Report

Cyber-Physical Attack on French Retail Refrigeration

France’s Supermarket Refrigeration Cyberattack: OT Risks, Attack Analysis, and Lessons for Industrial Security

Overnight on 11-12 October 2026, refrigeration systems across multiple French supermarket banners, Intermarché/Netto, Coopérative U, E.Leclerc, Carrefour and Monoprix, were disrupted in what the Paris prosecutor confirmed was a large-scale cyberattack. The affected systems were Danfoss AK-SM800, AK-SC355 and AK-SM800A refrigeration controllers, several of them end-of-life or running outdated firmware. France's Prime Minister ordered ANSSI, the national cybersecurity agency, to investigate.

Shieldworkz has produced a confidence-graded intelligence assessment of this incident, separating what is confirmed, what is only reported, what is inferred, and what remains an open hypothesis. The report also corrects a specific error circulating in media coverage: several outlets have wrongly linked this attack to Danfoss advisory DSA-2026-08-01 and CVE-2026-15203, which in fact concerns unrelated iC7-Automation drive software, not the AK-SM/AK-SC refrigeration managers involved here. This report does not treat that CVE as relevant to the incident.

This is not a retelling of the headlines. It is a claim-by-claim confidence matrix, a reconstructed timeline from 2016 through the attack, five tested hypotheses on access and cause, a blast-radius and time-to-spoilage risk model, and a prioritised remediation plan, built for any organisation that depends on internet-reachable OT devices to keep physical operations running.

Why This Report Matters

This incident is a case study in a risk pattern that extends far beyond retail refrigeration: a single, internet-reachable OT device class failing at scale, with real-world physical consequences.

It is a cyber-physical event, not a theoretical risk. At high confidence, this was direct manipulation of refrigeration systems rather than an IT outage, forcing continuous defrost cycles and, by some retailer accounts, temperatures reported as high as 50°C, with fires occurring through a mechanism that remains unconfirmed.

The exposure was systemic, not an isolated misconfiguration. Scanners counted roughly 2,765 internet-exposed Danfoss AK-SM 800A consoles before the attack, with multiple independent scans afterward still finding thousands of exposed units, evidence of a structural dependency, not a single customer's oversight.

The attack followed a public roadmap. Claroty Team82 published a technical write-up on the relevant vulnerability class 63 days before the attack, including a DEF CON 34 demonstration, yet the report finds no evidence the attackers specifically used that published research, and is careful not to overstate what is “unprecedented” about the technique itself versus its scale and target.

A quieter variant may exist. The observed attack was loud and highly visible, forced defrost, alarms, spoiled stock. Published research referenced in the report shows a silent variant is technically possible, which is arguably the greater long-term risk for any organisation relying on visible failure as its detection method.

Attribution and root cause remain unresolved. No group has claimed the attack, no ransom has been reported, and the specific vulnerability or credential path used is unknown, Danfoss has stated only that affected units were running outdated firmware. The report treats this honestly as an open question rather than filling the gap with speculation.

Why Downloading This Report Is Critical for Your Organization

Any organisation operating internet-reachable OT or building-management devices, refrigeration, HVAC, access control, or similar embedded controllers, shares the exposure pattern behind this incident, whether or not it runs Danfoss equipment.

A confidence-graded intelligence picture. Every major claim in the source incident, store counts, loss estimates, duration, cause, is explicitly labelled Confirmed, Reported, Inferred, Hypothesis or Unknown, so you can see exactly how solid each piece of evidence is before you act on it.

Five tested hypotheses on access and cause. The report works through plausible explanations for how the attackers gained access and what they changed, rather than assuming the first headline explanation is correct.

A prioritised, actionable remediation plan. Thirteen recommendations (R1–R13), each mapped to a specific failure mode, an owner, a constraint, and a concrete test of effectiveness, covering exposure removal, firmware lifecycle, secure remote access, credential hygiene, segmentation, independent monitoring, and joint incident response.

