Hackers forced refrigeration equipment at French supermarkets into defrost, and stores discarded affected food. The Danfoss cyberattack discussion concerns refrigeration controllers: France's official alert also names Copeland and Dixell equipment. A normal maintenance function became a way to disrupt cooling. Understanding that function explains the physical damage and why restoring clean settings can leave recovery unfinished. This edition follows the information reviewed for October 13, 2026.
TL;DR
- French retailers confirmed refrigeration disruption. Reuters reports discarded food and forced, prolonged heating at affected stores.
- Defrost normally removes ice from cooling parts so refrigeration can work properly. Keeping it running puts food at risk.
- CERT-FR names several controller families, including Danfoss, Copeland and Dixell. Its alert establishes neither the attackers' identity nor an exact entry route.
- Recovery advice includes removing public exposure, checking configuration and restoring protected access with the refrigeration provider.
- For exposed, unsupported equipment without security patches, a factory reset alone can remove attacker changes while leaving the device vulnerable.
What defrost does inside a supermarket
A supermarket refrigeration system keeps chilled and frozen food cold. Its cooling parts can accumulate ice, which gets in the way of airflow and reduces cooling. Defrost is the maintenance cycle that removes that ice. After a normal cycle, cooling resumes.
Danfoss's explanation of adaptive defrost describes that tradeoff. Too many cycles, or cycles that run too long, can harm food quality. The article is historical manufacturer background about the refrigeration mechanism. It adds no extra controller model to the current incident's affected list.
That relationship makes the attack understandable without a fictional exploit demonstration. The controller can change what the refrigeration equipment does. Holding a maintenance function on for too long changes the conditions the store relies on to keep food safe.
An ordinary feature already has the necessary physical effect. Access to its controls therefore carries consequences beyond a dashboard. The equipment is attached to stock that somebody must inspect, discard and replace when the cold chain is disrupted.
How remote maintenance becomes a control boundary
Reuters' report, republished by ABC, describes refrigeration control panels and remote maintenance adjustments. Maintenance companies can use those controls to manage equipment without sending a technician to every shop for every change.
The conceptual relationship is straightforward: a remote panel changes controller settings, and those settings affect physical refrigeration. Somebody taking over that panel can misuse a legitimate adjustment. The episode's diagram shows that relationship. It does not reconstruct the attacker's entry path.
France's official alert does not identify a particular password, vulnerability or exploit chain that explains every affected installation. Manufacturer statements about old firmware and reporting about earlier security research are relevant context. They establish no proof that a particular previously disclosed weakness caused this incident.
For a developer working on connected equipment, the useful question is who can reach the management function and what authority they get there. The refrigeration contractor needs controlled access; the retailer needs confidence that its cooling configuration remains under that control. Convenience depends on the boundary continuing to hold.
What French retailers actually reported
Coopérative U's chief, Dominique Schelcher, confirmed on October 12 that a cyberattack had affected cold-production facilities at several stores since the previous night. He described teams working with refrigeration specialists to restore service. That is a retailer's confirmation of refrigeration disruption.
Reuters reports a more specific account from Les Mousquetaires, Intermarché's owner. The company said fridges at about 150 stores were heated to 50 Celsius. It said the heating continued overnight for six hours. Those are company-reported figures, and the selected sources supply no cabinet-by-cabinet temperature record or measurement of every item's core temperature.
An Intermarché spokesperson said staff discarded affected food to eliminate health risks. A witness in Paris described carts of thawed food and melted ice cream spilling onto the street. The incident-response work included the pavement. A monitoring dashboard rarely has a field for that.
Store counts and loss estimates vary between reports. Counting affected stores also cannot establish that every store lost all its food. The reviewed reporting gives no settled industry-wide damage total. Keeping that limit visible prevents an early estimate from becoming a final invoice through repetition.
The affected list includes more than Danfoss
CERT-FR's October 13 revision lists these equipment families:
- Copeland xweb.
- Danfoss AK-SC and AK-SM series.
- Dixell xweb.
The alert's revision history records the addition of other targeted equipment. That makes the current list important when sharing a story initially framed around one manufacturer. Operators need to identify their actual installed controller and its support position, then work from the applicable manufacturer guidance.
The scope is equally important geographically. Dutch retailer Ahold Delhaize reported a separate disruption, and Reuters quotes its statement that there was no reason to link that incident to its French counterparts. The selected evidence supports the French refrigeration attack. It supplies no established single campaign behind every retail incident reported across Europe.
Why a factory reset can leave recovery unfinished
CERT-FR warns against exposing management interfaces directly to the public internet. Its recovery advice includes removing that exposure, checking configuration and restoring access through a secure VPN or protected network. The configuration check specifically includes defrost windows.
