French supermarket cyberattack technical report

Blog

From Initial Access to Physical Damage: Mapping the French Supermarket Cyberattack to MITRE ATT&CK for ICS

Dr. Rishabh Das

Critical Infrastructure Cybersecurity researcher at Assistant Professor, Ohio University || Web

Dr. Rishabh Das is an Assistant Professor at the Scripps College of Communication, Ohio University. Dr. Das has over a decade of hands-on experience in operating, troubleshooting, and supervising control systems in the oil and gas industry. Dr Das's research portfolio includes virtualization of Industrial Control Systems (ICS), threat modeling, penetration testing in ICS, active network monitoring, and the application of Machine Learning (ML) in cybersecurity.

[TECHNICAL REPORT – French Supermarket Cyberattack]

On the morning of October 12, 2026, hundreds of supermarkets across France discovered that their refrigeration systems had been compromised. Attackers had remotely accessed refrigeration controllers and forced them into extended defrost cycles. Temperatures in some units reached approximately 50 °C, causing food spoilage, equipment damage, and, in some locations, reported fires. Early reports estimated 250–350 affected stores. A later ministerial estimate put the total at about 700. Intermarché’s chief executive estimated nationwide losses in the tens of millions of euros [1][9][10][41].

The French supermarket cyberattack demonstrates how cybersecurity weaknesses in operational technology (OT) can lead to physical damage. According to public reports, attackers manipulated legitimate refrigeration functions, with no confirmed evidence of malware deployment. France’s national cybersecurity agency, ANSSI, identified internet-exposed management interfaces and weak authentication as the primary security weaknesses. Although researchers had previously disclosed vulnerabilities in some of the affected controller families, ANSSI’s director general rejected claims that attackers exploited those vulnerabilities during the incident [12][26][37].

This article examines how the attackers gained access to the refrigeration systems, manipulated operational parameters, and disrupted physical processes. It maps the reported activities to the MITRE ATT&CK for ICS framework, identifies the security weaknesses that contributed to the incident, and discusses practical measures to prevent similar attacks on industrial control systems.

How supermarket refrigeration is controlled

A supermarket’s refrigeration system is a small industrial control system. Each display case and cold room typically has its own controller, which regulates temperature by switching refrigerant flow, evaporator fans, and defrost. A store-level system manager, such as a Danfoss AK-SM 800A or a Copeland or Dixell XWEB supervisor, coordinates these controllers. It schedules defrost cycles, logs temperatures, raises alarms, and provides a web interface that refrigeration contractors use for remote maintenance.

Defrost is a routine function. Frost builds up on the evaporator coils, so the controller periodically stops cooling and melts the ice, in many systems with electric heaters. The cycle normally ends after a set time or once the coil reaches a set temperature. Because case temperatures are expected to rise during defrost, temperature alarms are commonly delayed until the cycle ends. A defrost that is forced, or extended from one hour to eight as Le Monde reported, therefore warms the case by design and can postpone the alarm that would normally bring staff to it [39].

These systems are often installed and maintained by refrigeration contractors rather than by the store’s IT or OT team. As a result, they can sit outside both IT and OT asset inventories, while remote access is configured for the contractor’s convenience. Forescout’s analysis of the incident reflects this: it recommends removing shared or stale contractor credentials and checking contractor-managed sites for shared exposure [36].

French supermarket cyberattack incident timeline

Security researchers had identified vulnerabilities in refrigeration controllers months before the attack. Between May 2025 and February 2026, CISA published advisories covering vulnerabilities in Danfoss AK-SM 8xxA and Copeland XWEB systems [42][43]. On August 9, 2026, Claroty’s Team82 published additional research on Danfoss controllers and reported finding 2,765 internet-accessible AK-SM 800A systems. However, this figure represents exposed systems, not necessarily systems vulnerable to the disclosed flaws [37].

The attack occurred overnight on October 11–12, 2026, with French outlets initially estimating 250–350 affected supermarkets [5]. On October 12, CERT-FR issued a security alert, and the Paris prosecutor opened an investigation [3][9][10]. By October 13, Finance Minister Roland Lescure estimated that about 700 stores had been affected. CERT-FR also expanded its alert to include Copeland and Dixell XWEB controllers [12][33][41]; reporting described a subsequent wave affecting Dixell equipment on October 12–13 [40].

