Attackers Forced Defrost at Hundreds of French Supermarkets Through Danfoss Controllers, and Danfoss Says Most Were End-of-Life

Attackers remotely forced refrigeration controllers into defrost at hundreds of French supermarkets overnight from Sunday, October 11, to Monday, October 12, and stores threw away chilled and frozen food. Retailers told BFMTV and AFP that about 300 Intermarché and Netto stores were hit, along with fewer than 100 Coopérative U stores, 80 Carrefour supermarkets, about 30 Monoprix stores and several E.Leclerc stores. Danfoss, the Danish maker of the controllers, told AFP and BFMTV that most of the affected units are older products, notably AK-SM800 and AK-SC355 systems, that have reached end of life and no longer receive software or security updates, and that the AK-SM800A units involved were running outdated firmware.

France’s CERT-FR said on October 12 that it is aware of “numerous compromises” of Danfoss AK-SM and AK-SC series devices. No group has claimed the attack, and no official source we found has named the flaw that was used. The Paris prosecutor’s office opened an investigation on its own initiative, and the office of Prime Minister Sébastien Lecornu says the national cybersecurity agency ANSSI has been asked to take up the case. Everything below is as of Tuesday morning, October 13 (UTC).

What happened overnight

BFMTV broke the story on Monday. Its sources in the refrigeration trade say the controllers have an automatic defrost function that can be programmed to run two hours of defrost in a 24-hour period, and that the attackers reportedly abused it to force a continuous defrost with a set point of 50 degrees. In some stores the attack reportedly began around midnight, which gave temperatures hours to climb; in others it came later in the night and staff saved part of the fresh stock. Summarizing the report on X, security researcher Lukasz Olejnik wrote: “Staff opening freezers in the morning were hit by a wave of hot air.”

The figures vary with who is speaking. Thierry Cotillard, who heads Les Mousquetaires (Intermarché and Netto), told BFMTV the attack put the cold units in affected stores into defrost and heated them to 50°C. Coopérative U CEO Dominique Schelcher told RTL on Tuesday that temperatures in some stores went as high as 80°C, according to BFMTV. A Carrefour Market manager in Rennes told France 3 Bretagne that the store’s freezers were programmed at 95°C in a phone app, as franceinfo reports. Those are three different figures from three different sources, and we have not seen controller logs for any of them.

The cold-chain rules left stores little choice: Intermarché told AFP it had to discard all affected products. Cotillard put the national damage at tens of millions of euros, while a source close to the case told France Inter it could reach several million. Schelcher said a loss at an affected store runs from a few tens of thousands of euros to about 200,000 euros in a hypermarket, and Intermarché told AFP that insurance would be a hard point because insurers do not cover this type of incident.

SecurityWeek, citing Reuters, says retailers in Belgium, Germany, the Netherlands, Poland, Portugal and Spain were also affected and lists Auchan among the chains hit. The French reports we read do not confirm that. The Prime Minister’s office did say ANSSI is working with its European counterparts because other countries could be affected, as franceinfo reported on Monday.

What Danfoss, ANSSI and CERT-FR have said

Danfoss described the incidents to franceinfo as affecting a limited number of refrigeration management systems. It said it has long recommended that customers keep supported systems on the latest firmware and migrate end-of-life systems to current ones, and that it is working with affected customers on mitigations: firmware updates where available, stronger network protections and removal of direct internet exposure where applicable. We have only seen that statement in French, in BFMTV’s and franceinfo’s reports, so the paraphrase is ours.

Firmware age matters because Danfoss changed the defaults in the 4.0 software line. Its AK-SM 800A download page says that after installing package 4.0.x or later the controller defaults to strict session control, which requires HTTPS and session tokens, while a backward-compatible setting that Danfoss does not recommend allows plain HTTP with no session tokens. BFMTV reported that the attack hit versions of the control software older than version 4, without saying how it knew.

