At an Intermarché in Gradignan, a delivery driver found the storeroom flooded around four in the morning on October 12. Owner Charles Dezon told Le Monde that the cold room had reached 50°C and triggered a sprinkler.1
Elsewhere, refrigeration installers were disconnecting the systems used to supervise cold rooms and display cabinets. Their trade body, SNEFCCA, said on October 12 that installers had protected merchandise and were waiting for a Danfoss-validated procedure before reconnecting.7 They could remove a remote connection immediately. They still needed to know how to restore it safely.
By Tuesday afternoon, Finance Minister Roland Lescure estimated that about 700 of France’s 10,000 supermarkets had been affected, according to AP.2 The entry route had not been publicly established. Store staff had to deal with the food before that explanation arrived.
Keeping the food cold
The cold chain is the sequence of refrigerated storage, transport and display that keeps perishable food within its required temperatures. A break occurs when those conditions are not maintained. Different foods have different limits; food-safety staff need the product’s temperature history to decide what can be retained or must be removed.9
Coopérative U’s chairman and CEO, Dominique Schelcher, reported 80 affected stores out of nearly 2,000 on October 13. In most, he said, teams prevented a cold-chain break. Where they could not, products were withdrawn and destroyed. He also described the value of continuous remote monitoring.3 An overnight alarm can give a technician time to intervene before a store opens.
Removing a remote connection may also remove that alarm. CERT-FR tells operators to check insurance terms before cutting the Internet data link to their refrigeration contractor, and to restore access through a secure VPN or protected network.4 An operator planning to disconnect a system needs to know which cooling functions and alarms will continue, and who will check temperatures in its place.
CERT-FR’s alert, issued October 12 and expanded October 13, identifies compromised Danfoss AK-SM and AK-SC controllers and Copeland/Dixell XWEB systems.4 Dixell belongs to Copeland.15 Early reporting had centered on the Danish manufacturer Danfoss; the expanded alert identifies equipment from Copeland/Dixell as well.
On October 13, the director of an E.Leclerc in Lescure-d’Albigeois told La Dépêche that his store, which used Dixell controls, had discarded stock after an overnight attack.17
Danfoss’s statement to Cooling Post named AK-SM800 and AK-SC355 systems, along with AK-SM800A units running outdated firmware. The company described work with customers on available updates and network protections.5
Neither the product list nor the existence of previously published vulnerabilities establishes the entry route. Claroty’s Team82 had researched flaws in refrigeration controllers; its incident commentary, updated October 13, still said the access method was unknown.6
A stolen service account, an exploited controller, a breached contractor service and a malicious software release would each require a different investigation. The evidence reviewed here does not establish a compromised supplier cloud or poisoned update. Product teams should keep those possibilities separate until logs and forensic work identify the failure.
What an account is allowed to do
Le Monde reported that defrost cycles had been extended from one hour to eight.1 A controller needs to permit ordinary defrosting. Its designer also needs to decide how long a cycle may run, how often it may repeat, and what happens when temperatures move outside the approved operating range.
Authentication cannot make those decisions. A device certificate helps identify the key holder at the other end of a connection. Strong administrator authentication makes account takeover harder. A legitimate account can nevertheless be used incorrectly, through a stolen session, a compromised workstation or a technician’s mistake.
The receiving system must check the requested action. Is this account permitted to change this customer’s equipment, at this site, during this maintenance window? Does the proposed change fall within limits that engineers and operators have tested for the equipment’s current state? Those checks must continue locally when the upstream service is unavailable or compromised.
The architecture below places the sites behind separate access controls. A factory, fuel forecourt, grocery store and electrical site have different operating requirements. Each needs an explicit policy for loss of remote service, local intervention and recovery.
Temperature measurements also need scrutiny. Two dashboards may use the same sensor, gateway, account and management service. If that service fails, both can fail together. Independent measurement gives local staff another way to check the food and equipment, provided its power, communications and alarm route do not depend on the failed system.