Early reporting raised the possibility of a Danfoss software vulnerability [9][31]. However, on October 21, ANSSI Director General Vincent Strubel attributed the intrusion to weak passwords and refrigeration controllers exposed directly to the internet, and disputed claims that previously disclosed software vulnerabilities caused the incidents [26].

In an October 22 study, Forescout reported 12,976 internet-exposed service observations across 10 product groups and 99 countries or territories, spanning 6,017 distinct public IP addresses. These figures represent observed services, not necessarily unique physical controllers [36].

Attribution: No group has claimed responsibility [15][16]. Forescout documented more than 20 claimed attacks on refrigeration systems in 2026, some associated with Z-Pentest Alliance and NoName057(16). It did not link either group to the French incident [36]. The attackers’ identities and motivations remain unknown.

MITRE ATT&CK for ICS mapping

We mapped the publicly reported activity to MITRE ATT&CK for ICS. ANSSI confirmed internet exposure and weak passwords, while news reports described changes to temperature and defrost settings. The exact discovery method, login mechanism, and commands used have not been publicly established. The table distinguishes reported observations from inferred or disputed techniques [12][26][35][39][40].

The reported sequence is short. Once logged in, the attackers used the controllers’ own settings to extend defrost cycles and raise temperature setpoints. The cases warmed during what the controllers treated as defrost, alarms were reportedly delayed, and physical damage followed.

Step	Tactic	Technique	What happened in this incident	Key sources	Confidence
1	Reconnaissance (Enterprise)	T1595 Active Scanning	Public scans found exposed interfaces; no evidence identifies the attackers’ discovery method.	[4][5][36]	Inferred: attackers’ method unknown
2a	Initial Access	T0883 Internet Accessible Device	Management interfaces reachable directly from the internet	[12][26][30]	Confirmed (ANSSI)
2b	Initial Access	T0822 External Remote Services	Remote-maintenance infrastructure was present	[12][16]	Inferred: ANSSI describes direct exposure
2c	Initial Access	T0819 Exploit Public-Facing Application	Previously disclosed Danfoss CVEs exist; no evidence shows these flaws were exploited in this incident.	[26][37]	Disputed: ANSSI rejects exploitation
3	Persistence / Lateral Movement	T0859 Valid Accounts; T1694.001 Default Credentials (unconfirmed)	ANSSI reported weak passwords. Exact credentials and whether defaults were used remain unconfirmed.	[26][35]	Confirmed (weak passwords); Inferred (defaults)
4	Execution	T0823 Graphical User Interface	Controllers support web interfaces, but the attackers’ specific interaction method is unknown.	[10][15]	Inferred: interaction method unknown
5a	Impair Process Control	T1692.001 Command Message (inferred)	Forced defrost was reported; whether attackers sent distinct unauthorized protocol messages is unknown.	[1][5][31]	Inferred: effect reported; message type unknown
5b	Impair Process Control	T0836 Modify Parameter	Temperatures reached 50 °C at some stores, while Le Monde reported that defrost durations were extended from 1 to 8 hours. At one site using Dixell equipment, attackers changed a freezer setpoint from −22 °C to 150 °C and modified 2–3 settings per second.	[1][39][40]	Reported
6	Inhibit Response Function	T0878 Alarm Suppression	Longer defrost periods reportedly delayed alarms. There is no public proof of separate alarm-configuration changes.	[11][39]	Inferred: alarm delay reported by Le Monde
7a	Impact	T0831 Manipulation of Control; T0827 Loss of Control (possible)	Cases heated against operator intent. Staff had to reprogram units by hand	[1][3][11]	Reported (manipulation); Inferred (loss of control)
7b	Impact	T0879 Damage to Property; T0880 Loss of Safety	Fires and equipment damage reported; potentially unsafe food withdrawn before sale. We extend Loss of Safety to this food-safety consequence; MITRE frames the technique around safety-system functions.	[7][10][31]	Reported (damage); Inferred (safety)
7c	Impact	T0826 Loss of Availability; T0828 Loss of Productivity and Revenue	Equipment unavailable and stock discarded; industry-wide losses estimated in the tens of millions of euros.	[7][9][29]	Reported

Confidence key: Confirmed means stated by ANSSI or CERT-FR; Reported means described by credible press or vendor sources; Inferred means our analytical mapping; Disputed means contradicted by an authority. MITRE files Valid Accounts and Default Credentials under the Persistence and Lateral Movement tactics; here the evidence points to their use at initial login. T1694.001 and T1692.001 are current ATT&CK v20 identifiers [35].

