French Supermarket Cyberattack: Lessons for Retailers

Key Takeaways

• Controllers were reportedly internet-exposed, and Danfoss said affected units were older kit without security updates.
• As at 23 October 2026 the attacker, exact method and final cost are unconfirmed.
• Refrigeration and building controllers belong in your asset register and your security scope.
• Remove public exposure, change default passwords and replace unsupported equipment.
• Rehearse manual monitoring and stock plans and check insurance wording before you need it.

The French supermarket cyberattack of 11 to 12 October 2026 showed that a shop's refrigeration controllers can be a cyber target as much as its tills or its customer database. Unknown attackers reached internet-exposed controllers and, according to reports, forced defrost cycles that spoiled stock in hundreds of stores. The main lesson for retailers is simple: find every connected device in your estate, take management interfaces off the internet and replace kit that no longer receives security updates.

This article sets out what has been confirmed as at 23 October 2026, what has not, and what a UK retailer, convenience chain or food business can do this week. It will be updated as the investigation develops.

The advice applies well beyond supermarkets. Any business with chillers, building controls, EPOS peripherals or remote-monitored equipment has the same exposure. A managed IT support partner can help, but the first steps cost little and most can start with a spreadsheet and a phone call to your refrigeration contractor.

What happened in the French supermarket cyberattack?

Overnight on 11 to 12 October 2026, refrigeration controllers in French supermarkets were reportedly manipulated remotely so that units ran defrost cycles when they should not. Several chains, including Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc, reported problems, and BleepingComputer reported the Paris prosecutor's office opened an investigation into the large-scale attack, partly because fires were linked to it.

Reports differ on scale. BleepingComputer cited French outlets putting affected stores at 250 to 350, while The Local France reported at least 300 Les Mousquetaires stores (Intermarché and some Netto), about 100 Coopérative U stores, about 80 Carrefour stores and about 30 Monoprix stores. Treat these as press estimates, not audited figures.

The reported damage was physical and commercial: damaged refrigeration units, discarded fresh and frozen food, and disrupted trading. Initial loss estimates were in the millions of euros but the final cost was not established. There was reportedly no ransom demand and no evidence of data theft.

↑ Back to Contents

What do we know and not know as at 23 October 2026?

Several technical facts are well supported, but the cause, the attacker and the exact entry route are not confirmed. Separating the two stops you reacting to rumour.

We have not speculated about who is responsible and neither should you. For a retailer the attacker's identity changes nothing about the controls you need.

↑ Back to Contents

How did the attackers reach the refrigeration controllers?

The most likely route, based on reporting, was controllers whose web management pages were reachable from the public internet. The Local France reported that attackers allegedly used the Shodan search engine to find Danfoss devices, and some units use 3G cards for remote monitoring. That is reported, not confirmed.

Claroty's Team82 had earlier published research on the Danfoss AK-SM 800A. As summarised by TechRadar's report on the Claroty research, it found 2,765 publicly accessible systems and three flaws: an undocumented "daily code" login that can be derived from the date (CVE-2025-41450), command injection (CVE-2025-41451) and a web server configuration weakness (CVE-2025-41452). Danfoss released firmware R4.3.1 to address them, and advises restricting administrative interfaces to trusted networks or a protected VPN.

Those are the facts. What nobody has confirmed publicly is that these exact flaws were used on 11 to 12 October. BleepingComputer noted the earlier CVEs as possible context only.

↑ Back to Contents

Why is retail refrigeration controller security overlooked?

Refrigeration controllers are usually bought, installed and maintained by a facilities or refrigeration contractor, so they sit outside the IT team's inventory. That ownership gap is the core problem.

The same pattern appears across retail estates:

• Controllers installed years ago with a vendor default or shared password that nobody has changed.
• Remote access added so the contractor can respond to alarms, often via a public IP address or mobile router.
• Equipment that works perfectly, so nobody schedules a firmware update or replacement.
• No entry in the asset register, so it never appears in a vulnerability scan or an audit.

The NCSC treats this class of equipment as operational technology. Its NCSC operational technology guidance stresses safety, reliability and availability as the priorities, and sets out principles for keeping an accurate asset record, limiting connectivity and logging remote connections. Those principles apply at store level, not only in power stations.

Our article on why IT asset visibility matters covers how to build the register that makes this possible.

↑ Back to Contents

What can we learn from this?

The attack teaches six practical lessons, each of which a UK retailer can act on without a large budget.

Why does end-of-life equipment matter so much?

Unsupported kit cannot be fully secured, because the flaws will never be patched. CERT-FR, as summarised by Refindustry's summary of the CERT-FR alert, warns that a factory reset on end-of-life equipment is not enough since the controller can be compromised again. Plan replacement as a funded project, not an emergency.

Should management interfaces ever face the internet?

No. Put them behind a VPN or an allow-list of your contractor's addresses. CERT-FR calls the allow-list an emergency step rather than a permanent fix, so move to VPN or a managed secure connection.

Are default and shared passwords still a risk?

Yes. Change every default, use unique credentials per site, and where the vendor offers a hardened mode, such as the strict security mode CERT-FR recommends for Danfoss controllers, switch it on.

Do vendor advisories reach the right person?

Often they do not. Nominate an owner for vendor and CERT notifications for every connected product family. Subscribe to the NCSC and vendor feeds.

