When cyberattacks turn physical: Lessons from France’s supermarket incident

An expert perspective from Franco Monti, MSF – an Allurity company

In October 2026, a cyberattack disrupted refrigeration systems at hundreds of French supermarkets, including Carrefour and Monoprix. Attackers manipulated refrigeration controls, causing temperatures to rise, food to spoil and operations to be disrupted.

The incident demonstrates how vulnerabilities in operational technology (OT) can have immediate physical and financial consequences.

We asked Franco Monti of MSF, an Allurity company specialising in OT security, what European retailers can learn from the incident and which actions they should prioritise.

1. What makes this incident particularly significant from an OT security perspective?

What stands out is how directly a cyberattack affected physical operations. The attackers did not need to steal customer data or encrypt business systems to cause substantial damage. They interfered with equipment that stores depend on every day, Franco explains.

It is a reminder that OT security is not limited to factories or critical infrastructure. Refrigeration, heating, ventilation, air conditioning (HVAC) and building management systems are also part of an organisation’s attack surface.

To put the scale in perspective, this was not a marginal event. Reports suggest that roughly 700 of the country’s approximately 10,000 supermarkets were affected over the night of 11–12 October 2026, with between 250 and 350 stores losing their cold chain outright. The banners hit included Intermarché and Netto (over 300 stores), Coopérative U (more than 100), Carrefour (around 80), Monoprix (about 30, or roughly 6% of its circa 490 French stores) and E.Leclerc, France’s largest chain.

The attackers reportedly forced refrigeration units into a continuous, built-in defrost cycle that drove internal temperatures to around 50°C (122°F), spoiling fresh and frozen stock and, in several stores, sparking fires. Thierry Cotillard, who heads Les Mousquetaires (Intermarché), put the damage at tens of millions of euros nationwide in a single day.

What makes the incident instructive is that the attackers appear to have abused a legitimate, documented function of the equipment: automatic defrost. Reports suggest that the forced defrost did not trigger normal temperature alarms, leaving staff unaware that the cold chain had already been broken. This resembles a textbook ‘living-off-the-land’ attack against a cyber-physical system, and it is exactly the pattern we help clients anticipate when it comes to protecting OT infrastructure.

2. What does this incident reveal about weaknesses in retail OT security?

Let me be specific about the technical weaknesses, because they matter. The attack surface was the management layer of the refrigeration estate. France’s CERT-FR (ANSSI) alert CERTFR-2026-ALE-012 confirmed numerous compromises of Danfoss AK-SM and AK-SC series controllers, and subsequently widened the scope to Copeland XWEB and Dixell XWEB controllers as well.

The affected Danfoss models included the AK-SM 800A, together with the legacy AK-SM 800, declared end-of-life in May 2021, and the AK-SC 355, phased out around 2016. Neither legacy unit still receives software or security updates, and some current-generation AK-SM 800A units may also have been running outdated firmware.

The first and most fundamental flaw was direct exposure of the management interface to the public internet. These StoreView web consoles are reachable so that maintenance firms can adjust settings remotely. Before the attack, security researcher Félix Aimé of Sekoia counted more than 1,700 instances of the affected Danfoss software exposed online in France alone. Predicta Lab reported roughly 2,752 Danfoss systems reachable worldwide on 12 October, 1,590 of them in France, and Shodan was tracking over 4,500 Danfoss devices on the open internet.

An attacker would not necessarily need to breach a corporate network or reach a store physically. They could potentially scan for exposed controllers and interact with the web application directly.

On top of that exposure sat a chain of controller vulnerabilities that had already been documented and responsibly disclosed in 2025. Three are particularly relevant:

A hidden ‘code-of-the-day’ authentication bypass (CVE-2025-41450, CVSS 8.2): an undocumented vendor mechanism that generates a valid daily password purely from the device’s own date. Anyone who reconstructs the algorithm can obtain a fully privileged administrative session without knowing the operator’s password.

A command-injection flaw leading to remote code execution (CVE-2025-41451, CVSS 8.7): an unsanitised field in the SMTP/email configuration page is passed straight into an operating-system shell command, letting an authenticated attacker run arbitrary commands on the controller.

An Nginx configuration-injection and denial-of-service flaw (CVE-2025-41452, CVSS 6.8): the web application lets an authenticated user replace the internet-facing web-server configuration at runtime, allowing traffic manipulation and a repeatable crash of the management service.

Chained together, these vulnerabilities could turn an internet-exposed box into a system under full administrative control. And because the controller is the central console that monitors circuits, sets temperature thresholds and manages alarms, whoever controls it may be able to trigger defrost cycles, interfere with alarms and manipulate reported temperatures. However, the precise vulnerabilities exploited in this incident have not yet been publicly confirmed.

