French fridge attack: Danfoss says most hit units were end of life; no source read ties it to Claroty's flaws

Fixes 436 and 566 days old, and a vendor saying most hit units were end of life

The chief executive of Coopérative U posted on X at 09:40 BST on Monday 12 October 2026 that a cyber-attack had been hitting, since the night, the refrigeration production installations of several stores in its network. Press reports name Danfoss's controllers. The tempting reading is that a known fix sat unapplied, because Claroty's Team82 published research on Danfoss's AK-SM 800A system manager in August. The dates do not say that. Claroty's two refrigeration posts are dated 9 August 2026, which is 63 days before the night of 11 October (derived; counting from the iTWire copy dated 11 August would give 61). Danfoss's own advisories are far older: 24 March 2025 for the fix to CVE-2025-41450 (release R4.2), 566 days before the night (derived), and 1 August 2025 for release R4.3.1, which fixes the other two flaws, 436 days before (derived).

Then the vendor's statement. Danfoss told franceinfo on 12 October that most of the devices concerned are obsolete products, "notably the AK-SM800 and AK-SC355 systems", that have reached end of life and no longer receive software or security updates (translated from the French franceinfo prints). Those are not the AK-SM 800A and 8xxA series named in the Danfoss advisories. So for most of the affected devices, on Danfoss's own account, the question is not an unapplied fix. It is a product with no fix to apply. For the rest of the devices, and for how any of them were reached, no source read says.

What the record does not establish, as five things nobody has said:

• The way in. No source says whether the attackers reached controllers directly over the internet, through a supplier's or contractor's remote service or account, or through the vendor's own environment. The retailers' own words point three ways.
• The product and version in each store. Danfoss says "the majority" are older models and does not say what the others are. BFMTV says versions before "version 4" without naming a product.
• Whether any published flaw was used. None is named in the French reports. The Prime Minister's office says ANSSI has identified a vulnerability in software supplied by a Danish company, without naming it.
• Who did it. No claim of responsibility, group, motive or nationality appears in any source read, up to the time stamp below.
• What was lost, and whether food safety or data was affected. The only loss figure is BFMTV's, and its own page does not reconcile it. No source publishes a logged food temperature or says whether data was taken.

Written between 14:51 and 15:21 BST on 12 October 2026, while the story is developing: every figure and statement below can change within hours. Read directly: the post on X (logged out), Claroty's two posts, Danfoss's advisories, product page and newsroom, CISA's advisory and catalogue file, NVD, the ANSSI and CERT-FR pages, and the UK pages cited. Read only as press reports: everything the retailers, Danfoss, the Prime Minister's office and the Paris prosecutor said (franceinfo, ICI of Radio France, BFMTV, Infosecurity Magazine, a retail trade blog). DataBreaches.net, which covers the same story, answered with an access block and was not read.

Who has said what, and what nobody has said

The table sets each party's statement against what it leaves out. "Not stated" means not found in what was read. It does not mean the information does not exist. Quotations from French sources are this briefing's translations and are kept short.

What each party has said about the incident, as read between 14:51 and 15:21 BST on 12 October 2026, and how each was read. Of these statements, only the X post was read at source.