The Prime Minister’s office said ANSSI had already identified a vulnerability in software from the Danish company and contacted the vendor, and that the agency was trying to identify other French companies affected so it could alert them. CERT-FR’s alert, CERTFR-2026-ALE-012, is short. It says exposing a management interface on the internet is contrary to good practice, advises disconnecting or filtering access to AK-SM and AK-SC instances, and, where compromise is suspected, lists six steps: restrict network access to service providers only, perform a factory reset, apply every available security patch, rotate secrets, check existing accounts and reconfigure the device fully.

The Paris prosecutor’s office said its anti-cybercrime section, with the national anti-cybercrime office (OFAC), will identify victims and establish the link with the damage they report, which it described as lost food and outbreaks of fire. Franceinfo, relaying AFP, says that refers to equipment that began to catch fire. EU agriculture commissioner Christophe Hansen condemned the attack on X, naming Intermarché, Coopérative U and E.Leclerc, and said the instrumentalization of food has become a reality. Schelcher’s post confirming the attack called it unprecedented; BleepingComputer translates it as “Targeting equipment essential for preserving fresh produce and supplying food to the French people is an extremely serious matter and is unprecedented.”

Which flaw was used? The public record has a pattern, not an answer

No official source has said how the attackers got in. What is public is a history of weaknesses across this controller family: the older end-of-life models, and two rounds of fixes for the newer AK-SM 800A. The table sets it out from Danfoss’s own advisories and two researchers’ reports.

In its 2023 advisory for the older units, Synacktiv wrote that the check behind the per-day login code “only relies on the date of the day,” and that “the needed information is returned by the read_date_time function accessible without authentication.” Danfoss acknowledged the report on March 13, 2023, but in Synacktiv’s words indicated “this vulnerability only affects EOL products SM800 and SC255.” The advisory’s mitigation reads “Restrict network access to the affected products.”

Claroty’s Team82 write-up, dated August 9, 2026, describes a similar mechanism in the newer AK-SM 800A for CVE-2025-41450: a routine that “generates a daily authentication password based solely on the device’s current date,” and a successful login that “results in a fully authenticated administrative session.” Danfoss’s own advisory for that CVE, published on March 24, 2025, describes a narrower impact: an attacker “would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information.” Claroty also lists configuring temperature thresholds and adjusting operating schedules among the functions of the management console.

Two French commentators have pointed to known flaws. Ethical hacker Clément Domingo told RMC on Tuesday that the attackers took control with a very simple password, the date of the day, and that the incident came down to an update that had not been made. Cybersecurity specialist Marta Rybczynska told Sud Ouest that the attackers used one of the documented flaws. The reports we read give no evidence behind either statement, and neither the Danfoss statement nor the accounts of ANSSI’s findings that we read name a specific CVE. A date-based code fits the pattern in the table, but a fit is not a finding. None of the three 2025 CVEs is listed in CISA’s Known Exploited Vulnerabilities catalog in the feed dated October 8.

The split matters for defenders. Danfoss says the AK-SM800A units involved ran outdated firmware, so newer firmware was available for them. For the older end-of-life units it says updates are no longer provided, so the remaining options are isolation or replacement.

How many of these controllers can be reached from the internet

Claroty wrote in August that exposure lowers the bar for an attacker: instead of compromising a corporate network first, “they can simply scan for exposed controllers, identify devices running vulnerable firmware, and begin interacting directly with the embedded web application.” Three counts are now public, and they should not be added together or read as a trend, because each uses a different tool, query and product scope.

• Claroty: a Censys count of 2,765 exposed AK-SM 800A devices, given in an image caption, without a date, in its August post.
• Baptiste Robert: 2,752 Danfoss systems online on Monday, 1,590 of them in France (58 percent), in an X thread. BleepingComputer describes Robert as the CEO of Predicta Lab.
• Shodan: over 4,500 Danfoss devices reachable from the internet, according to BleepingComputer.

