// analysis
The day supermarket freezers became a target
Sources and reading context
Topics
Contents10 sections
The war on ordinary machines · Part 1 of 7
Remote commands were changed, food was pulled from shelves, and another set of incidents followed three weeks later. The attacks on commercial refrigeration exposed a very tangible form of power: control over the conditions that keep goods fit for sale. Technical documentation and testimony from France’s cybersecurity agency help reconstruct the mechanism and correct the early explanations.
In Gradignan, near Bordeaux, an Intermarché operator put the food lost after the night of 11–12 October 2026 at €21,000, valued at purchase cost. He told Le Monde that a judicial officer had documented the loss. This was one shop’s assessment, reported by its operator. 1
Before the incident, the goods were inventory awaiting sale. Once their storage conditions had been compromised, their value depended on a food-safety decision and, potentially, disposal. A change made through a computer interface had reached into the assets of a business.
Refrigeration makes that transition unusually visible. An indicator can turn green again, a remote connection can be closed and a technician can complete a repair, while the fate of the affected food remains unresolved. Restoring a machine and rebuilding saleable inventory are separate jobs. This opening instalment follows the established events and the physical mechanism linking them.
Three weeks, and an explanation that changed
On 12 October, CERT-FR, the government incident-response centre within France’s national cybersecurity agency, ANSSI, issued an alert. An update on 13 October expanded the equipment covered; another on 16 October revised the recommendations. The alert names Danfoss AK-SM and AK-SC families, alongside Copeland XWEB and Dixell XWEB. It records compromises of remote refrigeration controllers. 2
Le Monde also reported incidents involving Dixell equipment on the night of 12–13 October. That second night should be distinguished from the initial French incidents. 10
A controller is a specialised computer that monitors or operates equipment. A refrigeration installation can have several layers: a device controlling an individual cabinet, a supervisor collecting information across the shop, and an interface through which a maintenance contractor works. Their precise capabilities depend on the installation. The alert identifies product families; establishing the route taken at each site requires investigation. 2 5
A significant clarification arrived on 21 October. Testifying before the French Senate, ANSSI director-general Vincent Strubel said the agency’s analysis pointed to equipment directly exposed to the internet, inadequately protected administration and weak passwords. At that stage, he rejected previously published vulnerabilities from the preceding two years as the explanation for the compromises under examination. 3
His intervention changes the order of the questions. Documented software flaws certainly exist. Finding one on a machine is useful information; establishing that an attacker used it requires further evidence. Investigators need to determine how access was obtained, which permissions were available and what commands followed. The testimony records the agency’s assessment on 21 October. It leaves room for differences between individual sites and for later incidents to involve other methods.
On 2 November, refrigeration incidents were reported across several European countries. Reuters obtained confirmations in Belgium, Luxembourg, Sweden and Ireland. It said the perpetrators and any connection to the French incidents remained undetermined. 4
There are twenty-one days between 12 October and 2 November. That is an interval between reporting dates, not a measured period of attacker activity. The public chronology establishes a recurrence of a type of damage. Describing it as one operation would require links between access records, infrastructure, commands and their origins. A convenient news label such as “wave” can suggest more coherence than the evidence supports.
Method and scope
Reports and document revisions carry different dates. The 21 days from 12 October to 2 November are calendar days. Visual spacing is editorial, not a time scale. The 21 October testimony concerns the compromises examined at that point; a connection to the November incidents remains unproven.
A freezer also has a way to generate heat
To understand the empty shelves, follow the heat. Refrigeration removes energy from an enclosed volume and the goods it contains. Frost can accumulate on the evaporator, the heat exchanger that absorbs that energy. The ice obstructs heat transfer and has to be removed. Defrosting is therefore part of the normal operation of many installations. 6
Depending on the design, defrosting can use electric heaters or hot gas. Temperature and time limits ordinarily govern when it ends. A function essential to preservation thus introduces heat into part of the equipment at particular moments. Controlling that function is crucial. 6
At shop level, a supervisor can coordinate multiple controllers, collect temperatures and handle alarms. Danfoss describes these capabilities in its product documentation. We use those documents to explain one possible architecture and its legitimate functions. They do not reveal how any particular victim’s installation was built. 5
The risk emerges when an intruder obtains control permissions. A legitimate function can then be used outside its intended operating conditions. The controller executes an instruction; the consequences continue through a heat exchanger, the surrounding air and eventually the goods. That sequence explains how access to a narrowly defined technical interface can produce direct material losses.