A KPI/KRI scorecard built for resilience, not optics. The report explicitly warns against metrics that reward activity over resilience, for example, why patch percentage alone misleads, and ties its recommended metrics to drills, not just paperwork.

A regulatory map without overreach. The report surveys IEC 62443, NIST CSF 2.0, NIST SP 800-82, ISO 27001/22301, the NIS2 Directive, the EU Cyber Resilience Act, and EU food-safety law, honestly noting where applicability is still uncertain rather than asserting a mandate that may not exist for your organisation.

Key Takeaways From the Report

Direct cyber-physical manipulation, high confidence. The affected layer was the refrigeration system manager / OT-class supervisory device, specifically Danfoss AK-SM800 and AK-SC355 (legacy, no updates) and AK-SM800A (outdated firmware).

Access vector unknown; exposed management interfaces are the most probable class. At moderate confidence, with roughly 2,765 internet-exposed AK-SM 800A consoles identified by Claroty/Censys before the attack.

Store counts and loss estimates vary by source and are not fully reconciled. Reported figures range from roughly 150 to 500 stores depending on the retailer and source, with national loss estimates described as “tens of millions of euros”, an unaudited executive estimate, and two Haguenau stores specifically reporting about €270,000 in losses.

The two Danfoss CVE threads must not be conflated. DSA-2026-08-01 and CVE-2026-15203 concern iC7-Automation drive software and are explicitly unrelated to the AK-SM/AK-SC refrigeration managers involved in this incident, a distinction several media reports got wrong.

Whether this links to the August 2026 US military commissary outages is unknown. The resemblance is in effect only; no confirmed shared cause has been established.

Thirteen prioritised remediation actions span exposure, authentication, segmentation, independent monitoring and incident response. Top priorities (P1) include removing direct internet exposure of refrigeration and BMS management interfaces, inventorying every controller, applying firmware lifecycle management, securing remote access with MFA and just-in-time grants, and deploying independent temperature monitoring not dependent on the controller UI.

No framework should be assumed mandatory without verification. The report is explicit that legal applicability of NIS2, the EU Cyber Resilience Act, and other frameworks depends on entity type, size and member-state law, and recommends verifying with counsel rather than assuming coverage.

How Shieldworkz Supports Your OT Cyber-Physical Resilience Journey

The report's own remediation plan points directly to where Shieldworkz capabilities apply, and is careful to frame this as guidance, not a claim that any product would have prevented this specific incident.

OThello Assess for rapid inventory and gap assessment. Supports rapid IEC 62443, NIS2 and related assessment cycles with sub-24-hour cycles, directly addressing the report's recommendations to build a controller inventory and dependency map (R2, R3, R6).

Shield Sensor and OThello NDR for passive OT network monitoring. Addresses the report's call for detection on set-point changes, defrost-duration anomalies, new administrator logins, and simultaneous multi-site anomalies (R9), without requiring active scanning of fragile embedded devices.

OThello TI for exposure and threat tracking. Supports ongoing visibility into internet-exposed management interfaces across owned and contractor address space (R1), the single highest-priority action in the report's remediation plan.

Regulatory playbooks and remediation guides. Practical, document-based guidance published at mapped to the IEC 62443, NIS2 and related frameworks surveyed in this report.

OT SOC design and incident response support. For the joint, cross-team incident response the report recommends across SOC, OT, facilities, food safety and suppliers (R11), with evidence-preservation steps appropriate for embedded devices.

Download the Report

Get the full confidence-graded intelligence assessment, the incident facts and confidence matrix, the reconstructed timeline, five tested hypotheses on access and cause, the blast-radius and time-to-spoilage risk model, the complete 13-point remediation plan, the KPI/KRI scorecard, and the regulatory landscape, to understand what this incident really shows about internet-exposed OT, and what to do about it before your own organisation becomes the next case study.

Schedule a Demo With Shieldworkz OT Security Experts

Download your copy now!

Get the Full French Supermarket Cyberattack Report

Discover the OT vulnerabilities, attack impact, and key lessons for stronger cyber resilience.