What the mapping shows

The attack chain shows how unauthorized changes to defrost cycles and temperature setpoints can disrupt physical processes. It also exposes a critical security gap: the reported settings suggest that the refrigeration controllers lacked effective safeguards to prevent unsafe operating parameters, while alarm mechanisms could be affected by the same control changes. The incident illustrates the difference between compromising a controller and compromising the physical process. In this incident, the first led to the second through settings that no refrigeration process can tolerate, such as a freezer setpoint of 150 °C or an eight-hour defrost.

Takeaways and defensive measures

ANSSI identified basic security weaknesses as the primary cause of the intrusion. During his Senate testimony, ANSSI Director General Vincent Strubel cited internet-exposed equipment, unsecured administrative interfaces, and weak passwords as key factors [26]. We group the measures below by when an operator can act on them. Isolation should come before cleanup, and any change that touches safety limits needs engineering validation before it is made.

Measure	What to do	MITRE ICS mitigation	Mitigates	Sources
*Now (days)*
Remove internet exposure	Disconnect or filter every controller with a public IP. Restore access only through a VPN or protected network. Treat IP allowlisting as temporary only.	M0930 Network Segmentation; M0937 Filter Network Traffic	T0883, T0819	[12][30][33]
Fix credentials	Change every default and shared password. Set Danfoss units to the “Strict” security level.	M0927 Password Policies	T1694.001, T0859	[12][22][25]
Clean up compromised units	Once internet access is cut, capture configuration, logs and defrost schedules first as evidence. Then factory reset, apply all fixes, change secrets, check accounts and fully reconfigure. A reset alone is not enough.	M0953 Data Backup; M0947 Audit	T0859, T1694.001	[12][3]
*Next (weeks to months)*
Secure contractor access	One managed remote-access gateway with MFA and session logging, named accounts per technician, no shared logins, no direct 4G or port-forward paths.	M0932 Multi-factor Authentication; M0918 User Account Management; M0801 Access Management	T0822, T0859	[36][16]
Patch	Update AK-SM 800A to R4.3.1 or later.	M0951 Update Software	T0819	[42][38]
Baseline and monitor settings	Record known-good setpoints, alarm limits and defrost schedules; alert on any change.	M0947 Audit	T0836, T0838	[36][25]
Independent alarms	Use independent temperature monitoring and alerts over a separate channel, tested against plausible loss-of-cooling conditions.	M0810 Out-of-Band Communications Channel	T0878	[22][25]
*Longer term (budget and lifecycle)*
Replace end-of-life units	Replace AK-SM 800 / AK-SC 355 units that can no longer be patched.	M0951 Update Software	T0819	[28][41]
Hard safety limits (our recommendation)	Reject impossible setpoints and cap defrost duration, using limits that cannot be changed remotely; where the firmware lacks them, ask the vendor. Fit a mechanical high-temperature cut-out on cases after engineering review.	M0818 Validate Program Inputs; M0805 Mechanical Protection Layers	T0836, T0879; also T1692.001	inferred from [22][25]
Inventory and lifecycle	Add facility controllers to the OT asset inventory with an end-of-life register; treat end of life as a trigger to isolate or replace.	Governance	Cross-cutting	[13][16][24][25]
Contracts and insurance	Put security and lifecycle duties in maintenance contracts. Check insurance terms before cutting a contractor’s data feed.	Governance	Cross-cutting	[12][23]

Conclusion

The French supermarket cyberattack demonstrates how weaknesses in operational technology can cause physical damage without sophisticated malware. Attackers reportedly used legitimate refrigeration controls to disrupt operations, destroy inventory, and damage equipment. Preventing similar incidents requires restricting internet access, securing remote maintenance connections, replacing unsupported controllers, and monitoring critical operating parameters. Independent temperature alarms and safety limits can also reduce damage when a controller is compromised. The incident highlights why refrigeration systems and other building automation technologies must be included in an organization’s OT cybersecurity strategy.