Danfoss Fridge Controllers Hijacked: Hundreds of French…

Overnight on 11 to 12 October, someone reached into the refrigeration controllers of hundreds of French supermarkets and turned the cold aisles into warm ones. Staff at Intermarché, Netto, Coopérative U and Super U, Carrefour Market, Monoprix and E.Leclerc stores arrived on Monday morning to display cases that had been running a forced defrost for roughly six hours, with set points pushed to 50°C according to sector sources cited by BFMTV. Entire fresh and frozen inventories went into the bin. France's national CERT published an alert the same day, and the Paris prosecutor's office opened an investigation.

This is not a data breach. Nothing was encrypted, nothing was exfiltrated as far as anyone has said, and no ransom note has surfaced. It is a physical-impact attack on operational technology that most retailers do not think of as part of their IT estate, delivered through management interfaces that were sitting on the public internet.

What Happened

The equipment at the centre of the incident is the Danfoss AK-SM and AK-SC family of refrigeration system managers, the store-level front end that supervises case controllers, defrost schedules and alarms for an entire site. Danfoss told franceinfo on 12 October that most of the affected units were obsolete products, naming the AK-SM800, which reached end of life in 2021, and the AK-SC355, phased out in 2016. In a later statement reported by Cooling Post, the vendor widened that to "legacy products or current products running outdated firmware," which brings the current-generation AK-SM800A into scope.

The vendor's statement on remediation is worth quoting in full because it describes the attack surface by implication: "We are working with affected customers to implement appropriate mitigation measures, including firmware updates where available, stronger network protections and removing direct internet exposure where applicable."

Store counts vary by outlet and are still moving. BleepingComputer reported 250 to 350 stores. The Hacker News put Intermarché and Netto at more than 300 stores combined, Coopérative U at 80 of its 2,000, Carrefour at 80 and Monoprix at around 30. Cooling Post estimated roughly 500 sites in total. ABC News reported that the impact extended beyond France into Spain, Portugal, Poland, Germany and Belgium, and that some sites also experienced fires.

Losses are concrete even where the totals are not. BFMTV, via Security Affairs, cited a Haguenau Intermarché that lost its entire frozen stock at about €50,000 and a Wasselonne Leclerc at roughly €220,000 in frozen and fresh goods. The head of Les Mousquetaires, Intermarché's parent, told reporters to expect tens of millions of euros of losses nationally from a single night.

Who Is Affected

CERT-FR's alert, CERTFR-2026-ALE-012, is broader than the Danfoss headlines. Its affected-systems list names the Danfoss AK-SC and AK-SM series, but also Copeland xweb and Dixell xweb, two other supervisory controllers common in commercial refrigeration. CERT-FR says it is aware of "numerous compromises" of remote refrigeration controllers across several models, and states plainly that exposing a management interface to the internet contradicts established security practice.

The affected population is therefore anyone operating a supervisory refrigeration or building controller that a maintenance contractor can reach from the internet. That describes most multi-site food retail, cold-storage logistics, pharmacy chains and hospitality groups. Intermarché's own statement pointed at "a service provider that manages refrigeration systems in stores," which is the normal arrangement: the retailer owns the cases, a refrigeration contractor owns the remote access.

Exposure numbers give a sense of the pool. Baptiste Robert of Predicta Lab counted 2,752 Danfoss systems reachable online on Monday, 1,590 of them in France. Shodan tracked more than 4,500 Danfoss devices. Claroty's Team82 had already flagged 2,765 AK-SM 800A controllers exposed to the internet, using Censys data, when it published its research in August.

Technical Analysis

Nobody has publicly confirmed the initial access vector. That matters, because there is a tempting and unconfirmed narrative sitting right next to this incident.

In 2025 Claroty Team82 researcher Tomer Goldschmidt reported three flaws in the AK-SM 8xxA series that Danfoss fixed and CISA catalogued in advisory ICSA-25-140-03. CVE-2025-41450 is an authentication bypass: the controller accepts a password generated internally from the device's current date and time, a hidden code-of-the-day mechanism that yields full administrative access to the web interface without the configured credentials. Danfoss rated it 8.2 and fixed it in firmware R4.2, published in advisory DSA-2025-03-01 on 24 March 2025. CVE-2025-41451 is a post-authentication OS command injection through the alarm-to-mail configuration fields, rated 8.7 on CVSS v4 by Danfoss and fixed in R4.3.1 on 1 August 2025. CVE-2025-41452 lets an authenticated user inject Nginx configuration directives and crash the web service. Team82's public write-up of the chain landed on 9 August 2026, 63 days before the attack.

