A refrigeration cyberattack disrupted French supermarkets overnight on October 11-12, 2026, leaving fresh and frozen food displays out of service. Intermarché and Coopérative U confirmed disruption, according to BleepingComputer, whose report was updated on October 12. France's CERT-FR separately warned that numerous Danfoss AK-SM and AK-SC systems had been compromised.

Intermarché told BleepingComputer that it and Netto removed products from affected display units as a precaution. The retailer said the incident reportedly involved a provider managing store refrigeration. Reports described hundreds of affected supermarkets, but the total remained uncertain. The Paris prosecutor's office told AFP it had opened an investigation, BleepingComputer reported.

According to a Danfoss statement published by Cooling Post on October 12, most affected units were legacy products or supported products running outdated firmware. The vendor identified AK-SM800 and AK-SC355 systems as discontinued equipment that no longer receives software or security updates. Affected AK-SM800A units were running old firmware, it said.

CERT-FR's alert identifies the affected controller families but does not name an exploited vulnerability, attacker or initial access method. It warns against exposing management interfaces to the internet. Where remote administration is essential, temporarily limiting access to trusted IP addresses is one measure it describes, alongside its broader hardening guidance.

Danfoss told Cooling Post it was helping customers apply available firmware updates, strengthen network protections and remove direct internet exposure where applicable. The company recommended keeping supported equipment current and replacing legacy systems. Its statement does not establish a single patch or firmware version that resolves every affected installation.

For suspected compromises, CERT-FR recommends restricting network access to service providers, performing a factory reset and applying all available security patches. Its recovery sequence then calls for rotating secrets, checking existing accounts and fully reconfiguring the equipment. The agency also advises disconnecting or filtering access to AK-SM and AK-SC instances.