If you run anything that controls physical equipment, this one is for you. Attackers took over the systems that run fridges and freezers at hundreds of French supermarkets and warmed them up, and stores had to throw food away. No ransom note, no data theft in the reports. Just spoiled stock.
What was reported
According to The Hacker News, the attack hit on the night of October 11. The attackers got in through a Danfoss controller that manages all of a store’s refrigeration and that maintenance firms can administer remotely.
Les Mousquetaires, which owns Intermarché, said its fridges and freezers were put into defrost and heated to as much as 50°C. The retailers’ own numbers vary:
- Intermarché and Netto: at least 300 stores across both brands per AFP, about 150 per Reuters
- Coopérative U: 80 of 2,000 stores
- Carrefour: 80 supermarkets
- Monoprix: about 30
- E.Leclerc: several stores
Outcomes differed too. Coopérative U’s chief executive said the cold chain held in most of its affected stores, and only a minority lost goods. Intermarché said its affected stores had to discard all the products concerned. The head of Les Mousquetaires told BFMTV he expected losses of tens of millions of euros across France.
The Paris prosecutor’s office has opened an inquiry. Among the damage it will examine is equipment that began to catch fire.
The controllers involved
CERT-FR said it knows of numerous compromises affecting two Danfoss series, the AK-SM and the AK-SC. Danfoss said most of the units hit were older models that no longer get updates. It named the AK-SM 800 (end of life since May 2021) and the AK-SC 355 (phased out in 2016).
Some units of the current AK-SM 800A were also hit. Danfoss told trade publication Cooling Post those were running outdated firmware, without naming versions.
CERT-FR’s advice is blunt: disconnect the controllers or filter access to them. ANSSI’s head, Vincent Strubel, called that urgent.
What nobody has said yet
This is the part I want to be careful about. As of October 13, neither CERT-FR nor Danfoss had named a vulnerability, a firmware version, or an entry route. No attacker has been identified. CERT-FR had published no indicators of compromise.
There are loose threads that invite speculation. A person close to the French Prime Minister told AFP that ANSSI identified a vulnerability in software from a Danish company. No CVE was named, and the statement doesn’t say it was used in the attack.
Danfoss fixed three flaws in the AK-SM 800A in 2025: an authentication bypass (CVE-2025-41450), a command injection (CVE-2025-41451), and a denial-of-service issue (CVE-2025-41452). Claroty researchers said they could be chained and found thousands of exposed AK-SM 800A interfaces. But neither French authorities nor Danfoss has linked these flaws to this attack, and Claroty’s work was lab testing on the newer model that doesn’t mention the older ones.
So I won’t tell you how they got in. Nobody has said.
My take
Everything below is my analysis, not something the sources report.
The failure here looks like an exposure problem first. Whatever the exact entry point turns out to be, the pattern is familiar. A management interface that can be reached from the internet, on a device that may not be patchable, installed by a contractor and then forgotten. CERT-FR’s alert says exposing these interfaces goes against good practice. Danfoss’s own newsletter described earlier attacks on AK-SM 800 stores in 2022, where all 40 hacked Israeli stores lacked proper firewall or VPN protection.
Ownership is blurry. Coopérative U’s chief executive pointed out that its stores buy from refrigeration contractors, not from Danfoss. In that setup, who tracks the firmware? Who knows the controller is on the internet? A store manager won’t. The contractor may not be watching either. This gap is where these incidents live.
End-of-life gear is a standing risk. For the AK-SM 800 and AK-SC 355, CERT-FR’s recovery step of applying security fixes gives owners nothing, because no fixes exist. Their only real options are isolation or replacement. Danfoss had told customers in October 2025 to plan replacements. A year later, here we are.
The impact was physical, and cheap to cause. Raising a setpoint on a refrigeration controller doesn’t need clever malware. It needs access. The damage was spoiled food and, by the prosecutor’s account, equipment that started to burn. If your threat model for operational devices stops at data loss, widen it.
What to do
If you operate or support Danfoss AK-SM or AK-SC controllers, follow CERT-FR’s guidance:
- Disconnect the controllers from the internet, or filter access tightly. If remote administration is unavoidable, restrict it to trusted IP addresses as a temporary step.
- If a controller may be compromised, work through CERT-FR’s six steps in order: limit network access to service providers only, factory reset, apply all available fixes, change secrets such as passwords, check existing accounts, then reconfigure completely.
- For the AK-SM 800A, update firmware. Per the package readme, a system on 3.x should move to 4.x first, and a controller can’t be downgraded once it runs 5.3.x. From 4.0, Strict Session Control is on by default and makes HTTPS mandatory.
- Change default passwords and send remote users through a single managed entry point, as Danfoss’s guidance says.
If you’re a retailer or any business that relies on contractors for building systems, ask them three things this week. Which controllers do you manage for us? Are any reachable from the internet? Which are past end of life?
More broadly, I’d inventory any building or industrial controller with a web interface and check whether it answers from outside your network. Do it before someone else does it for you.
There may be more to learn. Reuters quoted a Sekoia analyst saying Spain, Portugal, Poland, Germany and Belgium were also affected, with no details given. Watch for CERT-FR indicators and a Danfoss advisory, and re-check your exposure when they appear.
Sources
- Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers — The Hacker News, 2026-10-13
