TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
IPinfo’s weekly scans found 1,331 internet-accessible Danfoss refrigeration dashboards in France before attacks on supermarket cooling systems on October 11–12, 2026. The company’s analysis says 85% of those dashboards ran software with known security flaws, but it does not establish that the exposed dashboards were used in the attacks or identify who was responsible.
Internet scans by IPinfo found that 1,331 Danfoss refrigeration dashboards in France were accessible online before cyberattacks disrupted supermarket cooling systems on October 11–12, 2026. IPinfo says 85% of the French dashboards it identified ran software with known security flaws; the findings show prolonged exposure, but do not establish that attackers entered through those dashboards or explain who carried out the attacks.
According to IPinfo, its scan on October 6–7, five days before the reported attacks, detected 2,528 internet-visible Danfoss StoreView dashboards worldwide. France accounted for 1,331, more than the other 72 countries and territories combined, which had 1,197. Poland had the next-highest count, at 179, followed by the United States with 101.
IPinfo says 1,136 of the French dashboards ran software with known security flaws. That included 527 older controllers no longer supported by Danfoss, 280 systems missing fixes issued in 2023, and 329 missing fixes issued in 2025. The company identified 195 French dashboards as having every known fix. The figures describe the systems visible to IPinfo’s scans, not a confirmed count of compromised devices.
The attacks affected supermarkets across France. Futura-Sciences reported that more than 400 stores were hit. Carrefour said 80 stores were affected; Intermarché and Netto, both part of Les Mousquetaires, reported more than 300 between them. Monoprix said about 5% of its stores were affected, while Coopérative U chief executive Dominique Schelcher told RTL that 80 of the group’s 2,000 stores were hit. Leclerc and Coopérative U also confirmed attacks, according to the source report. The Paris prosecutor’s office opened an investigation.
Why Open Cooling Controls Matter
Supermarket refrigeration is operational equipment, but connected monitoring and control systems can also create a path for remote access. In this incident, the Paris prosecutor said some cooling units were pushed into defrost mode, which heats components to melt ice. Some reportedly reached 50°C (122°F); the prosecutor also said some equipment began to catch fire. Stores discarded fresh and frozen food as a result of the disruption.
The scale of the online exposure matters because the dashboards were intended for stores and technicians to monitor and manage refrigeration equipment. IPinfo describes the scanned pages as reachable by anyone who knew the address. A dashboard being reachable does not, by itself, prove that it was unprotected by authentication or that it was the route used in an attack. Still, the combination of persistent internet access and known software flaws points to a security problem that can affect physical operations, food stock and business costs.
The findings also suggest the issue was not confined to France. IPinfo found that 84% of dashboards outside France also had known flaws. France stood out because it had many more such systems online, not because its scanned systems were markedly less up to date. The report says potential losses could reach several million euros, but that figure is an estimate, not a confirmed total.
Danfoss refrigeration dashboard security kit
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How the Exposure Was Measured
IPinfo says it scans the public IPv4 internet weekly, checking common website ports and recording the systems that respond. Its figures count visible Danfoss StoreView dashboards at particular times. They do not measure every refrigeration controller in use, establish whether each dashboard was exploited, or identify the operator responsible for making it reachable.
The scans found broadly similar totals from late March through the period before the attacks. IPinfo says 1,019 French dashboards were at the same internet addresses on March 30 as in its later observations. The share of French dashboards with all known fixes rose from 14% to 24% during that period. The report says most had been exposed for at least six months.
Danfoss said most affected equipment was “legacy” and named the AK-SM 800 and AK-SC 355 controllers. The source report says Danfoss ended support for the AK-SM 800 in 2023. It also describes separate vulnerabilities and fixes affecting newer AK-SM 800A software. France’s cybersecurity agency, CERT-FR, reported numerous compromises involving AK-SM and AK-SC controllers and later added Copeland XWEB supervisors and systems from its Dixell brand to its alert.
““legacy””
— Danfoss
supermarket refrigeration monitoring system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Attack Route and Responsibility Unknown
No public account identifies who carried out the attacks or how the attackers gained access. IPinfo’s data documents internet-visible dashboards and software flaws, but does not connect a specific dashboard to a specific supermarket incident. It is not confirmed that attackers exploited the vulnerabilities IPinfo identified.
The number of affected stores remains based on statements from retailers and media reports, and the financial losses have not been established. IPinfo said most of the dashboards it had been tracking went offline after the attacks, but 316 of the 1,331 French dashboards were still online on October 14. The source material does not specify which organizations operated those remaining systems or whether they were connected to affected stores.
industrial refrigeration control panel
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Investigation and Operator Response
The Paris prosecutor’s investigation is expected to examine the attacks and how the refrigeration systems were accessed; the source material provides no public findings or timetable. CERT-FR advised operators to disconnect affected controllers or restrict who can reach them. Its guidance also tells operators to check insurance terms before cutting data connections used by refrigeration contractors, a consideration that may complicate rapid disconnection.
Retailers and refrigeration contractors will need to determine which systems were affected, what access controls are in place and whether software updates or replacement equipment are required. Danfoss, store operators and suppliers have not publicly set out a full remediation plan in the material provided. IPinfo’s next observations may show whether the remaining dashboards have been taken offline or secured, but that would not by itself establish whether the attack route has been closed.
As an affiliate, we earn on qualifying purchases.
Key Questions
What happened to French supermarket refrigeration systems?
During the night of October 11–12, 2026, attackers reportedly put refrigeration systems at supermarkets into defrost mode. The Paris prosecutor said some units reached 50°C (122°F) and some equipment began to catch fire; stores discarded fresh and frozen food.
How many online dashboards did IPinfo find in France?
IPinfo identified 1,331 Danfoss StoreView dashboards in France in its October 6–7 scan. Its scan found 2,528 worldwide, with 1,197 in the other 72 countries and territories combined.
Were all the exposed dashboards hacked?
No. IPinfo counted dashboards reachable from the public internet and assessed their software versions. Its report does not show that every exposed dashboard was compromised, or confirm that those dashboards were used in the supermarket attacks.
Who carried out the attacks?
The responsible party has not been identified in the source material. The Paris prosecutor’s office opened an investigation, and no public explanation of the attackers’ method is provided there.
What has the French cybersecurity agency advised?
CERT-FR advised operators to disconnect affected controllers or restrict access to them. Its alert also covered certain Copeland XWEB and Dixell monitoring systems and said attack campaigns were probably still ongoing.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
