A reconstruction of the October and November attacks: how a freezer comes to have a public web address, why three years of warnings missed the people who paid, and the five mistakes the record shows store owners making without knowing it.
By Yehuda B Abraham, IHR Magazine. November 10, 2026.
The service password on the freezer controllers at the centre of France’s supermarket attack was a code calculated from the day’s date. Researchers had reported it to the manufacturer in 2023. On October 12, 2026, about 700 stores paid for that design. The refrigeration cyberattack that followed across Europe required no hacking talent, because every door it used had been built on purpose and then forgotten.
One supermarket in Étréchy, south of Paris, wrote off about €60,000 of stock in a single night. The controller brands involved are sold in Canada, for the same kind of cases that hold refrigerated probiotics, kombucha, fresh meals and frozen food in a health store.
A freezer carries its own heaters, and a schedule that can be edited
Every commercial freezer has to melt the ice off its coils, so it is built with heaters and a timetable for running them, known as the defrost cycle. Because the case warms slightly each time, the temperature alarm is designed to stay quiet while defrost runs. The attackers in France combined those two facts. They stretched the cycle from one hour to eight, according to Le Monde, which meant the heaters ran through the night while the alarm waited as programmed. Cases sat near 50°C for about six hours, one Normandy store reported 80°C, and Paris prosecutors recorded equipment catching fire.
A log recovered by the security group Ransom-ISAC from a store hit in the second wave, on November 2, shows the speed involved. Between 3:15 and 3:21 a.m., one session sent 588 setting changes to 26 cases, roughly 1.6 a second, which points to a script and not a person. Temperature targets were rewritten to 110°C, and the cases were sent a command meant to lock their keypads against the staff who would arrive to turn them back down.
The door was installed for the repair technician
Nobody at these stores decided to put a freezer on the internet. A refrigeration contractor looks after many sites. The simplest way to watch them all is to plug each controller into the store’s own internet line and open a path through it. Network data firm IPinfo found 98 per cent of the exposed French control panels on ordinary telecom connections, which is the signature of exactly that arrangement.
The date-based code had a similar practical origin. It gave technicians a way into a unit without the password a store had set, and it therefore opened every controller of that model on a given day. French firm Synacktiv reported it in March 2023. Whether the October attackers used that route or simply found weak passwords has not been published. Synacktiv called the operation opportunistic: scan for open panels, then try what is known to work.
The equipment was never bought as a computer. It arrived with the compressors, on a facilities budget, to run for what Michael Ferdinandsen, chief executive of Danish remote-access firm Secomea, describes as “years, sometimes decades.”
The warnings were sent to the wrong address
Danfoss, whose controllers were the first to be named, withdrew one of the affected models in 2016 and ended support for the other in May 2021. In 2022 the same controller family was used against supermarkets in Russia and Israel. By October 2025 the company was writing to customers, citing those attacks, to say the old units should be replaced.
The letter changed little. Five days before the French attack, IPinfo counted 1,331 Danfoss panels open to the internet in France. Of those, 1,019 had been sitting at the same address six months earlier. Over that half-year the share of newer units carrying every available fix rose from 14 to 24 per cent, which is under two points a month.
A review by the French security site Ostraca found the explanation in the mailing list. Manufacturer advisories went to the contractors who install the controllers and hold the remote login. The store owners who would pay for a replacement, and for the spoiled stock, were not on it. A product recall reaches the store. A security notice for the case that product sits in reached somebody else.
The attackers chose by reach, which is why a butcher was hit
France blamed an Iranian Revolutionary Guard unit on November 9 and summoned the ambassador. Two pro-Russian groups had claimed the same attacks online five days earlier, and nobody has verified them. For a store the dispute is academic. “A teenager and an intelligence service would look much the same from the defender’s side,” SentinelOne researcher Tom Hegel told CSO.
What selected the victims was whether a panel answered. Danfoss counted at least 17 small Dutch businesses among them, and a butcher in Hove, Belgium, lost about €15,000 of meat. The second wave followed the same logic at national scale. Within three days of the first attack, 76 per cent of France’s exposed panels had been taken offline, against 25 per cent in other countries. Three weeks later, the stores hit were in those other countries.
The stock was gone, and so was the claim
Thierry Cotillard, who heads Intermarché’s parent group, put the French food loss at “tens of millions of euros” in one day, and a single hypermarket reported up to €200,000. Intermarché told AFP that its insurers do not cover an incident of this kind.