Party and how it was read	Stated	Not stated
Chief executive of Coopérative U (post on X, read logged out, stamped 09:40 BST)	A cyber-attack has been hitting, since the night, the refrigeration production installations of several stores in the network. Teams are working with refrigeration specialists to restore the situation. An investigation is needed. Attacking equipment essential to keeping fresh products is "d'une extrême gravité", "inédit" and "inacceptable".	A vendor, a product, a store count, the route in, who the attackers are.
Les Mousquetaires, owner of Intermarché and Netto (as reported by franceinfo, ICI and BFMTV)	Danfoss, which manages its refrigerated cabinets, was the victim of the attack overnight from Sunday to Monday (franceinfo's account of what the group told Agence Radio France). To BFMTV: 300 stores of Intermarché and Netto affected, twice the first estimate. The group says an attack of this scale on refrigeration is unprecedented for it. Stores empty cabinets and obtain a bailiff's report.	A technical cause, product or version. Whether Danfoss's own systems or controllers in stores were reached. A loss figure (an unnamed source close to the file says several million euros nationally).
E.Leclerc (to franceinfo)	An IT attack affected one of its refrigeration equipment suppliers, with repercussions on cold equipment in several stores. Teams are working with that supplier.	The supplier's name, the number of stores, the cause.
Danfoss (to franceinfo, as quoted by franceinfo)	Incidents in France affecting a limited number of refrigeration management systems. The majority of the devices concerned are obsolete products, notably the AK-SM800 and AK-SC355, at end of life with no software or security updates. It has long recommended keeping supported systems on the latest firmware and migrating obsolete ones. It is working with customers on mitigations including firmware updates where available, network protections and removing direct internet exposure "where applicable". ICI's relay of its email to Agence Radio France says the hacked systems are old products at end of life, without the word "majority".	The route in. What the devices other than the "majority" are. A count. Whether Danfoss's own network was breached. Any notice on its newsroom (latest item 9 October) or security advisories page (latest 2026 entry about other products), read at about 14:57 BST and re-read at 15:17 BST.
The Prime Minister's office (as relayed by franceinfo, ICI and BFMTV) and ANSSI	The Prime Minister asked ANSSI to take up the matter. ANSSI "has already identified a vulnerability in software supplied by a Danish company and has contacted the publisher", is in touch with European counterparts, and is trying to identify other French companies concerned so as to alert them.	Which vulnerability or software, and whether it was exploited. Any ANSSI or CERT-FR publication: the ANSSI news page and the CERT-FR alert and notice lists, read at about 14:56 BST and re-read at 15:16 BST, carried nothing on it.
Paris prosecutor's cybercrime section (as quoted by ICI)	Took the case on its own initiative under national competence, with the Office anti-cybercriminalité leading, to identify victims and establish the link with the damage victims report: lost food and, in the prosecutor's words as ICI quotes them, outbreaks of fire.	A suspect, a hypothesis, or whether data was taken. The prosecutor's own release was not read.
BFMTV (its own reporting, via unnamed sector sources and an internal Intermarché note it says it saw)	The attack targeted Danfoss refrigeration regulation systems, specifically older versions of the control software, "before version 4". The defrost function was reportedly forced on continuously with a set point of 50 degrees. An internal Intermarché note places the attack "chez Danfoss". The page also says ANSSI has identified a vulnerability.	A product name, what "version 4" counts, who the sources are, any technical evidence.

The retailers' words point three ways. The chief executive of Coopérative U speaks of stores' installations. E.Leclerc says an attack hit one of its refrigeration equipment suppliers. Les Mousquetaires, as franceinfo reports it, says Danfoss itself was the victim. Danfoss's statement speaks of customers' systems and of removing direct internet exposure "where applicable", which describes a mitigation, not a finding. Three readings fit those words, and none is shown: controllers reached directly, one at a time or by scan; a route through a supplier's or contractor's remote service or account; or the vendor's own environment. A single route into many customers would explain why several chains were hit on one night. A single model of controller in many stores would explain it as well (both are inference).

Interests, in one line each. Danfoss sells the current-generation systems it urges customers to migrate to. Claroty sells industrial cybersecurity products and published the research. Each retailer has a reason to place the cause with a supplier. BFMTV and the trade blog read for this briefing lean partly on unnamed sector sources and on store staff.

The figures, and why they do not reconcile

The figures that travelled first are not the figures on the pages now. Infosecurity Magazine's report repeats about 150 Intermarché stores and 270,000 euros for two stores in Haguenau, both attributed to BFMTV. BFMTV's own page, read at about 14:52 BST and unchanged on a re-read at 15:16 BST, says it was published at 10:33 Paris time yet quotes the chief executive's post stamped 10:40 Paris time, so it has evidently been revised since (inference). It now gives a different store count and itemises the 270,000 euros differently.

The figures in circulation on 12 October 2026, with who reported each, and what each does not settle. Derived figures are this briefing's arithmetic.

