A cyberattack reached the equipment keeping food cold at French supermarkets overnight on October 11–12. Coopérative U chief executive Dominique Schelcher confirmed that refrigeration installations at several stores in the network were affected. On October 12, France’s national computer emergency response team, CERT-FR, separately warned of numerous compromises of Danfoss AK-SM and AK-SC systems.
The immediate operator task is to disconnect or filter access to those systems, CERT-FR says. Its recovery instructions go beyond installing a patch: suspected compromise calls for a factory reset, security updates, new secrets, an account review and complete reconfiguration.
The incident reached the cold chain
Schelcher said teams were working with refrigeration specialists to restore operations, and that an investigation would need to establish what happened. His statement identifies the affected function precisely: the installations producing refrigeration, essential to preserving fresh food and maintaining supplies. It does not give a final store count or loss estimate.
That distinction matters. The retailer described a disruption to physical equipment, rather than simply an unavailable shopping website. Restoring a web service and restoring trustworthy control of a refrigeration installation are different jobs. The latter has to involve the people responsible for operating and configuring the equipment.
CERT-FR’s alert names the AK-SM and AK-SC families but does not identify a particular exploit, firmware version or CVE as the cause. It warns that exposing a management interface directly to the internet violates good practice. Where remote administration is essential, restricting access to trusted IP addresses is an initial temporary measure.
The useful question for an operator is therefore concrete: who can reach the controller’s management interface, and who has authority to change its configuration? The alert establishes the need to close that access path; it does not establish how every affected store was entered.
What the primary statements establish
| Confirmed point | Limit of the evidence |
|---|---|
| Coopérative U reported overnight disruption to refrigeration at several stores. | Its statement does not quantify damaged stock, total losses or the final number of affected stores. |
| CERT-FR knows of numerous compromised Danfoss AK-SM and AK-SC systems. | The alert does not attribute the incident to a named group or a specific vulnerability. |
| CERT-FR calls for disconnected or filtered access and a full recovery sequence. | Installing an update alone is not the complete response it prescribes for suspected compromise. |
Close access, then rebuild trusted control
For suspected compromise, CERT-FR lists six actions in this order:
- Restrict network access to the AK-SM and AK-SC installations to service providers.
- Perform a factory reset.
- Apply all available security patches.
- Rotate secrets, including the credentials used to access the equipment.
- Review existing accounts.
- Reconfigure the equipment completely.
These are installation recovery tasks for the operator and qualified service provider. Merely seeing the cooling resume does not answer whether an unwanted account or an exposed management interface remains. Account review and secret rotation address a different part of recovery from replacing the software.
The alert also points to CERT-FR’s broader industrial hardening guidance. That document recommends source-IP filtering, authenticated remote access through an IPsec or TLS VPN, replacement of default credentials, supported remote-access software and prompt patching. It was written for energy and water installations; CERT-FR explicitly references it in this refrigeration alert.
The broader pattern of remotely accessible equipment also appears in the LeakySensey investigation into compromised routers. That is a separate case, with a different purpose; here, the established consequence is disruption to refrigeration.
The French incident makes control of physical equipment the central security issue. Operators do not need an unconfirmed exploit name to act on CERT-FR’s access restrictions and recovery guidance, while the investigation determines the attack’s full scope.
References
- Dominique Schelcher, Coopérative U. Statement on the overnight refrigeration cyberattack. October 12, 2026; accessed October 13, 2026.
- CERT-FR. Security incident targeting Danfoss AK-SM and AK-SC series. CERTFR-2026-ALE-012, October 12, 2026.
- CERT-FR. Hardening recommendations for energy and water operators. CERTFR-2025-DUR-003, January 22, 2026; accessed October 13, 2026.