Danfoss fixed the command-injection and configuration-injection issues in firmware R4.3.1. Copeland also released firmware 1.13 to address previously identified XWEB Pro vulnerabilities. These vulnerabilities were publicly documented, and patches were available before the attack.

The deeper network lesson is architectural. Refrigeration, HVAC and IoT equipment were treated as ‘appliances’ rather than as part of the OT estate, so they were left internet-facing, flat (not segmented behind a firewall or VPN into their own zone), running end-of-life firmware with default or weak credentials, and reachable by third-party maintenance providers whose remote access was poorly governed and rarely monitored. Each of those is individually fixable. Together, they can create an open door into the physical operations of a supermarket.

3. What should every European retailer do immediately?

I would prioritise six actions:

1. 1. Build a reliable asset inventory. Check your exposure as soon as new vulnerabilities or exploits become known.
   2. Establish a vulnerability management process. It should cover all store infrastructure, not just IT.
   3. Take management interfaces off the internet. Where remote access is unavoidable, route it through a dedicated OT remote access solution and limit which suppliers can connect.
   4. Address vulnerable and obsolete equipment. Apply available firmware updates, change default credentials, and isolate or replace end-of-life units.
   5. Verify independent monitoring. Make sure monitoring and alarms can detect unsafe conditions, even when the controller itself reports normal operation.
   6. Rehearse disruption. Run regular tabletop exercises to practise emergency response and business continuity.

These actions should not wait until an incident occurs. They are fundamental to protecting operational continuity.

4. Germany’s BSI has issued a warning about internet-connected OT systems. What should organisations take away from it?

The BSI’s recommendations reinforce an important principle: systems that control physical processes should not be directly accessible from the internet.

But technical protection is only part of the answer. Organisations also need to know how quickly they can detect unauthorised changes, who can intervene and how they can restore safe operations.

The goal is not simply to prevent attackers from accessing OT systems. It is to make sure a cyber incident cannot easily become a business crisis.

It is worth stressing how preventable this was. The U.S. CISA had already flagged the Danfoss authentication-bypass and command-injection flaws in bulletins in May and August 2025, the vendor advisories and the R4.3.1 firmware were out, and warnings from several national agencies pointed to the same core problem: internet-reachable OT. The information needed to avoid this incident existed well before October.

What was missing was the visibility to know these controllers were exposed, the governance to get them patched or segmented, and the independent monitoring to notice a forced defrost in progress. That gap between a known vulnerability and an organisation actually acting on it is where most OT incidents live and it is exactly what disciplined asset inventory, exposure management and continuity planning are designed to close. OT Security issues need to be taken seriously and need to be put into the hands of OT Security experts.

5. What does this incident mean for the upcoming EU Cyber Resilience Act and Machinery Regulation?

This is the part retailers and manufacturers should sit up for. Two pieces of EU law are about to make the weaknesses behind this attack a compliance and liability matter, not just an operational one. The EU Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and for the first time builds cybersecurity essential requirements directly into machinery safety. Connected equipment such as refrigeration and HVAC control systems, where covered by the Regulation, must be designed so that a cyberattack cannot compromise safe operation.

The EU Cyber Resilience Act (EU) 2024/2847 governs ‘products with digital elements’, which can include these controllers depending on the Regulation’s scope and exclusions, with main obligations applying from 11 December 2027 and vulnerability and incident-reporting duties already beginning on 11 September 2026.

It demands security-by-design, no known exploitable vulnerabilities at the point of sale, mandatory security updates throughout the support period, coordinated vulnerability disclosure and a software bill of materials.

Measured against those rules, this incident illustrates the kinds of weaknesses the CRA and Machinery Regulation aim to address: end-of-life controllers with no update path, exposed management interfaces, an undocumented backdoor authentication mechanism and unsanitised input leading to remote code execution. The regulations are not bureaucratic overhead. They address precisely these kinds of risks, and organisations that wait for the deadlines may face both security incidents and compliance challenges.

This is where MSF, as an Allurity company, supports clients on both sides of the equation. For asset owners such as retailers, energy and industrial operators, we run OT asset inventories and internet-exposure assessments, IEC 62443-3-2 zone-and-conduit risk assessments and segmentation design, secure remote-access and supplier-governance reviews, and the crisis-management, business-continuity and operational-continuity planning that keeps a cyber incident from becoming a business crisis.

For manufacturers and OEMs facing the CRA and Machinery Regulation, we help translate the essential requirements into a concrete secure-by-design, vulnerability-handling and conformity programme. Together with our Allurity-group sister company SRLabs in Berlin, whose AI-assisted OT application code-review capability finds exactly the class of command-injection and authentication flaws seen here, we can test products and controllers in place, not after they are exploited. The French supermarket attack is the clearest signal yet that OT resilience and regulatory readiness are now the same project.

MSF is part of Allurity, a European group of cybersecurity specialists working together to help organisations strengthen their cybersecurity.