Figure	As reported, and by whom	What it does not settle
Intermarché and Netto stores affected	About 150 (BFMTV's first estimate, repeated by Infosecurity and the trade blog). 300 (Les Mousquetaires to BFMTV, twice the first estimate, derived). Between 200 and 300 (France Inter, via franceinfo and ICI).	Which count is final, and whether it counts stores, controllers or cabinets.
Coopérative U stores affected	Fewer than a hundred (Coopérative U to BFMTV, and franceinfo).	The exact number. Together with the 300 above, fewer than 400 stores in the two groups (derived), on the groups' own counts.
Other chains	E.Leclerc confirmed several stores (to franceinfo). About 5 per cent of Monoprix stores (franceinfo). Carrefour brands and others are named by store staff in a trade blog, which says none has communicated officially.	Any official count for those chains.
Danfoss's own count	A limited number of refrigeration management systems.	The unit differs from the retailers' (systems, not stores) and "limited" is not quantified.
270,000 euros of losses	BFMTV's lead says two supermarkets in Alsace, an Intermarché and a Super U, lost 270,000 euros (Infosecurity places them in Haguenau). Its body itemises an Intermarché in Haguenau at 50,000 euros and another store, a Leclerc at Wasselonne in the same area, at 220,000 euros. 50,000 plus 220,000 is 270,000 (derived), so the pairing in the lead does not match the body.	Which two stores. An even split of 135,000 euros each would be an assumption, and the two itemised losses differ 4.4 times (derived). No store figure is multiplied here into a national loss: that would be an extrapolation, not an estimate.
Temperatures	A set point of 50 degrees (BFMTV, via sector sources). A display showing 26 degrees in an ice-cream aisle (BFMTV photo caption). More than 40 degrees (a store worker, to a trade blog). 80 degrees and melted cabinets (one store's video, via ICI).	A set point is what the controller was told. The temperature the food reached is a separate measurement, and no logged value is published.
When it began	"Around midnight" in some stores (BFMTV, unnamed source). 04:44 at one store (that store's notice, via the trade blog). The chief executive's post says only "depuis cette nuit" (since the night).	The first affected store, or whether one start time applies. The post minus midnight Paris time is about 10 hours 41 minutes; minus 04:44 it is about 5 hours 57 minutes (derived). Both assume the reported onset times are right.

Two further reports of staff accounts are unverified and are used only as questions. Store staff told the trade blog that in some stores the alert system did not ring and in others an alarm sounded around 5 o'clock; one worker said the attack "neutralised" the alert system. Intermarché told AFP, as ICI reports it, that insurance does not cover this type of in-store incident. Neither claim was checked at source.

The August research and the older fixes: what the dates show, and what they do not

Claroty's Team82 posted two refrigeration studies on 9 August 2026 (page metadata 17:59 and 18:00 UTC): one on the Danfoss AK-SM 800A, one on the Copeland XWEB Pro. Danfoss's own pages give the earlier history. The figure shows each date as days before the night of 11 October 2026. The table gives the dates and where each was read.

Dates read from primary pages on 12 October 2026. Days before 11 October 2026 are derived.

