Staff at hundreds of French supermarkets arrived Monday to refrigerated cases that had been warming overnight. Attackers took over refrigeration controllers on Sunday night and switched on their automatic defrost cycle, according to BleepingComputer. Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc and Super U stores were among those hit.
BleepingComputer reports that the controllers were running older versions of Danfoss control software. Nobody has said yet how they were broken into.
The attacker didn’t steal data. They turned the freezers into heaters and let the food spoil.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Attackers defrosted supermarket fridges across France
French outlets put the number of affected stores at 250 to 350. Intermarché said the attack “reportedly” hit a service provider that manages refrigeration in its stores. The Paris prosecutor’s office opened an investigation into what it called a “large-scale cyberattack” on refrigerators at several major chains.
Danfoss has published fixes for its AK-SM 800A series of supermarket system managers. CISA warned in 2025 about an authentication bypass in versions before R4.2 (CVE-2025-41450), caused by passwords generated from the date and time, and a command injection bug in versions before 4.3.1 (CVE-2025-41451). Claroty’s Team82, which found the bugs, showed in August how they lead to remote code execution through the web management interface.
Stores and warehouses with Danfoss AK-SM controllers online
BleepingComputer cites Predicta Lab’s count of 2,752 Danfoss systems exposed online on Monday, 1,590 of them in France, and Shodan tracks more than 4,500. The same controllers run refrigeration and HVAC in food retail, cold storage and warehouses well beyond France.
These boxes are often installed and managed by a refrigeration contractor, not IT. That is how a management interface ends up on the open internet with old firmware and nobody watching its logins.
Take refrigeration controllers off the internet, then update
- Ask facilities, or the refrigeration contractor, for a list of every AK-SM 8xxA unit and its firmware version.
- Remove direct internet access to the web management interface. Put remote access behind a VPN or the contractor’s managed gateway.
- Update to 4.3.1 or later from Danfoss, which also covers the R4.2 authentication fix.
- Change the controller passwords and turn on alarm notifications for unexpected defrost or setpoint changes.
Forward this
For whoever manages our stores, warehouses or building systems: attackers remotely defrosted fridges at hundreds of French supermarkets on Sunday night through internet-exposed Danfoss controllers. Can our refrigeration contractor confirm today that none of our controllers are reachable from the internet and that they run firmware 4.3.1 or later?
Details
- Products: Danfoss AK-SM 8xxA series (AK-SM 800A) system managers for refrigeration and HVAC.
- CVE-2025-41450: improper authentication (date/time-based password generation), fixed in R4.2.
- CVE-2025-41451: command injection in alarm-to-mail settings, post-authentication RCE, fixed in 4.3.1. CVE-2025-41452: web server configuration control, denial of service, fixed in 4.3.1.
- Advisories: CISA ICSA-25-140-03 (Update A, August 26, 2025); Danfoss DSA-2025-08-01.
- Incident: controllers hijacked Sunday night, October 11, 2026; 250 to 350 stores reported affected. Paris prosecutor investigating. Entry point not confirmed.
Hunt / verify
- Controller event logs for defrost cycles or setpoint changes that nobody scheduled, especially overnight.
- Logins to the web interface from addresses outside your contractor’s known ranges.
- Your own external IP ranges in Shodan or a similar service, searched for Danfoss management pages.
Slack paste: French supermarket fridges defrosted remotely via Danfoss refrigeration controllers (Oct 11–12). Action: get the AK-SM 8xxA list from facilities, take the web UI off the internet, update to 4.3.1+, change passwords.
Sources
- BleepingComputer: Cyberattack shuts down refrigerators at French supermarkets (October 12, 2026)
- CISA: Danfoss AK-SM 8xxA Series (Update A), ICSA-25-140-03
- Danfoss: Security advisory DSA-2025-08-01
- Claroty Team82: Uncovering vulnerabilities in Danfoss refrigeration controllers
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