The illustration below uses an electric-defrost example. Other installations use different methods, and local protections vary. It identifies the boundaries that an investigation should examine: who authorises the command, which device acts on it, which sensor observes the result and how an alert reaches someone able to respond. It does not reconstruct the attackers’ settings.
Method and scope
An explanatory architecture based on manufacturer capabilities and CERT-FR’s alert. The drawing follows an electric-defrost example and separates authorisation, supervision, local control, thermal effects and measurement feedback. Each victim’s protections, connections and settings are unknown. The measurement arrow makes no claim about sensor or log-storage independence.
Remote maintenance has a clear operational purpose: detecting a fault, interpreting an alarm and preparing a repair before a technician travels to the site. The economic question concerns how much authority that connection carries. Reading a temperature, changing the target temperature and altering a configuration have different consequences. A contract describing “remote monitoring” may bundle those functions together. An investigation needs to separate them.
The tempting shortcut of a known vulnerability
In August 2025, Danfoss published a security advisory for vulnerabilities in the AK-SM 800A, remedied in version 4.3.1. The advisory describes flaws that require prior authentication. It establishes a product risk, rather than evidence that these flaws were used in October. 8
The distinction matters when reading technical alerts. A CVE identifier names a catalogued vulnerability. Connecting it to a particular incident still requires checking the model, software version, configuration and available records. Similar product names can also be misleading: the manufacturer’s documentation distinguishes the AK-SM 800 from the AK-SM 800A generation. 5 8
A separate Danfoss page describes security options on the AK-SM 800A. Software branch 4.0.x and later defaults to strict mode after installation, while retaining a compatibility option. The company warns that an upgrade may affect communications with third-party software and recommends having personnel on site where the configuration is uncertain. 9
This is where a recommendation to update becomes an operational project. The refrigeration contractor needs visibility over the equipment, the shop needs continued monitoring of its food, and the IT team needs to control access. A security change can affect all three relationships. That calls for preparation and testing. It also produces a specific documentary question: who was responsible for verifying the complete service after the change, and what evidence of that verification exists?
Supplier documentation explains product capabilities and precautions. It says much less about how individual installations were configured, maintained or covered by contracts. Responsibility for an incident depends on those local facts. Assigning all the blame to a manufacturer, contractor or shop at the outset would settle the issue before examining the records that matter.
A dramatic temperature needs a precise definition
Reports of these attacks include very high temperatures. Before repeating a number, establish what it describes: a target entered into a controller, an air-temperature measurement, or the temperature of the food itself. The first is an instruction. The second is an observation at a particular sensor location. The third concerns the goods whose safety is at issue. 6 12 13
European food law makes the distinction useful for managing the cold chain. For products within the quick-frozen category, Directive 89/108/EEC sets a reference of −18°C or below throughout the product, subject to specified tolerances. Regulation 37/2005 separately addresses air-temperature monitoring in transport and storage, with derogations including those for retail display cabinets. The rules themselves distinguish food temperature from the temperature around it. 12 13
The evidence should be read accordingly. Sensor location, calibration, exposure time and the history of a batch all matter. A screenshot stripped of that context illuminates one part of an incident while leaving much to reconstruct. Chilled products also have requirements that vary by category: the quick-frozen reference has a defined scope.
Method and scope
The diagram separates three objects of evidence, without depicting readings from an attack. The −18°C reference concerns quick-frozen foods under Directive 89/108/EEC, subject to its specified tolerances. Regulation 37/2005 addresses air monitoring in defined settings, with derogations. No storage time or decision to release goods for sale is calculated.
The distinction also prevents a misleading assumption about recovery. Bringing the air back to its normal operating temperature does not erase what happened earlier. A decision to release food for sale concerns its history and the relevant safety requirements. The EU’s food-hygiene regulation places primary responsibility for food safety on the operator and requires procedures for controlling hazards. 11
For accurate reporting, a properly contextualised reading is more useful than an isolated maximum. For customer protection, shop staff need to make decisions about batches even when the information is incomplete. They may withdraw goods as a precaution. Such a withdrawal, by itself, is not a count of items whose spoilage has been individually demonstrated.
The hourly report may smooth away the event
The documentary research exposes another issue: how temperature histories are presented. The June 2026 revision of the Danfoss AK-SM 800A manual describes a food-safety reporting function that samples at fifteen-minute intervals and displays an hourly value based on the average of four samples. It distinguishes this function from other service logs. 7
This describes a feature in that manual. Whether the affected shops had it, or had enabled it, is unknown. Its value to this investigation is methodological: an hourly average and the maximum within that hour answer different questions. Several sets of four readings can have the same average. The summary therefore loses some of the information in the underlying observations.