Date	Event, and where read	Days before 11 Oct
June 2023	Danfoss's Tech Insider bulletin (a French-language PDF) closes the official end of life of the AK-SM 800 range, naming the AK-SM 820, 850 and 880, says production stops, and points to the AK-SM 800A. The day is not stated.	About 40 months
21 Aug 2023	Danfoss advisory DSA-2023-08-01: three flaws in AK-SM 800A software before 3.3, one of them remote command execution rated 9.8 critical by Danfoss. Fix: 3.3.	1,147
24 Mar 2025	Danfoss advisory DSA-2025-03-01: CVE-2025-41450, an improper-authentication flaw in AK-SM 8xxA before 4.2. Fix: release R4.2. NVD published the CVE on 8 May 2025.	566
20 May 2025	CISA advisory ICSA-25-140-03 first published. Its Update A of 26 Aug 2025 added the other two CVEs. CISA says no known public exploitation had been reported to it (as of that update).	509 (first), 411 (Update A)
1 Aug 2025	Danfoss advisory DSA-2025-08-01: CVE-2025-41451 (command injection, after authentication) and CVE-2025-41452 (configuration control leading to denial of service, after authentication), AK-SM 8xxA before 4.3.1. Fix: release R4.3.1. The R4.3.1 change log is dated August 2025; the firmware's own release day is not stated. NVD published both on 22 Aug 2025.	436
26 Feb 2026	CISA advisory ICSA-26-057-10 on a different vendor's controllers, the Copeland XWEB and XWEB Pro: 23 CVEs listed.	Not used
9 Aug 2026	Claroty's two posts, Danfoss AK-SM 800A and Copeland XWEB Pro. iTWire carried Claroty's summary on 11 Aug 2026. Infosecurity says the work was presented at DEF CON 34; no primary source for that was found.	63
11 and 12 Oct 2026	The incident, as reported: the night, then the chief executive's post at 09:40 BST.	0

What the primary pages say, and where they differ. Claroty's post says Danfoss released R4.3.1 and tells owners to upgrade to it or later and to keep management interfaces off the internet. Its figure caption reads "2765 exposed devices according to Censys"; the post's text does not give the date of that scan. Danfoss's advisory describes the effect of CVE-2025-41450 as letting an attacker generate a web report that discloses internal IP addresses, usernames and store names. Claroty's post describes a path to a fully authenticated administrative session. CISA describes the three together as able to let a remote attacker bypass authentication and execute code, and says two need prior authentication. The vendor, the researcher and the agency do not describe the effect in the same terms, and this briefing does not resolve that.

Scores, attributed. For CVE-2025-41450: 8.2 (CVSS 3.1, Danfoss as the CVE authority, repeated by CISA). For CVE-2025-41451: 8.7 on CVSS 4.0 (Danfoss) and 7.6 on 3.1 (CISA's calculation). For CVE-2025-41452: 6.8 on 4.0 (Danfoss) and 5.4 on 3.1 (CISA). CISA's Known Exploited Vulnerabilities file, version 2026.10.08 with 1,739 entries and fetched again at 15:16 BST on 12 October, lists none of the three CVEs and no Danfoss entry. That is a statement about that file at that time. It says nothing about 11 October, and an addition could follow.

One more correction to a common framing. Infosecurity's paragraph says a compromised AK-SM 800A could disable cooling while falsifying temperature readings. The Danfoss post as read has no physical demonstration. The demonstration where displayed readings stayed normal while cooling was disabled is in Claroty's Copeland XWEB Pro post, in a lab with a field controller, and it lists the defrost cycle among the components an attacker could switch. That is a different vendor's product and a lab. It shows what a compromised supervisory controller can be made to do; no source says the French incident worked that way.

What would have to be shown to tie the French incident to the August research, or to any older advisory, in the order a defender would ask:

1. The product and firmware version of the units that were changed, store by store, including the ones that are not end-of-life models.
2. The route: direct internet exposure, a supplier or contractor account or service, or the vendor's environment.
3. For the two flaws that need authentication, how authentication was obtained.
4. Whether units on R4.3.1 or later were also changed. If they were, the older fixes are not the point. If none were, that is evidence about the fix, not proof of the flaw.
5. A statement from ANSSI, Danfoss or the investigators, not from the retailers. None has been published as of the time stamp.

One boundary fits the label without proving anything. BFMTV's "before version 4" is the same line at which Danfoss's AK-SM 800A page says its stronger defaults begin: software package 4.0 and above sets a strict session mode that requires encrypted sessions, with a weaker "backward compatible" mode still selectable. The label is consistent with those records. It does not show that any of them was used, and BFMTV does not name a product.

Six friendly names, and the control question each one hides

Each phrase below was used in the reports. Each sounds like a technical detail. Each is a question about who can reach a controller, who patches it and who notices.

Labels used in the reports on 12 October 2026, and the question each hides. The right-hand column is this briefing's reading, not a source's wording.

