When the fridge became the attack surface: France and Germany supermarket cyber lessons (2021 to 2026)

On the night of 11 to 12 October 2026, someone logged into the refrigeration supervisors of hundreds of French supermarkets and told the cold cabinets to defrost. Thierry Cotillard, CEO of the Mousquetaires group (Intermarché, Netto), said the attackers managed to put  “all our cold cabinets into defrost and raise them to as much as 50 °C”,  as quoted by franceinfo.

There was no ransom note. As of 13 October the attack had not been claimed. Nobody encrypted a file server. The target was the operational technology (OT) that keeps fresh and frozen stock cold: remote supervisors sitting on the internet, reachable by anyone who found them.

The French national CERT published alert CERTFR-2026-ALE-012 the same day. It names the affected product families: Danfoss AK-SM series, Danfoss AK-SC series, Copeland xweb and Dixell xweb. Three weeks later, a store in Bavaria saw the same thing happen to its cooling.

This post walks through what is confirmed, how the pattern changed over five years, and the steps CERT-FR and the German BSI actually published. Then a short note on why anyone running cold storage in India should read this carefully.

What happened in France in October 2026

The CERT-FR alert is titled “Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération” (security incident targeting remote controllers of refrigeration installations). It was first issued on 12 October 2026, updated on 13 October to add more equipment, and updated again on 16 October with revised recommendations.

Retailers confirmed their own impact to the press. As reported by franceinfo on 13 October:

• Intermarché and Netto: at least 300 stores
• Coopérative U: fewer than 100 stores
• E.Leclerc: “several” stores
• Carrefour: 80 supermarkets
• Monoprix: about 30 stores

The stated numbers alone add up to more than 400 stores, before counting U and Leclerc. The true national total has not been published by any official source.

Danfoss told franceinfo that “the majority of the devices concerned are obsolete products, notably the AK-SM800 and AK-SC355 systems, which have reached end of life and no longer receive software or security updates.”

The Paris prosecutor opened an investigation, assigned to OFAC, the French police office for cybercrime. Intermarché said its insurers do not cover this type of incident. Store managers quoted in the press gave losses of about €60,000 at Etréchy, €55,000 at Issy-les-Moulineaux and €270,000 across two Intermarché stores in Haguenau. Nobody has published a verified total.

What is not known matters as much. No official source has stated how the attackers got in. You will see claims about default passwords or specific vulnerabilities in commentary; none of them is confirmed by CERT-FR or the vendors, so we leave them out.

Germany: the BSI warning and Reisbach

On 13 October 2026 the BSI, Germany’s federal cyber security agency, issued a press release urging operators of internet-reachable control systems, including food-cooling systems, to secure them. BSI President Claudia Plattner said: “This attack could have hit any country and can find copycats at any time. Such entry points practically invite sabotage.” The BSI published recommendation BSI-CS 154, “Gefährdung durch internet-verbundene OT-Systeme” (threats from internet-connected OT systems), on the same day.

The warning was right. On the night of 1 to 2 November 2026, the Edeka store in Reisbach, Lower Bavaria, confirmed to BR24 that its cooling had been set to “50 Grad Heizen”, 50 degrees heating. Most of the stock was discarded. BR reported that the same wave hit stores in Belgium, Sweden, Ireland, Luxembourg, Estonia and the Netherlands, that no financial demands were made, and that experts suspect sabotage.

How many German stores were hit beyond Reisbach is not confirmed.

Five years of supermarket incidents: from IT to OT

The October wave looks sudden, but it sits at the end of a clear line. Earlier incidents in the same two countries hit IT systems and customer data. 2026 is the year the target became physical.

April 2021: tegut, Germany (cyberattack, IT)

Fulda-based grocer tegut was hit by a cyberattack in April 2021. Under its emergency plan, the company shut down and disconnected all head-office network systems, including the merchandise programmes that control disposition in logistics, as reported by heise. tegut warned of isolated gaps in product availability. Stores stayed open.

tegut refused to negotiate. In its press release relayed by fuldainfo, the company said it would not enter negotiations with criminals. The attackers then published company data on the dark web.

Lesson: a pre-planned isolation procedure kept the shop floor running even with head-office IT down.

October 2022: METRO, Germany, France, Austria (IT outage)

On 17 October 2022, wholesaler METRO suffered a cyberattack that caused a partial IT outage, confirmed in its newsroom. Store teams set up offline systems to process payments, as reported by SecurityWeek, with impact in Germany, France and Austria.

During recovery, METRO found malware again and shut down some systems a second time (newsroom status, 23 November 2022). Its 2021/22 annual report put the earnings hit in the mid-double-digit millions of euros.

Lesson: recovery is not done when systems come back. Reinfection during restoration is a real risk.

November 2024 to August 2025: Picard and Auchan, France (customer data)

In November 2024, Picard reported unauthorised access affecting 45,000 of its 11 million loyalty accounts, said it had not detected an intrusion into its information systems, and notified the CNIL (Le Parisien, quoting Picard).