That arithmetic has a practical consequence for evidence gathering. “Send the temperature records” is an incomplete request. Does the file contain original readings, averages, maxima or a reformatted display? Which periods have missing data? Were the clocks synchronised? A well-presented table may still be an incomplete account of what happened.
Method and scope
Danfoss manual BC337629891709en-001101, dated June 2026, describes this feature in section 5.10, printed page 52. T1 to T4 are symbols, not invented temperatures. Their arithmetic mean is their sum divided by four. The intervals separate successive samples; no exact position within the hour is attributed to the software. A mean alone cannot recover the maximum or time above a threshold. Use of this feature at victim sites is unknown.
There is a second question: does the equipment issuing commands also retain and transmit the measurements? Supervisory documentation shows that several of these functions can be combined. Investigators should therefore consider the independence of the available evidence. This is a reason to compare records from different sources; it establishes no falsification of logs in the incidents discussed here. 5 7
A robust chronology brings together configuration changes, alarms, readings and human interventions. Each timestamp describes a different event: a command arriving, a sensor detecting a change, a message being sent, or a person acting. Treating them as interchangeable can turn a transmission delay into an apparent failure to respond, or conceal a period in which nobody had the information needed to intervene.
Bringing refrigeration back, then refilling the shelves
Ireland provides a useful comparison. On 2 November, Musgrave said that thirteen SuperValu stores had been affected and that chilled and frozen products had been withdrawn as a precaution. The company credited its monitoring systems with detecting the incident, according to its statements to the Irish Farmers Journal. 14
A second report dated the same day said Musgrave considered the incident resolved and stores operating normally, while replenishment of the affected ranges was still under way. These remain company statements reported by the newspaper. The pages reviewed do not establish the precise timing of each operational milestone. 15
The sequence separates two jobs: making the equipment usable again and restoring product availability. The latter depends on logistics and stock decisions. A declared end to an IT incident can coexist with shelves still being refilled. Measuring economic damage therefore requires a definition of recovery: control of the machine, availability of goods, restored sales or payment of the costs incurred.
The Gradignan estimate was expressed at purchase cost. Other estimates might use retail value, disposal charges, lost margin or the cost of damaged equipment. Combining these measures could count the same consequence twice. A credible aggregate would require supporting records by category, a common period and a distinction between losses, additional expenditure and insurance recoveries.
This instalment therefore keeps local amounts within their stated scope. The documents reviewed provide no consolidated European economic-loss total. The lack of a reliable aggregate leaves the reality of the incidents intact and avoids attaching artificial precision to it.
The gap between professions
Commercial refrigeration sits between building services, maintenance, IT and food hygiene. ANSSI describes industrial systems as operational technology (OT), systems that act directly on physical processes. It also notes that security measures used in office IT may require adaptation in these environments. 16
A simple organisational question follows: who has a complete view from access permission to the decision about a batch of food? The shop understands its products. The refrigeration contractor understands the controls. The IT team understands the connections it manages. The investigation needs to establish where that knowledge meets, especially when equipment has been installed or maintained under a contract separate from the rest of the IT estate.
CERT-FR’s alert calls for removing direct internet exposure and restoring protected access. It also asks operators to check the insurance terms before interrupting reporting to the refrigeration contractor. That detail is a reminder to preserve effective temperature monitoring while securing the connection. 2
The missing evidence can now be named: before-and-after configurations, original logs, batch inventories, intervention reports and maintenance contracts. These records would help establish responsibilities and explain why losses differed between sites. A common retail brand identifies a commercial network. It says much less about how uniform the technical installations are.
Attribution requires another level of evidence. Destructive acts can serve several motives. Naming a group or a state demands sufficiently strong technical and contextual indicators beyond the damage and its timing. The record available on 3 November supports an account of a loss mechanism and an organisational vulnerability. It leaves the perpetrators and the connections between episodes unresolved. 4
The freezers made a familiar dependency visible. Food inventory retains its value only while physical conditions are continuously maintained. Remote control provides influence over those conditions. Protecting access, retaining usable measurements and arranging an on-site response are consequently parts of the same task: keeping control of the goods until they are sold.