Label, and where it appears	What it sounds like	The question it hides
"Refrigeration production installations" (Coopérative U's chief executive)	Pipes, compressors, plant.	A networked computer that can set temperatures and defrost schedules. Who can reach it, from where, with whose credentials?
"Administered by" or "which manages its refrigerated cabinets" Danfoss (Infosecurity, Les Mousquetaires)	The vendor is on watch.	Does the vendor, a contractor or the retailer hold the remote path and the accounts? Is that written in the contract, and is the route direct, through a vendor cloud, or through a contractor's access?
"Outdated software" or older versions "before version 4" (BFMTV)	A patch exists and was missed.	Two different controls hide here. A supported product on old firmware needs an upgrade. An end-of-life product has no update, so it needs replacing or isolating. Danfoss says most hit units are the second kind.
"End of life" (Danfoss)	The vendor's duty has ended.	The unit was still running in a store, possibly reachable. Who owned the decision to replace it, and who watched its exposure?
"Remote monitoring" and "alarm"	A safety net.	An alert that comes from the same controller, or through the same network path, can fail with it. Is there a sensor and a path that does not trust the controller?
"Defrost" (BFMTV)	A routine maintenance cycle.	The same function with a different duration and set point is a heater. Who can change it remotely, and is there an independent limit the network cannot override?

The UK: what the published rules say, and where they stop

Nothing in the French reports says a UK site was hit, and no UK retailer is named in anything read. This section reads what UK bodies have published, so a UK operator can see which rule would apply if the same thing happened here.

UK guidance and law as read on 12 October 2026, with where each stops. Quotations are short and exact; the "where it stops" column is this briefing's reading.

UK source	What it says	Where it stops
NPSA, Critical National Infrastructure page (updated 21 September 2026)	There are 13 CNI sectors, and food is one. For food it says: "the food sector has no individual assets which are designated at CNI", resilient through global sourcing, alternative supply chains and commercial competition.	Food is a CNI sector by name, with no designated assets, on the agency's own page. It says nothing about refrigeration controllers or a cyber-attack on retail, and this briefing infers no duty from it.
NCSC alert, 27 August 2026 (page modified 7 September 2026)	Increased targeting of operational technology "across multiple sectors globally, including in the UK", with some limited real-world disruption. Organisations "should not assume that their OT is inaccessible from the internet without verifying it". Eight actions follow.	The page does not mention refrigeration, food, buildings, suppliers or contractors. It is advice, not a legal duty.
Cyber Security and Resilience Bill (GOV.UK summary; Parliament stages page)	The regime covers energy, transport, health, drinking water, digital infrastructure and some digital services. The Bill adds data centres, managed service providers, large load controllers and designated critical suppliers, lets government add sectors by secondary legislation, and sets 24 hour and 72 hour incident reports. Lords report stage is listed for 26 October 2026, provisional.	Food is not named. Nothing read says a retailer or its refrigeration contractor is in scope. The Bill is not law.
Cyber Essentials, Requirements for IT Infrastructure v3.3 (April 2026)	Updates fixing vulnerabilities rated critical or high (CVSS v3 of 7 or above) must be applied within 14 days of release. Unsupported software must be removed, or kept in a defined sub-set that prevents all traffic to or from the internet. Accounts your organisation owns are in scope even when a supplier or contractor uses them to manage your infrastructure.	The document has no wording on operational technology, controllers or refrigeration. Scope is the boundary the applicant agrees with its certification body. It is a scheme, not a legal duty.
FSA content on GOV.UK, food hygiene for businesses; FSA guidance of May 2016; Food Standards Scotland	Chilled food must be at 8°C or below: a legal requirement in England, Wales and Northern Ireland, recommended in Scotland. Set a fridge to 5°C or below. Chilled food can be out of the fridge for up to 4 hours, then must be thrown away. The 2016 guidance says the requirement is for the temperature of the food, "not the surrounding air". Food Standards Scotland tells households to keep a fridge between 0°C and 5°C and a freezer around minus 18°C.	Written for ordinary running, not a remote attack. No FSA business page on refrigeration failure was found, and the FSA's household power-cut page was not used. The 2016 document is old (review date June 2018).
Danfoss's AK-SM 800A product page (Danfoss's own wording)	The page says the product "is not subject to the UK PSTI regulation", because it is for supply to and use only by professionals.	That is the vendor's statement, not a legal reading. It means the UK's connectable-product security regime gives a retailer no lever here.