The public record does not establish which safeguards the French stores had, which failed, or which helped staff prevent losses. These are design requirements to examine in an operator’s own installations.
NIST SP 800-82 Rev. 3 treats performance, reliability and safety as part of OT security. Its September 21, 2026 Rev. 4 initial public draft adds food-and-agriculture coverage and guidance on protecting system management functions. Rev. 3 remains final; comments on Rev. 4 close November 30.14 Retail refrigeration teams can contribute examples from their work: what happens to alarms when a supplier is disconnected, how local staff regain control, and how a restored system is checked before reconnection.
One account, many sites
A central support system saves travel and speeds maintenance. It may also let one account reach hundreds of controllers. A product review should establish how many devices that account can change, whether bulk operations need separate approval, and how quickly the operator can stop a session.
Team82’s earlier research found 2,765 Internet-exposed Danfoss AK-SM800A units.6 That count describes exposed devices. It does not identify French victims or show that one account controlled them all.
Remote access should be limited to named equipment, necessary actions and an approved period. The operator should be able to see the session and end it. A supplier’s emergency account needs its own limits; urgency should not silently grant access to other customers.
Separating customer records in a database does not ensure that commands stay within the same customer boundary. The service and the receiving site both need to enforce which customer and equipment a support account may address. Otherwise, a permission granted for one customer can become a route into another’s plant or store.
The access rules need an owner for the life of the equipment. Danfoss said the AK-SC355 was phased out in 2016 and the AK-SM800 reached end of life in 2021.5 Refrigeration machinery can remain useful long after software support ends. The manufacturer, installer and operator need to agree who will restrict access, apply updates and arrange replacement.
SNEFCCA said installers had not been warned of a specific flaw.7 A product-security team should follow an advisory through its distribution and support channels, rather than treating publication as proof that every installer and asset owner acted on it.
CERT-FR warns that resetting an Internet-exposed end-of-life unit without a security fix removes persistence but leaves the device vulnerable to another compromise.4 A reset cannot substitute for removing the exposure or replacing equipment that cannot be secured.
For products within the Cyber Resilience Act’s scope, manufacturers already have reporting duties. Article 14 has applied since September 11, 2026. It covers actively exploited vulnerabilities contained in their products and severe incidents affecting product security, with an early warning without undue delay and within 24 hours of awareness. Article 69(3) includes products placed on the market before December 11, 2027. The broader product requirements begin that December; older products are generally covered only if substantially modified from then.16
I recently wrote about that reporting deadline. Manufacturers need to identify affected product versions and assemble an initial account while the investigation is still incomplete. The public record reviewed here does not establish a CRA notification for this incident.
Reconnecting
The following recovery approach is a recommendation for operators and product teams. NIST cautions that isolating a system under attack can itself affect OT operation.8
Qualified refrigeration and food-safety staff should first protect the physical service, measure temperatures independently and assess suspect stock. Restored cooling does not establish that food stayed within its storage limits while the system was disrupted.9
Next, identify the actual remote paths. Ending a supplier session, restricting a management interface or isolating a gateway need not mean switching off refrigeration. Check cooling, protective functions and alarms as each path is restricted. Arrange substitute monitoring where needed.
Preserve logs and configuration where it is safe to do so. Urgent protection of people, equipment and stock takes priority. Record the intervention and any evidence it prevented staff from collecting.
A disconnected controller can retain an altered schedule. Compare its settings with an approved baseline and test its operation. CERT-FR calls for reviewing the configuration, particularly defrost schedules; its Danfoss examples include firmware updates, Strict security mode and changed default passwords.4 Check sensors and alarms too. A backup is useful only after its contents have been validated.
Before reconnection, validate the administration systems and their permissions. Rebuild infrastructure implicated by the evidence, end suspect sessions, and rotate or reissue affected credentials where justified. Plan the replacement sequence: revoking certificates across a fleet can interrupt monitoring or leave devices unable to reconnect.