For compromised equipment, the alert describes resetting and reconfiguring the device as part of the response. The condition around its strongest warning matters: it discusses an internet-exposed, end-of-life device for which no security patch is available.
In that situation, a factory reset can remove the changes or persistence left by a compromise. It does not repair the vulnerable device or the exposed access arrangement. Restoring the same vulnerable conditions leaves the opportunity for another compromise.
The image is a reformatted excerpt of the French alert. In plain English, its warning is that resetting this exposed, unpatched equipment alone is insufficient. A clean configuration and a protected management boundary address different parts of recovery.
That is the detail I keep in the episode's open loop. Resetting gives an operator a concrete action and a visible result. The remaining questions concern the device's support status, its security updates and who can reach the restored controls. The recovery review has to continue after the reset completes.
Coordinate recovery with the refrigeration provider
This is physical infrastructure, with service relationships around it. CERT-FR specifically tells operators to coordinate with their refrigeration contractor and check insurance-contract conditions before cutting internet reporting. Disconnecting a connection can affect required monitoring.
That warning deserves the same attention as the recommendation to remove public exposure. The immediate objective is to protect the management interface while preserving a workable, reviewed maintenance arrangement. Somebody responsible for the installation needs to decide how those requirements fit together.
The alert also discusses supported firmware, security settings and changing defaults as relevant manufacturer practices. They are defensive measures. Their inclusion supplies no evidence about which weakness an attacker used in this case.
A useful recovery conversation identifies the installed model, its support status, the configuration that was changed and the protected route through which authorized technicians will regain access. It should also identify who verifies those decisions before service is called restored.
Those questions are a way to read the alert with the responsible provider, rather than a substitute for their incident response. The normal controls govern equipment whose failures have physical and food-safety consequences. Reopening an aisle requires more than dismissing a software notification.
Also today: Rust accepted a reference that outlived its data
Rust issue #164250 reports a specific lifetime-check problem. A reference is a handle to data; a lifetime describes how long that reference and the data remain valid. The report describes accepted code retaining a short-lived reference where a longer-lived one is expected. Cleanup later treats the handle as valid after the original data is gone.
The reporter supplies reproductions and says a memory-checking tool detects the invalid access. Contributors discuss related examples reaching older versions. We did not compile or run those examples. At the episode's source check, the issue was open, marked high priority and had no linked fix. This supplies no claim that every Rust application encounters the path or that production exploitation has been established.
Also today: Apple's HomeView checks whose content to show
Apple announced HomeView, a seven-inch display for calls, entertainment and compatible home accessories. Its US starting price is $299. Preorders begin October 13, with availability November 13 in the announced markets.
Apple says personal Messages and Calendar content appears when an enrolled user's face is recognized and their paired phone or tablet is present and recently unlocked. The devices normally share the same wireless network, with a constrained cellular exception described in the announcement. These are vendor statements about personal-content controls; this edition makes no independent privacy certification.
Siri's new features start in English and beta. Some server-based features have daily usage limits, with expanded access available for a future fee. Apple also says HomeView will not be sold in the EU while Siri's new capabilities remain unavailable there.
Verdict: NEEDS REVIEW
I'd insist on protected management access before calling the refrigeration installations recovered. The legitimate maintenance feature remains useful. Its access boundary has to protect the retailer relying on it. Clean settings alone leave an unresolved exposure waiting for the next incident, and the food has already paid for the first one.
FAQ
Were the French fridges forced into a normal maintenance function?
The reviewed reporting describes prolonged forced defrost. Normal defrost removes ice so cooling can resume; holding it on can put food at risk.
Was only Danfoss equipment affected?
CERT-FR's revised alert also lists Copeland and Dixell controller families. Consult the current list and the installed model's manufacturer guidance.
Does the alert identify the exact attack entry route?
The reviewed alert establishes neither an attacker identity nor a specific exploited weakness explaining the campaign. Do not turn a possible cause into a confirmed one.
Why might resetting the controller be insufficient?
For the exposed, unsupported, unpatched equipment described by CERT-FR, resetting can remove attacker changes while leaving the vulnerability and access exposure unresolved.
Sources
- CERT-FR's official alert and October 13 affected-equipment update
- Reuters reporting, republished by ABC
- Dominique Schelcher's retailer confirmation
- Danfoss background on normal defrost
- Rust's primary lifetime-check issue
- Apple's HomeView announcement
This article expands on an episode of **The Daily Diff, a five-minute daily video on what shipped and what broke in tech.
Watch the episode · Subscribe on YouTube · the written diff lands in your inbox every morning at thedailydiff.dev.
Top comments (0)