Two sums for context (derived). A set point of 50 degrees is 42 degrees above the 8°C legal maximum for chilled food in England, Wales and Northern Ireland and 45 above the 5°C recommended fridge setting, and 68 above a freezer at minus 18°C. A set point is not a food temperature, and the law the FSA describes is about the food. The four-hour figure is the FSA's rule for chilled food held outside a fridge, not a rule written for a remote attack, and no source says how long the French stores' food was above any limit.

On Cyber Essentials, a plain reading matters. If a controller sits inside the scope an applicant has defined and accepts connections from the internet, the 14 day clock applies to a fix rated 7 or above, and CISA's calculation gave CVE-2025-41451 a CVSS 3.1 score of 7.6. From 1 August 2025 that clock would have run out on 15 August 2025 (derived, if the firmware was released that day, which is not stated). For an end-of-life product the document's own rule is that unsupported software is removed or isolated from the internet. A controller managed remotely over the internet cannot meet the second option (inference). Whether an assessor treats a refrigeration controller as in scope is not answered by the document.

The NCSC's eight actions, translated into the refrigeration question. The first column is shortened from the alert; the second is this briefing's translation, not NCSC wording.

The eight actions in the NCSC alert of 27 August 2026, shortened, with the refrigeration question each raises. Read in full on 12 October 2026.

NCSC action (shortened)	The refrigeration and building-controller question
1. Build a definitive view of OT assets; keep them off the public internet	Is every refrigeration and building controller on a list, with product, version and route, and is any reachable from the internet?
2. Replace default credentials; unique accounts; multi-factor authentication where supported	Who holds the controller and remote-service accounts, and are any shared with a contractor's staff?
3. Control access to OT; keep boundary devices supported and updated	Is the gateway or modem a contractor installed within vendor support, and who updates it?
4. Adopt secure industrial and management protocols	Does the controller's management interface use encrypted sessions, and is a weaker compatibility mode left on?
5. Log and monitor all connectivity to and within OT	Would anyone see a new remote session at midnight?
6. Keep devices in a state that prevents remote programming in normal operation	Can a remote session change set points and defrost schedules at any hour, or only in a maintenance window?
7. Separate OT, management and business networks	Is refrigeration control kept apart from tills, guest Wi-Fi and head-office IT?
8. Maintain tested backups; be able to isolate and restore	Can a store's controllers be cut off from the network and run locally, and has anyone tried?

The NCSC alert asks all organisations to register for its free Early Warning service. For the patch-age pattern, this site's briefing on a Palo Alto flaw 149 days after its advisory sets out the usual story, which here is complicated by Danfoss's statement that most hit units have no patch. For the point that a count of exposed systems is a floor, see its briefing on 8,547 wind and solar systems reachable online. For the same alert applied to machine-speed attacks on operational technology, see its briefing on a vendor lab test of AI models against an OT plant.

Questions to put to a refrigeration contractor and a controller supplier

Written questions, with the answer each must name. They are this briefing's, drawn from what the sources leave open, and they ask for facts about your own estate, not for anyone's secrets.

Questions for a UK retailer or food manufacturer to put to its refrigeration contractor and controller supplier, with what a usable answer must name.