Those are the only published vulnerabilities for this product line, and neither Danfoss nor CERT-FR has linked them to the incident. The CERT-FR alert names no CVE at all. The CISA KEV catalog, version 2026.10.08, contains no Danfoss entry. Several outlets have drawn the line between the August research and the October attack anyway. Treat that as a hypothesis.

Two other explanations fit the evidence at least as well. The AK-SM800 and AK-SC355 that Danfoss says make up most of the victims predate the 8xxA series, so the 2025 CVEs do not apply to them; a 2016-era controller exposed to the internet rarely needs a vulnerability, only a default or shared password. And CERT-FR's inclusion of Copeland and Dixell units from entirely different vendors points toward a campaign built on whatever was reachable rather than a single product-specific exploit. Credential reuse across a contractor's fleet, or compromise of the contractor's remote-access platform, would explain multiple vendors and multiple chains in one night.

What is not in doubt is the physical mechanism. A supervisory controller like this exists to schedule defrost cycles, set temperature thresholds and raise alarms. Whoever held the interface used those legitimate functions: no malware is required to run a defrost indefinitely at a high set point. Team82's research notes the same controller can also alter temperature readings, so an attacker who wanted to be subtle could have left the thermometers lying. This time they did not bother. For a deeper look at why this class of device is dangerous, see How a Refrigeration Controller's Web Interface Becomes a Physical-Damage Attack Surface.

Immediate Actions

CERT-FR's guidance is specific and splits by state. For controllers you believe are not compromised: remove them from internet exposure along with any other publicly reachable equipment, verify the full configuration with particular attention to defrost cycles, restore access only through a secured VPN or protected network, and apply the manufacturer's hardening, which it lists as firmware updates, strict security mode and changing default credentials. For compromised units: remove internet exposure, perform a factory reset, re-establish access only through VPN or a protected network, reconfigure for service, then apply the vendor hardening. The alert warns that campaigns are ongoing and that an unpatched unit left exposed will simply be hit again.

In practice that means three workstreams this week:

Find them. Most retail IT teams do not hold an inventory of controllers a refrigeration contractor installed, often behind a cellular modem or a port-forward on the store router. How to Inventory the OT Controllers Your Facilities Contractors Put Online covers where to look.
Cut the path. Pulling a controller off the internet before you have confirmed it is clean is the right order of operations, even if a contractor loses remote visibility for a few days.
Confirm the physics. Walk every case with a thermometer and check defrost schedules against the documented baseline. A controller showing normal readings is not proof of normal temperatures.

For supported Danfoss hardware, the fix lines are documented: R4.2 for the authentication bypass, R4.3.1 for the command injection and Nginx issue. For end-of-life AK-SM800 and AK-SC355 units there is no firmware to apply. Those devices need to be fenced off completely and scheduled for replacement.

Long-Term Outlook

This incident will be remembered less for its technique than for the business model it exposed. The retailer bought the refrigeration, the contractor kept the keys, and the keys were on the internet because that is how the contractor services 300 stores with a small team. Why 'Our Contractor Manages That' Is Not a Security Boundary for OT looks at how to put that relationship under contract and under monitoring.

Expect three things to follow. Insurers will start asking whether supervisory controllers are internet-reachable, the way they already ask about MFA on remote access. CISA and European agencies will keep adding building and refrigeration controllers to the exposed-device sweeps that have so far focused on firewalls and VPNs. And copycats will test the same recipe against the 4,500 devices still answering on the public internet, because this attack needed nothing a motivated person could not learn from the vendor's manual.

Sources

BleepingComputer: https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/
The Hacker News: https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html
CERT-FR alert CERTFR-2026-ALE-012: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/
Danfoss statement via Cooling Post: https://www.coolingpost.com/world-news/danfoss-moves-to-mitigate-cyberattack/
Danfoss DSA-2025-03-01: https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/
Danfoss DSA-2025-08-01: https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01/
CISA ICSA-25-140-03: https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03
Claroty Team82 research: https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
Security Affairs (BFMTV figures): https://securityaffairs.com/200863/hacking/hackers-cranked-french-supermarkets-freezers-up-to-50-degrees-causing-hundreds-of-stores-to-lose-their-stock.html
ABC News: https://www.abc.net.au/news/2026-10-13/french-supermarkets-hacked-causing-fires-and-food-loss/107258724
CISA KEV feed (no Danfoss entry as of catalog 2026.10.08): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json