Method and limitations
Documentary investigation, evidence cutoff 3 November 2026. No third-party systems were accessed or tested, and no interviews were conducted for this article. Testimony and company statements are attributed to the outlets that obtained them. The illustrations explain mechanisms; no victim’s temperature trace was obtained. Command settings, air readings and product temperatures are treated separately. The next instalment will examine the allocation of control between supervisors, local controllers and remote maintenance.
Further reading
- Part 2: who actually controls the machines?, on permissions, configuration copies and operation after a connection fails.
Our earlier Danfoss analysis examined responsibility and costs after the October incidents. Remote access to wind and solar installations illuminates another boundary between software and physical processes. The economics of recovery after a cyberattack follows the spending and operational conditions needed to restore service.
Sources
- A black day in French supermarkets after a mass cyberattack targeting refrigeration systems
The Gradignan Intermarché operator told Le Monde that losses after the 11–12 October incident amounted to €21,000 at purchase cost and reported a bailiff’s record.
Passages and scope
Passages naming Charles Dezon and Gradignan, with the loss expressed at purchase cost. An attributed local estimate; the bailiff’s record and store accounts were not obtained. Initial technical hypotheses are reassessed against the 21 October ANSSI hearing. Relevant passages of the original report were read through the web tool; no subscriber account, bailiff’s record or accounts were accessed.
- CERTFR-2026-ALE-012: incident targeting remote refrigeration controllers
Initial alert on 12 October 2026, additional equipment on 13 October and revised recommendations on 16 October. Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB families; removal of direct exposure and protected access. Check contractual insurance conditions before interrupting upstream reporting.
Passages and scope
Document management, affected systems, summary, solutions and revision history. A campaign alert, without a consolidated victim count or attribution. It does not establish exploitation of a particular CVE. The complete official alert and its revision history were read through the web tool.
- Hearing of Nicolas Roche, Vincent Strubel and Anne-Sophie Dhiver before the Foreign Affairs Committee
In the Senate hearing of 21 October 2026, Vincent Strubel described direct exposure, insufficiently secured administration and weak passwords. According to the analysis available then, vulnerabilities disclosed in the preceding two years had not been exploited in the cases examined.
Passages and scope
Vincent Strubel’s answer about refrigeration attacks, administration and weak passwords. ANSSI’s assessment as of 21 October, not a site-by-site forensic report or a conclusion extended to the November incidents. The official transcript was opened and the complete relevant passages read, improving on the access limitation in the supplied packet.
- New cyberattack on supermarket fridges sweeps across Europe
The 2 November 2026 report describes incidents in Belgium, Luxembourg, Sweden and Ireland, including 13 SuperValu stores according to Musgrave. Reuters leaves the perpetrators and any link to the French attacks unresolved.
Passages and scope
Retailer confirmations, the Musgrave statement and the paragraph leaving attribution and linkage unresolved. The full Reuters report was read in its Investing.com and Euronext republications; the original Reuters URL was inaccessible in the tool. Attributed statements, without victim logs or proof of a single operation. Original Reuters URL: retrieval error in the tool. Complete Investing.com and Euronext republications read. Read the version consulted.
- System managers / AK-SM 800A
The manufacturer describes controller supervision, temperature collection, alarms and coordinated defrost. The 800A uses a different platform from the 800.
Passages and scope
System Manager overview and new electronics platform; the official support FAQ distinguishes the 800 and 800A series. Supplier-described capabilities; victim configurations and installed architecture remain unknown. Official indexed content was read through web search; direct HTTPS requests returned HTTP 403.
- Refrigeration controllers
Defrost can use electric heaters or hot gas; temperature and time help control its operation.
Passages and scope
Chapters 1, 2, 4 and 5: setpoint and measured value, electric or hot-gas defrost, temperature termination and maximum-time backup. Design explanation, not a victim reconstruction or attack procedure. The official indexed text of chapters 1–7 was read; direct requests returned HTTP 403.
- User Guide, System Manager AK-SM 800A, BC337629891709en-001101
The HACCP feature samples every fifteen minutes and displays four-reading hourly averages, separately from service logs.
Passages and scope
BC337629891709en-001101, section 5.10, printed page 52; footer dated 2026.06. Documented feature; use and activation at victim sites are unknown. The archive’s original link redirects to this June revision; no victim trace is used. The official PDF returned HTTP 200 and was downloaded. Text from pages 35, 51–53 and 112 was extracted; page 52 was rendered and inspected.
- DSA-2025-08-01: post-authentication vulnerabilities, AK-SM8xxA
The August 2025 advisory describes two post-authentication vulnerabilities and identifies 4.3.1 as the corrective release for earlier versions.
