French Supermarket Cyber-Attack Impacts More Refrigeration Controllers

While many supermarkets in France are still grappling with food stock disruptions due to a cyber-attack that targeted refrigeration controllers on October 11, the scope of the incident could be larger than previously observed.

Recent developments suggest that the incident does not only impact Danfoss refrigeration controllers, but also temperature regulation devices from Dixell Electronics, an Italian brand owned by American heating and cooling equipment provider Copeland.

Notably, French local media France 3 reported that an E. Leclerc supermarket in the Tarn region, in the south-west of France, experienced disruptions to its refrigeration systems, despite using Dixell equipment instead of Danfoss.

French national newspaper Le Monde also reported a supermarket near Bordeaux, where attackers reportedly changed freezer settings from −22°C to 150°C.  A technician observed several settings being altered per second, suggesting automation.

A security advisory published by the French national Computer emergency response team (CERT-FR) on October 12 specifically named Danfoss AK-SC and AK-SM series as well as Dixell xweb and Copeland xweb as “affected systems.”

Fears of Deliberate Industrial Sabotage

Speaking to Infosecurity, Amir Preminger, CTO of industrial security provider Claroty, said refrigeration controllers are a prime target, not just for supermarkets but also cold-storage facilities, warehouses, pharmaceuticals, chemical manufacturing and more, that often go overlooked by security teams.

“Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks, however, our research found many of these devices are directly exposed to the public internet. While this convenience significantly reduces maintenance costs by allowing engineers to troubleshoot issues remotely, it also lowers the barrier to entry for attackers,” he said.

Preminger assessed that while the attack did not necessarily require sophisticated skills, the targeting was a clear deliberate attempt to cause damage.

“I don’t think it’s sophisticated,” he said. “However, you cannot cause a defrost by mistake by typing the wrong parameter. You need to initiate the defrost. Somebody needed to guide the exploit, the campaign to have that impact.”

He compared the apparent tactic with an incident at a food-processing facility in Israelin 2025. In that case, an attacker inside the facility’s network manipulated a refrigeration compressor and caused it to defrost. While the impact was similar, Preminger did not claim the incidents involved the same group.

He argued that the broader concern was that refrigeration controllers were exposed to the internet. Preminger said such exposed Danfoss devices could be found outside of France too, including in Israel and the US, but he did not know what software versions those devices were running or whether they were vulnerable.

He also cautioned that patching alone does not make internet exposure safe. His advice was to keep critical devices off the public internet and restrict access through measures such as corporate virtual private networks (VPNs) or even access point name (APN) gateways.

He also urged operators to segment their networks, inventory their equipment, and know who can access each device. “Gate your devices, segment your devices. That’s the first frontier,” he said.

Why Supermarket Fridges Are Connected to the Internet

Supermarket fridges are generally connected to the internet to comply with legislation, which, in Europe, requires them to maintain timestamped monitoring of temperatures to strengthen food safety and to install an alarm system in case of an abnormal rise in temperature.

This connection also allows for remote maintenance.

“This is an essential system for the proper preservation of food products,” emphasized Dominique Schelcher, CEO of Coopérative U, in a post on X.

Image credits: Elninho / kaskip / Shutterstock.com