France's supermarket fridges sat exposed online for months

On the night of October 11–12, 2026, fridges and freezers in hundreds of French supermarkets started to warm up. Attackers had pushed the systems into defrost mode, which heats the cooling parts to melt ice. Some units reached 50 °C, some equipment began to catch fire according to the Paris prosecutor, and stores had to throw away their fresh and frozen food. The reports pointed to one maker of controllers — the Danish company Danfoss.

The scale

According to Futura-Sciences, more than 400 stores were hit, with losses possibly reaching several million euros. Carrefour reported 80 stores, Intermarché and Netto (the Les Mousquetaires group) more than 300, and Monoprix about 5% of its outlets. Coopérative U's CEO, Dominique Schelcher, told RTL that 80 of its 2,000 stores were affected; the chains don't buy from Danfoss directly but get its systems through their refrigeration contractors.

Danfoss called most of the affected equipment "legacy," naming the AK-SM 800 and AK-SC 355 models. The agency CERT-FR reported numerous compromises of these controllers and advised operators to disconnect them or restrict access, and on October 13 it expanded its alert to include XWEB supervisors from Copeland and its Italian brand Dixell. Who carried out the attack, and how they got in, is still unknown; the Paris prosecutor's office has opened an investigation.

What IPinfo found

IPinfo, which scans the Internet weekly, turned to its own measurements. In the sweep of October 6–7 — five days before the attack — open Danfoss StoreView dashboards answered at 2,528 addresses. That is the web page stores and technicians use to watch the controllers, except anyone who typed in the address could open it.

France accounted for 1,331 of them — more than the other 72 countries and territories combined (1,197). Poland came next (179), then the US (101), Portugal (92), and Belgium (85). The data can't say why France stood out: its software versions matched everywhere else, and 98% of the panels ran on telecom networks rather than in data centers — meaning they were plugged straight into a store's own Internet connection.

85% of the French dashboards (1,136 of 1,331) ran software with known flaws — nearly the same as the 84% elsewhere. Among them were 527 older controllers Danfoss no longer supports. Only 195 were fully up to date.

The exposure had existed for months: 1,019 of the French dashboards were at the same address back on March 30, and the share fully updated rose over six months only from 14% to 24%.

After the attack

Most stores disconnected their systems: of the 1,331 French dashboards, only 316 were still online on October 14 — a 76% drop, against the usual 3–7% a week. The unsupported older controllers vanished fastest. IPinfo says it will keep watching those that remain reachable.

The scans can't reveal how the attackers got in or whether any of the listed flaws were used. But one thing is clear: five days before the attack, France had more panels open to anyone than the entire rest of the world, and most were behind on updates.

Source: Hacker News