Would you notice a bad defrost schedule?

Alarm thresholds and configuration checks should flag unexpected temperature rises quickly. CERT-FR specifically advises checking defrost schedules on devices you believe are clean.

Have you tested running without the system?

Manual temperature logging, spare cold storage and supplier arrangements for emergency stock are the difference between a bad night and a lost week. See our business continuity plan template.

↑ Back to Contents

What should a retailer check this week?

Start with exposure and ownership, then work down. The table below is a working checklist you can hand to your IT lead and your refrigeration contractor.

The insurance line comes from CERT-FR's own advice, which says to confirm contractual terms before cutting internet-based data transmission to service providers. Some warranty and monitoring contracts depend on that connection, so check first, then replace it with a secure route.

↑ Back to Contents

How do you secure remote access to store equipment?

Replace direct internet exposure with a controlled, logged path: a VPN or managed secure gateway, multi-factor authentication where supported, and named access for each contractor. The aim is that no controller answers to the open internet.

• Segment the network. Place refrigeration and building controllers on their own VLAN, away from tills, card payment devices and staff Wi-Fi. Limit what can talk to what.
• Control the contractor route. Give contractors time-limited accounts through your gateway rather than a standing open port.
• Log and monitor. Record every remote session and alert on logins out of hours or from unexpected locations.
• Plan isolation. The NCSC connectivity principles include having a plan to isolate a site or system quickly. Decide in advance who may pull the plug.

Endpoint and network monitoring helps here. Our managed EDR services cover the servers and workstations at the IT end, while a cyber security audit can identify exposed services and unmanaged devices across a multi-site estate. For smaller operators, our guide to cybersecurity for small business sets out the baseline.

↑ Back to Contents

What does this mean for UK retailers and food businesses?

UK retailers run the same families of equipment, so the same exposure question applies. Reports said the same product families were also found exposed in other European countries and a small number of US stores, so this is not a French-only problem. As at 23 October 2026 we have not seen an official UK incident linked to this campaign.

Different businesses face different exposure:

• Convenience and franchise operators: equipment is often owned by the franchisor or a contractor. Ask who is responsible for patching and who holds the passwords.
• Food manufacturers and cold-chain firms: a warehouse is a larger version of a store. The loss from one overnight failure is bigger.
• Hospitality and care providers: a handful of commercial fridges may be remotely monitored by a supplier with little oversight.

The UK baseline is the Cyber Essentials scheme, which covers firewalls, secure configuration, patching and access control. Scope it to include connected devices, not just laptops. Retailers that process card payments should also keep refrigeration networks well away from payment systems. Our guide on supply chain risks seen in recent retail breaches covers the third-party angle.

↑ Back to Contents

What does a worked example look like for a 20-store chain?

The following is an illustrative example with stated assumptions, not a real case. Assume a 20-store chain where refrigeration was installed by one contractor, with remote monitoring via mobile routers, and no register of devices.

1. Day 1: IT asks the contractor for a list of every controller, model, firmware and connection method per store. The answer reveals that most stores use a router with a public address.
2. Day 2: IT checks the chain's public addresses on exposure search tools and finds management pages at several stores. Access is restricted to the contractor's addresses as an emergency step.
3. Week 1: passwords are changed, hardened modes enabled, defrost schedules reviewed and alarm thresholds confirmed.
4. Month 1: a VPN replaces the allow-list. Controllers are moved to a separate VLAN.
5. Quarter 1: controllers out of vendor support are ranked by food value at risk and put into the capital replacement plan.
6. Ongoing: a named owner reviews vendor and CERT advisories monthly, and one store runs a manual-monitoring drill each quarter.

Nothing in that plan needs specialist tooling. It needs ownership, a list and a decision about which risks to retire first. Pairing it with an cybersecurity assessment gives an independent check.

↑ Back to Contents

How do insurance, incident response and continuity fit in?

A refrigeration attack is a business interruption and stock loss event as much as a cyber one, so check how your policies treat it. Many cyber policies cover digital loss but exclude physical damage or spoiled stock, while property policies may exclude cyber causes. Ask your broker in writing how each scenario would respond. Our overview of cybersecurity insurance explains the questions to ask.

Next, write the response down. A cyber incident response plan should name who can authorise isolating a site, who calls the contractor, who contacts the insurer, and who decides what to do with stock. For stores, include a step to physically check temperatures when an alarm cannot be trusted.

Finally, remember that ransomware and sabotage share the same recovery muscles. If you have rehearsed one, the other is easier. See our guide to ransomware protection for UK businesses for the wider controls, and cybersecurity best practices for the baseline. Out-of-hours monitoring matters too: an overnight event is only contained if someone is watching, which is where a 24/7 IT helpdesk can fit.

↑ Back to Contents

What is the main lesson from the French supermarket cyberattack?

The French supermarket cyberattack shows that connected operational equipment is part of your attack surface, and that old, unpatched, internet-facing controllers are the weakest part of it. Find them, remove their public exposure, change their passwords, replace what is out of support and rehearse running without them.

If you want help auditing store-level devices or building the register, speak to us through the NetMonkeys contact page.

↑ Back to Contents

Frequently Asked Questions (FAQs)

↑ Back to Contents