Cyberattack Hijacks Danfoss Controllers, Shuts Down Refrigerators at French Supermarkets

Attackers Remotely Defrosted Hundreds of French Supermarket Fridges

A coordinated cyberattack struck overnight between October 11 and 12, 2026, hijacking refrigeration controllers made by Danish manufacturer Danfoss at supermarket chains across France. Instead of disabling cooling outright, the attackers abused a built-in automatic defrost function, forcing it to run continuously rather than its normal ~2-hour daily cycle. Over several hours, affected units climbed from their normal operating range near -20°C to as high as 50°C (122°F), spoiling fresh and frozen stock and, according to the Paris prosecutor's office, sparking fires in at least some locations.

French outlets reported between 250 and 350 stores affected, with Cooling Post later citing figures suggesting the true number could be closer to 500. Confirmed victims include Intermarché and Netto (roughly 150-200 stores, per parent company Groupement Mousquetaires), Coopérative U (fewer than 100 stores), Carrefour Market (around 80), E.Leclerc, Monoprix, and Super U. Picard was reportedly not affected. A separate wave of disruption hit supermarket operations in the Netherlands (Albert Heijn, Etos, Gall & Gall) and Belgium (Delhaize) the same weekend, though it remains unconfirmed whether the two incidents share a common origin.

Incident Details

How It Worked

A Built-In Function, Turned Against Its Own Equipment

Rather than deploying ransomware or simply cutting power, the attackers manipulated a legitimate feature of the Danfoss control stack: the defrost cycle, which normally runs for about two hours per day to clear ice buildup on evaporator coils. By remotely accessing exposed management interfaces, the attackers overrode the cycle's built-in time limits and left it running indefinitely. Display cases and walk-in freezers that should hold steady near -20°C instead climbed toward 50°C over a period of roughly six hours — not merely stopping preservation, but actively melting and spoiling product.

The Targeted Hardware

The central target was the AK-SM 800A, a supervisory "system manager" controller that coordinates all of the refrigeration circuits in a store and exposes a web-based interface for viewing circuits and setting temperature thresholds. Danfoss told AFP that most of the affected equipment consisted of legacy products that no longer receive software or security updates — specifically the AK-SM800 line, officially declared end-of-life in 2021, and the older AK-SC355, phased out in 2016. Technical reconstructions point to attackers exploiting known weaknesses in outdated, internet-exposed firmware on these older units rather than a fresh zero-day.

A Known Vulnerability Chain, Disclosed Months Earlier

This was not a surprise to the security research community. On August 9, 2026, Claroty's Team82 (researcher Amir Zaltzman) published "Freeze the Controller, Defrost the Food," detailing three vulnerabilities in the AK-SM 800A's embedded web management interface, later presented at DEF CON 34:

• CVE-2025-41450 — a hidden "code-of-the-day" authentication mechanism that could be abused to bypass normal login controls, ultimately enabling remote code execution.
• An unauthenticated command injection flaw, where the email-authentication password field was passed unsanitized into an OS shell command.
• CVE-2025-41452 — a flaw in the function that lets the web application overwrite the headers.conf file used by the exposed Nginx instance, allowing an attacker to inject routing directives and crash the sm_app process (denial of service).

Chained together, these issues let an unauthenticated attacker progressively escalate to root-level remote code execution — including the ability to physically manipulate refrigeration hardware and falsify temperature readings to mask the failure. Team82's research also found 2,765 Danfoss management interfaces exposed directly to the internet via a Censys scan. Danfoss patched the disclosed issues in firmware R4.3.1 and urged AK-SM 800A operators to upgrade — but patching requires active vendor support, which legacy AK-SM800 and AK-SC355 units no longer receive.

Impact Assessment

Recommendations

For Retail and Facilities Operators Running Danfoss or Similar OT Equipment

• Inventory every refrigeration controller on the network — model, firmware version, and support status — and flag any AK-SM800 or AK-SC355 unit still in production; both are end-of-life and will not receive further security patches.
• Upgrade supported AK-SM 800A controllers to firmware R4.3.1 or later, which addresses the Team82-disclosed vulnerabilities.
• Remove refrigeration management interfaces from direct internet exposure. Place them behind a VPN or jump host, and verify exposure with an external scan (Censys/Shodan) rather than assuming firewall rules are correctly applied.

For Security Teams

• Treat OT/ICS vendor disclosures (Claroty, Dragos, CISA ICS advisories) as operational action items, not just reading material — the gap between an August disclosure and an October exploitation was roughly two months.
• Segment refrigeration and building-management networks from POS, inventory, and corporate IT; a compromised controller should not have a path to anything beyond its own refrigeration circuit.
• Deploy independent temperature monitoring (physical sensors feeding an out-of-band system) so a falsified controller reading cannot mask a real failure.

For IT/Procurement Leadership

• Build end-of-life OT hardware into capital refresh planning rather than running it until failure — "legacy equipment no longer receiving updates" is now an attack vector, not a maintenance footnote.
• Require vendors to disclose support end dates and firmware update commitments at time of purchase for any networked industrial controller.

Key Takeaways

1. Attackers did not need malware or a zero-day — they abused a legitimate built-in defrost function on Danfoss refrigeration controllers to destroy cold-chain integrity remotely.
2. Hundreds of French supermarket stores across Intermarché, Coopérative U, Carrefour Market, E.Leclerc, Monoprix, and Super U were affected, with losses estimated in the millions of euros.
3. The exploited weaknesses trace back to legacy, unsupported Danfoss hardware (AK-SM800, AK-SC355) rather than currently patched models — end-of-life OT equipment is a direct business-continuity risk.
4. Claroty Team82 publicly disclosed related AK-SM 800A vulnerabilities, including CVE-2025-41450 and CVE-2025-41452, in August 2026 — two months before this attack — and found thousands of exposed management interfaces.
5. French authorities, including ANSSI and the Paris prosecutor's office via the OFAC cybercrime unit, have opened a formal investigation; a possibly related wave hit Dutch and Belgian grocers the same weekend.
6. The incident highlights a growing OT risk pattern: internet-exposed, unpatched industrial controllers in retail and food supply chains are now viable targets for large-scale, low-sophistication disruption.

Sources

• Cyberattack shuts down refrigerators at French supermarkets — BleepingComputer
• Cyberattacks hit European grocers: French supermarket freezers hijacked, Dutch and Belgian stores disrupted — Help Net Security
• Freeze the Controller, Defrost the Food — Claroty Team82
• Danfoss moves to mitigate cyberattack — Cooling Post