TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
IPinfo’s October 6–7, 2026, scan found 1,331 internet-accessible Danfoss refrigeration dashboards in France, more than in the other 72 countries and territories combined. The company’s analysis found known security flaws on 85% of those dashboards; the scan does not establish that each exposed system was compromised or identify who carried out the attacks on supermarkets.
Hundreds of French supermarkets reported refrigeration disruptions after attackers put store cooling systems into defrost mode overnight on October 11–12, 2026, while a scan by internet-data company IPinfo found that 1,331 Danfoss refrigeration dashboards in France were accessible online days before the incident. IPinfo said 85% had known security flaws; the scan documents exposure, but does not show which systems were attacked or how intruders got in.
IPinfo said its weekly scan on October 6–7 detected 2,528 internet-facing Danfoss StoreView dashboards worldwide. France accounted for 1,331, or 53%, more than the 1,197 found across the other 72 countries and territories combined. Poland had the next-highest count, with 179, followed by the United States with 101. The dashboard is a web interface used to monitor and manage refrigeration controllers.
In its analysis, IPinfo found that 1,136 of the French dashboards ran software with known security flaws. The count included 527 older controllers no longer supported by Danfoss, 280 systems missing fixes released in 2023, and 329 missing fixes from 2025. IPinfo found that 195 had all known fixes. The share with known flaws was similar elsewhere: 84% outside France, according to the company.
The attack’s effects were reported across supermarket chains. Futura-Sciences reported that more than 400 stores were hit, with losses potentially reaching several million euros. Carrefour said 80 stores were affected. Intermarché and Netto, both part of Les Mousquetaires, reported more than 300 affected stores. Monoprix said about 5% of its stores were affected. Coopérative U chief executive Dominique Schelcher told RTL that 80 of the group’s 2,000 stores were hit. Leclerc and Coopérative U also confirmed attacks, according to IPinfo’s report.
Exposed Controls Put Store Cooling at Risk
Supermarket refrigeration systems protect fresh and frozen food, so losing control of them can lead to spoilage, disruption and financial losses. The Paris prosecutor said some equipment reached 50°C (122°F) and that some units began to catch fire. Stores discarded food after the cooling systems were reportedly forced into defrost mode, which heats refrigeration components to melt ice.
The scan points to a broad exposure problem, not proof that every dashboard was vulnerable to the same attack. IPinfo found France had far more exposed dashboards than other countries, while the proportion with known flaws was nearly the same. That distinction matters: the report suggests France stood out because of the number of systems online, rather than unusually poor patching rates.
Remote access can support service providers and refrigeration contractors who monitor equipment, but it can also make control interfaces reachable from the public internet. CERT-FR advised operators to disconnect affected systems or limit who can access them. Its guidance also asks operators to check insurance terms before cutting data connections used by contractors, underscoring the operational trade-off between remote service and restricting access.
Danfoss refrigeration dashboard security camera
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
A Long-Running Online Exposure
IPinfo said scans from late March 2026 through the attack repeatedly found between 2,464 and 2,622 Danfoss dashboards exposed worldwide. Of the French dashboards, 1,019 were at the same internet addresses on March 30 as in the October scan. Over that period, the share of French dashboards with all known fixes rose from 14% to 24%, according to IPinfo. The figures indicate persistent visibility online, but an address remaining the same does not by itself confirm that a particular controller was continuously reachable or compromised.
The systems span different generations. IPinfo described older AK-SM 800 controllers using a Flash-based dashboard; Danfoss declared that model end of life in 2023. The newer AK-SM 800A is a current model, but IPinfo said its observed software versions also included systems missing security updates. The company counted flaws associated with earlier firmware and later fixes, including a 2025 login-bypass fix for versions older than 4.2.
Danfoss said most affected equipment was “legacy” and named the AK-SM 800 and AK-SC 355 controllers. CERT-FR, France’s cybersecurity agency, said it knew of numerous compromises involving AK-SM and AK-SC controllers. On October 13, it expanded its alert to include XWEB supervisors from Copeland and its Dixell brand, which monitor refrigeration equipment. Its alert said attack campaigns were probably still ongoing.
““legacy””
— Danfoss
Attack Path and Full Impact Remain Unknown
Authorities and companies have not publicly identified who carried out the attacks or explained how the attackers accessed the refrigeration systems. The Paris prosecutor’s office has opened an investigation. IPinfo’s scan shows which dashboards answered on the internet during its scans, but it does not establish that attackers used those dashboards to gain access or that every exposed system was exploitable.
The exact number of affected stores and the total losses are also not settled. Futura-Sciences reported more than 400 stores affected and potential losses of several million euros, while individual chains supplied their own figures. Those reports may cover different store groups or stages of the incident. It is also unclear how many refrigeration units were compromised, how much food was discarded, and whether any fires caused injuries or wider damage.
IPinfo reported that most of the 1,331 French dashboards had gone offline after the attack, but 316 were still online on October 14. That is a later scan result, not confirmation that those systems remained compromised or were still being targeted.
Investigation and Access Restrictions
The Paris prosecutor’s investigation is expected to examine how the attacks occurred and who was responsible. CERT-FR’s guidance calls on operators to disconnect controllers or restrict access, and its October 13 alert said activity might continue. The agency also broadened the products covered by its warning to include Copeland and Dixell monitoring systems.
Supermarkets, refrigeration contractors and equipment suppliers will need to determine which controllers were affected, whether software updates are available, and how to keep necessary service links without leaving management interfaces open to the public internet. IPinfo’s October 14 scan found 316 French dashboards still online; subsequent figures and any confirmed remediation were not included in the source material.
Further updates may clarify the number of affected stores, financial losses and the attackers’ access method. Until investigators publish more findings, the link between the broad internet exposure documented by IPinfo and the specific intrusions remains unconfirmed.
Key Questions
What happened to the supermarket refrigeration systems?
According to the source report, attackers pushed refrigeration systems into defrost mode overnight on October 11–12, 2026. That process heats cooling components to melt ice. Some equipment reportedly reached 50°C, and stores discarded fresh and frozen food.
How many French refrigeration dashboards were exposed?
IPinfo’s October 6–7 scan found 1,331 Danfoss StoreView dashboards accessible online in France. It found 2,528 worldwide, with 1,197 in the other 72 countries and territories combined.
Does the scan prove the exposed dashboards were used in the attacks?
No. The scan records dashboards that responded on the internet. It does not show which systems attackers accessed, whether every dashboard could be exploited, or how the intruders entered the affected networks.
What did officials advise operators to do?
CERT-FR advised operators to disconnect affected controllers or restrict access. Its guidance also said operators should check insurance terms before cutting data links used by refrigeration contractors.
Who is responsible for the attacks?
The source material does not identify a perpetrator or describe a confirmed access method. The Paris prosecutor’s office has opened an investigation, and those questions remain unresolved.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