Question	A usable answer names
How can anyone reach each controller from outside the site?	Every route, per site: direct internet address, supplier cloud, contractor remote access, mobile modem. "None" with the evidence.
Which product and firmware version is on each site, and is any product end of life?	A list by site, the vendor's support end date for each product, and the replacement date for any that is unsupported.
Who applies firmware updates, and how soon after release?	A named party, a time limit, and how security notices reach you. Whether an upgrade changes defaults and needs a site visit.
Who holds the administrator and remote accounts?	Named, unique accounts, with multi-factor authentication, logging, and time limits on supplier access. No shared contractor login.
Can a remote user set a defrost or set point outside a safe range?	Whether a local, independent high-temperature safeguard exists that the network cannot override, and when it was last tested.
What raises an alarm that does not depend on the controller?	Independent temperature sensors and loggers, the alert path, who is called, and how fast.
What is the fallback if the controller is not trusted?	Manual temperature checks and logs, whose job it is at night, where stock can go, and who decides what to discard.
What does the contract say about a supplier incident?	How fast you are told, who investigates, who pays, and whether insurance covers it. Intermarché told AFP its insurance does not cover this type of in-store incident (as ICI reports it).

What to do, in the order worth doing

Every item is a control the NCSC, CISA or Danfoss's own pages already name, and none depends on knowing how the French attackers got in. Defender level only: this lists what to find and harden, not how anything is broken.

An unconfirmed parallel, and one that is not

In late August 2026, Stars and Stripes reported that at least six US military grocery stores (commissaries) confirmed refrigeration outages within days of each other, with food thrown away, and that some freezers had gone into defrost mode. A defense official acknowledged only a "possible refrigeration disruption". On 1 September the paper reported that three military criminal investigation agencies were investigating, and that officials did not answer questions about unauthorised access. A report on 30 September said up to a dozen stores may have been affected, and investigators were still looking. No cause is published in the pages read, and none names Danfoss. Counts such as 14 stores come from other outlets and from tracking sites and are not repeated. It is an unconfirmed parallel in timing and in the defrost detail, nothing more.

A separate incident is not a parallel. Hackread, citing Dutch public broadcaster NOS, reports that Albert Heijn, Etos and Gall and Gall had websites, deliveries, loyalty systems and shelf labels disrupted from Sunday afternoon, in what Ahold Delhaize calls a cybersecurity incident, with some effect in Belgium. Hackread says no public evidence links it to the French refrigeration attack, and this briefing does not treat them as one.

What could not be verified, and what was checked and set aside

• Everything the retailers, Danfoss, the Prime Minister's office and the prosecutor said is read through press reports, mostly franceinfo, ICI and BFMTV. Only the chief executive's post was read at source. Danfoss's statement is quoted by franceinfo; it was not on Danfoss's own newsroom or security pages at 14:57 or 15:17 BST.
• ANSSI's reported finding (a vulnerability in software from a Danish company) comes from the Prime Minister's office. ANSSI's own news page and CERT-FR's alert and notice lists carried nothing on it at 14:56 or 15:16 BST.
• BFMTV's page appears to have been revised after its stamped 10:33 Paris time (inference from the later time of the post it quotes). Figures here follow the page as read at about 14:52 BST and 15:16 BST.
• Store-level claims (alerts that did not ring, 80 degrees, melted cabinets) rest on staff or one store's video, relayed by a trade blog or ICI. The prosecutor's reference to fires is as ICI quotes it.
• Claroty's DEF CON 34 presentation is stated by Infosecurity Magazine only. A separate secondary site claims Danfoss documented real attacks on its older controllers in Russia and Israel in 2022; no such text was found on the Danfoss pages read, so it is not used.
• The date of the Censys scan behind "2765 exposed devices" is not stated in Claroty's text.
• Set aside after checking: a Cooling Post report of a cyber-attack on Beijer Ref's French business is dated 20 October 2020 and concerns the wholesaler's own computers, so it has no bearing here. The Dutch retail incident and the US commissary outages are not shown to be related.
• Time-stamped. Read between 14:51 and 15:21 BST on 12 October 2026. A new count, a claim of responsibility, an ANSSI notice, a KEV entry or a Danfoss notice could appear within hours.

The question that exposes the gap

If someone changed a freezer controller in one of your sites to heat at midnight tonight, what would tell a person first, does that alert depend on the controller that is heating, and who is allowed to cut the controller off the network without asking?

Key facts