French Supermarkets Lost Their Freezers to a Hacker. In a UK Store, Who Would Notice at 3am?

01 What happened in France

Coopérative U’s chief executive, Dominique Schelcher, said refrigeration had been disrupted since Sunday night and called the attack “unprecedented”. Intermarché told AFP its affected branches would have to “throw away all of the products” that are fresh and frozen. Its chief executive, Thierry Cotillard, told BFM TV the losses could reach “tens of millions of euros nationwide in a single day” [ Al Jazeera 2026 ] .

Carrefour said 80 of its supermarkets were hit. Monoprix put its figure at about 5% of its stores. The Paris prosecutor’s office opened an investigation into “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France” [ RTÉ 2026 ] . Prime Minister Sébastien Lecornu asked the national cybersecurity agency, ANSSI, to investigate. No group has claimed the attack.

Danfoss, the Danish manufacturer of the controllers, told AFP that most of the affected equipment was legacy product that “no longer receive[s] software or security updates”. It named its AK-SM800 and AK-SC355 regulators. Two months earlier, Claroty’s Team82 had published a login bypass in the Danfoss AK-SM 800A, fixed in firmware R4.3.1, and counted 2,765 of the controllers reachable from the internet [ Claroty 2026 ] . Nobody has confirmed which flaw the attackers used.

ANSSI is working with European counterparts because other countries may be affected. One analyst, Felix Aime of Sekoia, named Spain, Portugal, Poland, Germany and Belgium. The UK was not on his list, and as of 13 October the NCSC had said nothing about the incident.

02 The way in belongs to your contractor

Refrigeration in a UK supermarket, a hotel kitchen or a distribution centre is usually installed and maintained by a specialist firm. That firm manages the store controller remotely so an engineer can adjust a setpoint or clear an alarm without driving to site. The controller has a web login. The remote route is whatever the contractor set up: a VPN, a port opened on the store router, a 4G modem in the plant room.

Each of those routes was set up so an engineer could reach the controller from anywhere. Whether a stranger can use the same route depends on details the retailer rarely sees. Does each engineer have a personal login, or does the whole firm share one? Is the same password used across every store? Does the login page answer on the internet? Is the firmware on a version the vendor still supports? E.Leclerc said its stores were hit through “one of its refrigeration equipment suppliers”.

03 Different from M&S and Co-op, and why that matters

UK retail has had its own hard lesson. In April 2025 Marks & Spencer stopped taking online orders for clothing and home after a cyberattack, and by early May about £700 million had come off its market value. Co-op said attackers had taken data on a significant number of current and past members [ Reuters 2025 ] . The NCSC’s chief executive, Richard Horne, called the incidents “a wake-up call to all organisations”.

Most of what UK retailers heard afterwards was about identity, help-desk procedures and corporate IT, and rightly so. The French attack took a different path. It went nowhere near email, the help desk or the online shop. The attackers stole and encrypted nothing. They reached a box in the back office that the IT team does not own, and the cost arrived as warm freezers, skips full of food and, in some stores, fires.

A business can pass a Cyber Essentials assessment and a penetration test of its corporate network and still have store controllers on the internet, because neither exercise looked at them. Facilities bought the kit, the contractor manages it, and it appears in no asset register IT controls.

04 Seven questions for your refrigeration contractor

Send these to every contractor who maintains connected plant in your sites: refrigeration first, then heating, ventilation, energy and access control. Good contractors will answer quickly. Slow or vague answers tell you where to look first.

• Which controllers do you manage for us? Make, model and firmware for every site.
• Which of those models has the vendor stopped updating? For Danfoss, ask specifically about AK-SM800 and AK-SC355 units, and whether AK-SM 800A units are on R4.3.1 or later.
• How do your engineers connect? Through a VPN, a remote-access tool, an open port or a modem. Get the answer per site.
• Does every engineer have a personal login? One shared password across your stores means one leak opens all of them.
• Does any controller login page answer on the internet? Ask them to prove it does not.
• Who gets the temperature alarm at 3am, and by what route? The alarm needs to reach a person through a route someone on the controller cannot switch off.
• Can you show us the access log for last month? If nobody can, nobody would see an attacker either.

Then check the answers independently. A contractor’s word that nothing is exposed is worth exactly as much as their last look at your router. Give us your public address ranges and a list of your sites, and within 14 days you will know which controllers answer from the internet, what each one lets an attacker change, and which contractor route to close first.