French offensive-security firm Synacktiv told 01net that in a recent audit it found refrigeration systems reachable directly from the internet with no password at all, and sometimes also from stores’ internal networks.

Who owns the fix

Schelcher told RTL that U stores are not Danfoss customers but customers of refrigeration contractors who supply Danfoss solutions. The FCD retail federation asked Danfoss and the contractors for full transparency. Cotillard predicted a legal fight in which the parties pass responsibility around, and said Danfoss had, as Cotillard recalled it, explained that the problem was not on its side, BFMTV reports. Intermarché’s statement to BleepingComputer frames the incident as an attack on a service provider rather than on the controllers: “Following a cyberattack reportedly affecting a service provider that manages refrigeration systems in stores, some fresh and frozen food display units are out of service.”

That leaves three parties around one device: a manufacturer that ended support for older models, contractors who install them and, as Claroty notes, frequently administer them remotely, and stores that bear the loss. The record we read does not show who was responsible for updating or isolating each unit. CERT-FR’s remediation advice, to restrict network access to service providers only, treats those providers as the parties that legitimately need the connection.

What operators can do now

• Cut internet exposure. CERT-FR says to disconnect or filter access to AK-SM and AK-SC instances; where remote administration is essential, restrict it to trusted IP addresses. Claroty likewise advises keeping management interfaces off the internet and behind trusted management networks or VPNs.
• Update what can be updated. Claroty and Danfoss’s 2025 advisories point AK-SM 800A owners to firmware 4.3.1 or later. Units that no longer receive updates need isolation and a replacement plan.
• If compromise is suspected, follow CERT-FR’s six steps above. Our own addition, not from these sources: check set points, defrost schedules and alarm settings, because the reported damage came from configuration changes.
• Ask in writing. Also our suggestion: ask your refrigeration contractor which controller model and firmware each store runs, who has remote access and who is responsible for updates.

What is still unknown

Who is behind the attack and why is open: nobody has claimed it, and the Paris investigation has only started. Which weakness was used, if it was one of the documented ones, has not been stated; Danfoss and CERT-FR both advise removing internet exposure, but neither says that is how the attackers got in. Intermarché’s statement speaks of an attack on a service provider that manages refrigeration systems, so whether the attackers went through a provider’s remote access or reached the controllers directly is also open. Whether the incidents in other countries that Reuters reportedly describes are the same operation is unconfirmed. Ahold Delhaize said on Monday that it took some systems offline after a security issue; BleepingComputer notes there is no evidence yet that the two are connected, and SecurityWeek says it is unclear. How many controllers remain compromised or exposed, and whether attackers kept access, has not been reported.

For related reading, we covered the UK National Audit Office’s warning that preparedness for a food supply shock lags the risk, which cited the 2025 ransomware attacks on Marks and Spencer and Co-op; the French incident reached the equipment that keeps food cold rather than retailers’ IT systems. For another cyber-physical angle this month, see Booz Allen’s operational technology lab report, where humans approved every action that could have a physical effect.

Sources and method

We read Danfoss’s security advisory index and advisories DSA-2023-08-01, DSA-2025-03-01 and DSA-2025-08-01; its AK-SM 800A download page; Synacktiv’s 2023 advisory PDFs and its advisory list; Claroty’s Team82 post; CERT-FR alert CERTFR-2026-ALE-012 and its English-language post on X, as embedded by 01net; X posts from Schelcher, Hansen, Olejnik and Robert through a public mirror; reporting from franceinfo (AFP), BFMTV, 01net, BleepingComputer and SecurityWeek; and CISA’s KEV feed (catalog 2026.10.08), where we searched for the three 2025 CVEs and for any Danfoss entry and found none. Reuters returned an error to our request, so its reporting is attributed through SecurityWeek. We did not test any device and did not query Shodan or Censys, so the exposure counts are the researchers’ own. Translations from French are ours and are kept as paraphrase except where an English-language source printed the same words. Danfoss’s statement was seen in French only.