France's Supermarket Fridges Were Vulnerable Online for Months

On the night of October 11-12, 2026, attackers forced refrigeration systems in hundreds of French supermarkets into defrost mode, raising temperatures, causing some equipment to catch fire and forcing stores to discard fresh and frozen food. Internet scans from the week before the attack found 2,528 Danfoss StoreView dashboards exposed on IPv4, 1,331 of them in France - more than the other 72 countries combined. Eighty-five percent of those French dashboards (about 1,136) ran firmware with known flaws, including 527 legacy controllers Danfoss no longer supports (AK‑SM 800 and AK‑SC 355). The same exposed devices appeared in scans as far back as March 30, and only a small share had been fully updated by October. After the incident many operators disconnected controllers: only 316 of the 1,331 French dashboards were still reachable two days later, a 76% drop.

The exposed interfaces include an older Flash-based web UI and newer AK‑SM 800A units missing 2023 and 2025 security fixes; Synacktiv and Claroty have previously published login-bypass issues. CERT‑FR also flagged XWEB supervisors from Dixell/Copeland. Technical recommendations are to remove controllers from the public Internet, require secure VPN access for contractors, update firmware, set security to Strict and change default passwords; simple factory resets or IP whitelists are insufficient. Scans cannot determine how intruders gained access or which specific stores were compromised, and the published counts cover IPv4 and the ports scanned, so they are minimum estimates.