Overnight on 11–12 October 2026, attackers pushed refrigeration systems at hundreds of French supermarkets into continuous defrost, with temperatures reaching 50°C. Fires broke out at several stores and food was spoiled. According to Al Jazeera, citing AFP and Reuters, at least 300 Intermarché or Netto shops were targeted, along with more than 100 Coopérative U outlets and 80 Carrefour supermarkets. Monoprix said about 5% of its roughly 490 stores were hit. Intermarché's chief executive put the losses at tens of millions of euros in a single day.
The counts are not settled. Reuters, via TimesLIVE, quoted the Mousquetaires group as saying about 150 of its stores were affected, with fridges at up to 50°C for six hours. Other reporting cites the 300 figure. Final damage numbers are still being compiled.
What actually failed
The attack appears to have been simple. BFM TV, as relayed by Al Jazeera, reported that the hackers remotely triggered forced defrosting. Danfoss said the affected units were running outdated firmware and that it had long urged customers to update or replace legacy equipment.
France's national response points to exposure as the core problem. ANSSI's incident team published alert CERTFR-2026-ALE-012 on 12 October and updated it on 13 October. It lists Danfoss AK-SC and AK-SM controllers, plus Copeland xweb and Dixell xweb. The alert says exposing a management interface to the internet is contrary to good practice. It also warns that a factory reset alone is insufficient, because it removes persistence but leaves the device vulnerable. It adds that keeping an unpatched end-of-life device exposed carries a very high risk of compromise.
The public record is not conclusive on the exploit. In August, Claroty's Team82 published research on Danfoss AK-SM 800A controllers. It described a hidden date-derived "code-of-the-day" login bypass (CVE-2025-41450) and a command-injection flaw (CVE-2025-41451). A Censys scan found 2,765 exposed AK-SM 800A devices, and Danfoss fixed the flaws in newer firmware. Investigators have not confirmed that these specific bugs were used on 11–12 October, so treat the link as plausible but unproven.
The strongest case for tougher mandates
The case for stricter rules deserves a fair hearing. Store managers do not audit firmware, and a grocery chain buying cooling equipment cannot assess embedded web servers. Vendors know which units are internet-reachable and can see when support has ended. A market where the buyer cannot evaluate security and the seller bears none of the loss will under-invest in patching. Fires and spoiled food are physical harms, not data-breach abstractions, and the lesson that connected industrial equipment is critical infrastructure arrived at real cost.
Why the answer is mostly enforcement of what already exists
Europe has already legislated the main fix. The Cyber Resilience Act entered into force on 10 December 2024. Its reporting obligations apply from 11 September 2026, and its main obligations from 11 December 2027. It requires manufacturers to handle vulnerabilities across a product's lifecycle. The France incident arrived one month after reporting began and about fourteen months before the substantive duties bite.
That timing is the lesson. These controllers were installed before the Act applies, so the Act cannot retroactively secure them. The practical gap is the installed base: fielded, unsupported equipment with a public IP address. Adding new mandates now would not touch it. Three measures would:
- Exposure hygiene by default. Removing the public interface and requiring a VPN or filtered access, as CERT-FR recommends, closes most of the attack surface at near-zero cost.
- Honest end-of-support dates. Vendors should publish when a controller stops receiving fixes, so operators can budget replacement instead of discovering it during an incident.
- Fast, specific advisories. The Claroty disclosure existed in August. The gap between a published flaw and fleet-wide remediation is where the damage happened.
The retailers also carry responsibility. A national supermarket chain runs thousands of refrigeration endpoints and treats them as facilities equipment rather than networked computers. Contractors who remotely monitor cooling often need connectivity, which is why CERT-FR advises checking insurance terms before cutting uplinks. The incident shows the cost of that convenience.
The risks of overcorrecting
A reflexive response, such as blanket liability for any exploited IoT product, would raise costs for the manufacturers and installers of legitimate, well-maintained equipment. It would also push small vendors out of a market that depends on interoperable, cheaply serviced hardware. Proportionate policy targets the failure mode demonstrated here: internet-exposed, unsupported devices.
The cross-border reach strengthens this approach. Sekoia analyst Felix Aime told Reuters that Spain, Portugal, Poland, Germany and Belgium were also affected, and that single-source claim remains unconfirmed. If correct, it shows why EU-level harmonised vulnerability handling under the CRA beats a patchwork of national responses. France said it is coordinating with European counterparts.
What to watch
Several facts will determine how policy should respond. First, whether ANSSI and the Paris prosecutor identify the actual exploit and the actor behind it. Second, how many compromised units were fully patched versus legacy. Third, whether insurers start requiring exposure audits for refrigeration and building-management systems. If most affected devices were end-of-life, the lesson is that support transparency and network segmentation do the work. If current, patched firmware was breached, the case for stronger pre-market assurance gets harder to dismiss, and the Act's 2027 obligations will be the first real test.
Until then, the least costly intervention is the least glamorous one: take management interfaces off the public internet, and retire controllers their makers no longer support.