The reason sits in the wording. Spoilage cover on a commercial property policy is typically written for a power failure or a mechanical breakdown, and a malicious command sent over the internet is neither. Gallagher’s John Farley told Insurance Business that property policies often “carve out cyber-related physical damage,” while cyber policies differ on whether physical loss is included at all.
Canada has its own example of how long such claims take. Empire, the parent of Sobeys, put the cost of its November 2022 attack at about $32 million after insurance and warned that the complexity of its coverage would delay recovery. Where the Loblaw breach exposed customer records, a freezer attack destroys inventory, which is insured under a different contract.
Canada has the hardware and no count
No Canadian store has reported an incident, and none of the scans IHR reviewed breaks out a Canadian figure. The closest is a count by scanning firm Onyphe of 589 exposed Copeland Site Supervisor panels, close to 70 per cent of them in the United States and Canada combined. About 44 per cent appeared to run firmware older than the 2025 security patch. Danfoss has sold in Canada since the early 1950s.
The Canadian Centre for Cyber Security has already documented this kind of tampering at home. Its October 2025 alert describes a farm grain-drying silo where temperature and humidity settings were manipulated from outside.
The cost of a warm night is set by rules that leave little discretion. Ontario public health guidance tells operators to discard meat, fish, poultry and eggs held above 4°C for more than two hours. Natural health product labels must state storage conditions, so a refrigerated probiotic that spent hours at room temperature can no longer be sold as labelled. A store without its own temperature record cannot show which units stayed in range.
Five mistakes the record shows, and the fix for each
- Believing the cooler is offline because nobody in the store connected it. Onyphe found 88 per cent of exposed Danfoss panels on unusual port numbers, which hides them from staff and not from scanners, and 59 per cent running without encryption. Ask the contractor in writing how technicians reach the controller, and request a VPN with two-factor authentication.
- Assuming the banner’s security covers the store. ICA in Sweden had 23 stores hit, and said all of them “had their equipment connected outside ICA’s centrally managed store network.” The five Belgian Spar victims were independently owned. Have the franchise or banner agreement state who secures refrigeration.
- Planning to patch a unit that cannot be patched. France’s CERT-FR warned that a factory reset does not keep an intruder out of an unsupported controller. Stephan Moelans, whose firm runs Delhaize’s refrigeration, said some fixes need physical changes. Ask for each controller’s end-of-support date and a replacement quote.
- Trusting the controller to raise its own alarm. At a Selver store in Estonia a freezer was set to 50°C, staff caught it in about ten minutes, and the temperature rose 2 to 3°C with nothing lost. Fit a stand-alone logger with its own alert in every case that holds stock.
- Unplugging the contractor’s link without reading the policy. CERT-FR told operators to check their insurance terms first, because remote monitoring can be a condition of cover. Ask the broker which policy pays for spoilage caused by a remote command, and whether it requires that link.
Europe’s stores learned all of this at their own expense. The record they left costs a Canadian operator one email to a contractor and one to a broker.
Frequently Asked Questions
Which refrigeration controllers did authorities name?
France’s CERT-FR alert CERTFR-2026-ALE-012 listed the Danfoss AK-SM and AK-SC series and the Copeland and Dixell XWEB systems. It was widened to XWEB on October 13 after an E.Leclerc store in the Tarn department was compromised. Danfoss said most affected units were AK-SM 800 and AK-SC 355 models.
Which firmware versions close the known flaws?
For the Danfoss AK-SM 800A, version 3.3 carries the 2023 fixes, 4.2 closes a 2025 login bypass and 4.3.1 adds two further 2025 fixes. Copeland lists XWEB Pro firmware 1.13 and E3 firmware 2.31F01. On the 800A, firmware cannot be rolled back once version 5.3.x is installed.
What did CERT-FR tell stores with a tampered controller to do?
It set out six steps, in order: limit network access to service providers only, perform a factory reset, apply all available security fixes, change passwords and other secrets, check the list of user accounts, then fully reconfigure the device before returning it to service. Defrost schedules should be reviewed during the rebuild.
Was refrigeration attacked outside grocery stores?
Yes. On the night of the second wave, intruders working through a refrigeration contractor’s systems reset freezer settings at three French blood-service sites from about minus 30°C to 110°C. No blood products were lost. Reuters reported that the Pentagon is treating freezer failures at six or more U.S. military commissaries in August 2026 as a suspected attack.
This is independent editorial analysis by IHR Magazine. It quotes Secomea, a remote-access vendor, as one industry voice and names Danfoss, Copeland and Dixell because authorities and the companies themselves have. It is not an endorsement of any product or security service. Confirm equipment details with your own contractor and insurer.
