Five days before the French supermarket fridge attack, France had more exposed Danfoss StoreView dashboards than the rest of the world combined

On October 11-12, 2026, a cyberattack pushed refrigeration systems in hundreds of French supermarkets into defrost mode, damaging equipment and causing food spoilage. Analysis of Internet scans revealed 2,528 Danfoss StoreView dashboards exposed globally, with France alone accounting for 1,331 (53%). Approximately 85% of these French dashboards ran software with known vulnerabilities, including 527 end-of-life AK-SM 800 controllers and many missing critical patches from 2023 and 2025. These dashboards were mostly connected via telecom networks and had been exposed for at least six months. Post-attack scans showed a 76% reduction in exposed French dashboards, indicating many stores disconnected their systems instead of patching. The attack method is not confirmed, and CERT-FR has issued advisories recommending disconnection or restricted access to affected controllers. The incident highlights widespread exposure of vulnerable industrial control systems in retail refrigeration.

The attack caused refrigeration units in hundreds of French supermarkets to enter defrost mode, leading to equipment overheating (up to 50°C), fires, and significant food spoilage. Financial losses are estimated in the millions of euros. The exposure of vulnerable Danfoss StoreView dashboards facilitated potential unauthorized access to refrigeration controllers. The incident disrupted operations of major French retail chains including Carrefour, Intermarché, Netto, Monoprix, Leclerc, and Coopérative U. The widespread presence of unpatched and end-of-life controllers increased the risk and impact of the attack. The attack also prompted a significant reduction in exposed dashboards as stores disconnected affected systems.

CERT-FR advises operators to disconnect vulnerable Danfoss AK-SM and AK-SC controllers from the Internet or restrict network access to authorized personnel only. After the attack, many stores disconnected their dashboards rather than applying patches. Operators should verify insurance terms before cutting off data access to refrigeration contractors. Since many affected controllers are end-of-life and no longer supported, disconnection or network segmentation is recommended. Monitoring for ongoing attack campaigns is advised as CERT-FR indicates attacks may still be active. Patch status is not explicitly confirmed in the data; operators should consult Danfoss and CERT-FR advisories for updates and remediation guidance.