Passages and scope
Summary, affected products and publication register; the August advisory preconditions are distinguished from the March advisory. Historical correction; neither the current latest release nor observed exploitation in October is inferred. The indexed official advisory and advisory register were read; direct requests returned HTTP 403.
- AK-SM 800A Series: product security and installation notes
Danfoss describes strict mode by default after installing 4.0.x or later, alongside compatibility options and third-party-interface precautions.
Passages and scope
Product security, Session Control and Important installation notes; June manual, section 5.5, printed page 35. Supplier statements, also checked on June manual page 35; no independent certification or victim configuration inferred. The indexed official product page was read and corroborated against page 35 of the downloaded official PDF.
- After Danfoss, other refrigeration systems were targeted
Le Monde reports Dixell incidents during the night of 12–13 October 2026, distinct from the first 11–12 October episode.
Passages and scope
Opening passages, refrigeration-technician testimony and the extension to Dixell equipment. Reporting and attributed testimony. Initial vulnerability hypotheses are reassessed against ANSSI’s 21 October account. Complete relevant passages of the original report read through the web tool.
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs, consolidated 24 March 2021
The regulation assigns primary food-safety responsibility to the operator and addresses hazard control and cold-chain maintenance.
Passages and scope
Articles 1, 4 and 5; Annex II, Chapter IX. EUR-Lex lists the 24 March 2021 consolidation. General principles and the 2021 consolidated version were reviewed; no individual lot-release decision or legal advice. The indexed official 2021 consolidated text was read. Direct requests returned HTTP 202 with an anti-bot page; no legal PDF was downloaded.
- Directive 89/108/EEC on quick-frozen foodstuffs, consolidated 1 July 2013
The directive covers foods marketed as quick-frozen and sets −18 °C or below throughout the product, subject to specified tolerances.
Passages and scope
Articles 1(2) and 5(1)–5(3); transport and retail tolerances have distinct conditions. The directive excludes edible ices; this product threshold differs from air and chilled-food rules, with no safe release interval calculated. The complete indexed official text of Articles 1 and 5 was read. Direct requests returned HTTP 202 with an anti-bot page.
- Regulation (EC) No 37/2005 on temperature monitoring of quick-frozen foodstuffs
Articles 2 and 3 distinguish air-temperature recording in transport/storage from retail-cabinet and certain small-store derogations.
Passages and scope
Article 2 on regular air monitoring; Article 3 on retail cabinets and certain reserves smaller than 10 m³. Continuous recording must not be described as a universal requirement for every retail cabinet. The indexed official text of Articles 1–5 was read. Direct requests returned HTTP 202 with an anti-bot page; no legal PDF was downloaded.
- Refrigeration cyber attack hits SuperValu as frozen food removed from sale
Musgrave reports 13 affected SuperValu stores, precautionary withdrawal of chilled and frozen products, detection through its monitoring systems and immediate action.
Passages and scope
Article body reporting the Musgrave spokesperson’s statement. A company statement reported by the newspaper, without raw monitoring data or independent audit. The CMS shows 00:00 and does not provide a usable announcement time. The original article was opened through the link in the follow-up report and the relevant complete paragraphs read.
- Cyber attack on SuperValu fridges now resolved
Musgrave says the incident has been resolved and stores are operating normally while replenishment of the affected ranges continues.
Passages and scope
Headline, subheading and Musgrave statement in the article body. Resolution is the company’s statement, without a public independent technical audit. The CMS shows 00:00; no hourly resolution duration is inferred. The original article and its complete relevant passages were read through the web tool.
- Cybersecurity for industrial systems: detailed measures, guide presentation
ANSSI’s presentation describes OT systems controlling and monitoring processes with direct physical effects, and the need to adapt some IT security measures to industrial constraints.
Passages and scope
HTML presentation paragraphs on OT/IT; additionally, version 2 PDF §§1.1–1.2, printed pages 5–6. 19 December 2025 is the page publication date. The linked version 2 PDF is dated 27 November 2025; only its introduction and scope were read additionally, without importing unreviewed technical prescriptions. The HTML presentation and the specified sections of its linked official PDF were read.
This analysis is not investment advice.
// cite this analysis
l0g, “The day supermarket freezers became a target”, l0g.fr, published November 03, 2026, updated November 03, 2026, https://l0g.fr/en/analysis/ordinary-machines-01-freezers-target/
$ cd ../analysis