Start with a small approved group of devices. Observe temperatures through relevant operating cycles, test alarms and rejection of unauthorized commands, and retain a tested way to return to safe local operation. That fallback should not depend on reinstalling known-vulnerable software. Add further groups only when each meets the agreed criteria.10
Device identity and software updates
Manufacturers can make this work easier before equipment leaves the factory. Each device needs credentials that can be provisioned, renewed, revoked and retired, with permissions limited to its role. Hardware-backed keys, where supported, make extraction and cloning harder. Human administrators need phishing-resistant MFA and narrowly scoped access. The release process needs protected signing keys, and the device needs to verify the software it receives.
Disclosure: I am Regional Field CTO at DigiCert. These are my own views.
DigiCert® Device Trust Manager documents certificate lifecycle, provisioning and hardware-security integration.11 The DigiCert® TrustCore SDK provides embedded cryptography and authenticated communications, including mutual TLS.12 DigiCert® Software Trust Manager documents signing governance, SBOM generation, and threat and vulnerability detection.13
These tools address device credentials, communications and software releases. The controller still has to reject unsafe commands. A signature establishes origin and integrity, not the absence of defects. A compromised authorized application may use a hardware-protected key without extracting it. Independent measurements and local operating limits remain the manufacturer’s and operator’s responsibility.
Compatibility with every affected refrigeration controller has not been established. Nor is there evidence that these products would certainly have prevented this incident.
For the next product review, choose one approved site in a controlled test environment. Give a service account legitimate access, verify that it cannot change another site or exceed the permitted actions, then withdraw its remote access. Cooling and required alarms should continue under the agreed local policy. Qualified staff should conduct the exercise before anyone tries it on a live cold chain.
Remote access should be something an operator can withdraw without losing the cold.
Sources
Information checked through October 13, 2026, 16:25 UTC. The intrusion mechanism, final victim count and nationwide restoration status remain unresolved in the public evidence reviewed.
-
Le Monde, October 13, 2026: Gradignan operator account. ↩↩
-
AP, October 13, 2026, 15:56 UTC: Government estimate of about 700 affected supermarkets. ↩
-
Dominique Schelcher, October 13, 2026: RTL interview report on 80 affected U stores; X update, 11:06:41 UTC, also describing withdrawn and destroyed food. ↩
-
CERT-FR, CERTFR-2026-ALE-012, October 12–13, 2026: Affected controller families and official recommendations. ↩↩↩↩
-
Cooling Post, October 12, 2026: Danfoss statement on affected products and mitigation. ↩↩
-
Claroty Team82, October 12, 2026; updated October 13: Incident commentary distinguishing previous research from unknown access. ↩↩
-
SNEFCCA, October 12, 2026: Refrigeration installers’ statement. ↩↩
-
NIST SP 800-82 Rev. 3, final September 28, 2023, §6.2.4.5: Containment can affect OT operation. ↩
-
French Ministry of Agriculture, June 23, 2026: Product-specific cold-chain requirements. ↩↩
-
NIST SP 800-184, December 2016: Cybersecurity event recovery; ANSSI, March 18, 2024: Piloter la remédiation. ↩
-
DigiCert: Device Trust Manager documentation, last modified October 12, 2026. ↩
-
DigiCert: TrustCore SDK and mutual-authentication configuration, accessed October 13, 2026. ↩
-
DigiCert: Software Trust Manager documentation, last modified October 7, 2026; signing governance capabilities. ↩
-
NIST SP 800-82: Rev. 3 final, September 2023; Rev. 4 initial public draft, September 21, 2026. Remote-access and management-architecture guidance informs the conceptual figures; their exact layouts and gates are the author’s synthesis. ↩↩
-
Copeland: Dixell brand and XWEB systems, accessed October 13, 2026. ↩
-
Regulation (EU) 2024/2847, Articles 14, 69(2)–(3) and 71(2): Official Journal text. ↩
-
La Dépêche, October 13, 2026: Named store director’s account from Lescure-d’Albigeois. ↩
-
AFP, October 12, 2026, via Le Temps: Reporting identifying affected retail chains. ↩