
- Who can reach the controls remotely? Ask to see the active staff and supplier accounts, their permissions and the date of the last access review. Check that remote access uses a protected route and strong authentication. Remove accounts and permissions that are no longer needed.
- What separates this equipment from the rest of the network? Ask which connections are actually permitted between the equipment, business systems and the internet, and why each is needed. Have IT and the equipment owner verify those rules together, accounting for operational dependencies.
- Who notices and responds when something behaves unexpectedly? Decide which changes require action: altered settings, missing readings or unexpected connections. Ask when an alert last reached its owner in a test and whether the response worked. For safety-critical processes, discuss independent monitoring with qualified engineers.
- What happens if remote access has to be cut off? Ask when recovery was last exercised, what failed and whether the gaps were fixed. Review configuration backups, escalation contacts and safe local operation with qualified technicians. A written plan needs evidence that people can use it.
Those last two questions are practical resilience checks. An alert and a recovery document only help if people can use them under pressure.
These questions apply established OT security principles to a retail setting. NIST’s guidance on remote access explains the value of asset inventories, restricted access, authentication and network separation. NIST
If Your Business Uses the Affected Systems
Ask your refrigeration provider and security team to check the current CERT-FR alert together.
For suspected compromise, the alert describes restricting network access, factory resetting equipment, applying available security fixes, changing secrets, checking accounts and reconfiguring the system. Coordinate that work with the technicians responsible for keeping the installation safe and operational. CERT-FR remediation guidance
For unsupported equipment, ask for a replacement plan as well as immediate protective measures. “We’ll update it later” needs an actual supported update behind it.
Where I Would Start
My advice is to start with one business process your organisation cannot afford to lose. Bring together the person who owns that process, IT, security and the suppliers it depends on. Map the systems involved, who can access them and what happens if they become unavailable.
Then ask for evidence. When was access last reviewed? Who receives an alert? When was recovery last tested, and what did that test reveal?
You do not need to solve every security problem in one meeting. You do need to leave with clear responsibilities, agreed priorities and a date to check progress.
The question I would leave with every business owner is simple: if an essential system failed tomorrow, which parts of your response have you tested—and which are still assumptions?
