A cyberattack reached the equipment keeping food cold at French supermarkets overnight on October 11–12. Coopérative U chief executive Dominique Schelcher confirmed that refrigeration installations at several stores in the network were affected. On October 12, France’s national computer emergency response team, CERT-FR, separately warned of numerous compromises of Danfoss AK-SM and AK-SC systems.
Updated October 13: CERT-FR has expanded the equipment scope and revised its recovery guidance. Operators should remove public internet exposure and follow the appropriate recovery path below; restoring cooling alone does not establish secure control.
The incident reached the cold chain
Schelcher said teams were working with refrigeration specialists to restore operations, and that an investigation would need to establish what happened. His statement identifies the affected function precisely: the installations producing refrigeration, essential to preserving fresh food and maintaining supplies. It does not give a final store count or loss estimate.
That distinction matters. The retailer described a disruption to physical equipment, rather than simply an unavailable shopping website. Restoring a web service and restoring trustworthy control of a refrigeration installation are different jobs. The latter has to involve the people responsible for operating and configuring the equipment.
CERT-FR’s updated alert names Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb but does not identify a particular exploit, firmware version or CVE as the cause. It warns that exposing a management interface directly to the internet violates good practice. Where remote administration is essential, restricting access to trusted IP addresses is an initial temporary measure.
The useful question for an operator is therefore concrete: who can reach the controller’s management interface, and who has authority to change its configuration? The alert establishes the need to close that access path; it does not establish how every affected store was entered.
What the primary statements establish
| Confirmed point | Limit of the evidence |
|---|---|
| Coopérative U reported overnight disruption to refrigeration at several stores. | Its statement does not quantify damaged stock, total losses or the final number of affected stores. |
| CERT-FR’s October 13 version lists Danfoss AK-SM/AK-SC, Copeland xweb and Dixell xweb. | The alert does not attribute the incident to a named group or a specific vulnerability. |
| CERT-FR removes public exposure and separates compromised and non-compromised equipment. | A factory reset alone is insufficient for exposed unsupported equipment without security fixes. |
November 2 update: Swedish outages, unconfirmed cause
ICA and Coop told AFP that overnight refrigeration failures forced Swedish stores to discard food. Coop counted six affected stores; ICA had no total. A Sjöbo store blamed hacking and reported a 50°C setting, but neither chain confirmed a cyberattack. Equipment and entry method remained unverified. These accounts do not establish a connection to the French attack or a shared recovery path.
October 13 update: equipment scope and recovery paths
CERT-FR now also names Copeland xweb and Dixell xweb, alongside Danfoss AK-SM and AK-SC. Its revised guidance separates equipment that has not been compromised from compromised installations. In both cases, remove public internet exposure first; check insurance obligations before interrupting data reporting to the refrigeration service provider.
- Equipment not compromised: check the complete configuration, especially defrost schedules. Restore remote access through a secure VPN or protected network, then apply manufacturer hardening and firmware guidance.
- Compromised equipment: factory-reset the unit after removing exposure. Restore access through a secure VPN or protected network, reconfigure it for service and apply manufacturer hardening.
Emergency firewall filtering to a service provider’s source IP addresses is temporary, not a permanent access design. For Danfoss equipment, CERT-FR specifically includes firmware updates, Strict security mode and changing default passwords. It warns that a reset alone leaves unsupported, unpatched equipment vulnerable to reinfection if it remains internet-exposed.
Credential rotation and account review were explicit steps in the October 12 version and remain useful recovery checks with the service provider. They should not be mistaken for the revised alert’s complete procedure. Likewise, normal cooling does not establish that management access and defrost settings are trustworthy.
The separately retained CERT-FR industrial hardening document provides background on authenticated VPN access, default credentials and patching. The October 12 alert linked to it; the current version gives the refrigeration-specific branches above.
The broader pattern of remotely accessible equipment also appears in the LeakySensey investigation into compromised routers. That is a separate case, with a different purpose; here, the established consequence is disruption to refrigeration.
The French incident makes control of physical equipment the central security issue. Operators do not need an unconfirmed exploit name to act on CERT-FR’s access restrictions and recovery guidance, while the investigation determines the attack’s full scope.
References
- Dominique Schelcher, Coopérative U. Statement on the overnight refrigeration cyberattack. October 12, 2026; accessed October 13, 2026.
- CERT-FR. Security incident targeting remote controllers of refrigeration installations. CERTFR-2026-ALE-012, first issued October 12; updated and accessed October 13, 2026.
- CERT-FR. Hardening recommendations for energy and water operators. CERTFR-2025-DUR-003, January 22, 2026; accessed October 13, 2026.
- AFP. “Refrigerator temperatures soar in Swedish supermarkets: chains.” The Peninsula, November 2, 2026; accessed November 2, 2026. AFP interviews with ICA and Coop.