Auchan disclosed a breach of more than 500,000 loyalty accounts in November 2024, with no bank data or passwords stolen, and notified the CNIL (franceinfo). On 21 August 2025 it disclosed a second loyalty-data breach affecting “several hundred thousand” customers (ICI).

October and November 2026: refrigeration OT

Then the October wave in France and the November Reisbach case in Germany. The difference is direct physical loss: product that has warmed up has to be thrown away, regardless of whether any data left the building.

One note on myths. We found no official confirmation of ransomware at Casino, Carrefour, Leclerc, Système U, Intermarché, Lidl, Aldi, Kaufland or Globus before October 2026. If you read otherwise, check the source.

Why the refrigeration supervisor is such an easy target

A store refrigeration supervisor sits between the cabinets and compressor packs on one side and the refrigeration contractor on the other. The contractor wants to see alarms and change setpoints without driving to the store. The easiest way to give them that is a web interface on a public IP.

CERT-FR is blunt about this: “De manière générale l’exposition d’une interface de gestion sur Internet est contraire aux bonnes pratiques.” In general, exposing a management interface on the internet goes against good practice.

Add Danfoss’s own statement that most affected units were end-of-life models without security updates, and the picture is simple. Old supervisors, still in service because they still control the cold room, reachable from anywhere. The device does exactly what it is told, including defrost and heating.

Practical checklist: what CERT-FR and BSI tell operators to do

Everything below comes from CERTFR-2026-ALE-012 or the BSI press release of 13 October 2026 and BSI-CS 154. We have not added steps of our own.

1. Inventory and exposure check

• List every refrigeration supervisor and controller across your sites, with model and firmware. Pay particular attention to Danfoss AK-SM, Danfoss AK-SC, Copeland xweb and Dixell xweb, the families named by CERT-FR.
• Check which of these is reachable from the internet. The BSI tells operators to check their exposure.

2. Remove public internet exposure

• CERT-FR’s first step: remove internet exposure of the affected units, and of any unit on a public IP.
• BSI: block direct internet access to control systems.

3. Contractor remote access through VPN, with MFA

• CERT-FR: restore remote access only through a secure VPN or a protected network. Filtering by source IP is acceptable only as a temporary measure.
• BSI: use VPN and multi-factor authentication.

4. Patch, or replace end-of-life units

• CERT-FR: update firmware, and for Danfoss units set security to “Strict” mode.
• BSI: patch promptly.
• CERT-FR warns that for end-of-life devices a factory reset alone is not enough, because the device stays vulnerable. If the vendor no longer ships security updates, plan the replacement.

5. Change default passwords

• CERT-FR lists changing default passwords among its recommendations.

6. Review the full configuration, especially defrost windows

• CERT-FR: check the whole configuration, in particular defrost windows. A compromised unit should be rebooted or factory reset and then reconfigured, keeping the end-of-life warning above in mind.

7. Read your insurance contract before cutting the contractor feed

• CERT-FR: check your insurance contract terms before cutting the data feed to your refrigeration contractor. Intermarché said its insurers do not cover this type of incident, so check what yours actually say.

Segmentation: three zones, not one network

The incidents above map to three different zones, and each should be treated separately:

A compromise in one zone should not hand over the next. The practical meaning of CERT-FR’s VPN and protected-network advice is that the contractor zone is a controlled entry point, not an open door on a public IP.

What this means for cold chain in India

We are not aware of any Indian incident like this, and we are not claiming one. The principle transfers anyway.

Cold storage warehouses, dairy chilling centres and pharma cold rooms in India increasingly use controllers that a contractor or OEM supervises remotely, often over Modbus to a gateway or supervisor. The pattern from France is the same: a controller that can change setpoints and defrost cycles, a contractor who needs remote access, and a temptation to make that access as easy as a public web page.

The CERT-FR and BSI checklist above applies almost word for word. Know what you have, take management interfaces off the public internet, put contractors behind VPN and MFA, plan the replacement of units that no longer get security updates, change defaults, and know what your insurer covers. For pharma, where a temperature excursion can mean a batch is written off, the defrost and setpoint review in step 6 deserves a regular slot in your maintenance calendar.

Visibility is the part you can add

None of the official guidance replaces the basics above, and monitoring is not a substitute for removing exposure. But in both France and Germany, the damage was a temperature change that someone had to notice. An independent view of cabinet and cold room temperatures, separate from the supervisor that is being instructed, tells you that something changed even when the controller itself has been told otherwise.

That is the kind of work we do with Embedos Edge, our platform of products, solutions, dashboards, insights and services for industrial telemetry. For cold chain, that means temperature and equipment telemetry, dashboards and anomaly alerts that sit alongside your existing refrigeration controls. If you run cold storage, dairy chilling or pharma cold rooms and want to talk through how to get that visibility, get in touch with our team in Mumbai.