French supermarkets: Danfoss refrigeration sabotaged remotely

During the night between Sunday 11 and Monday 12 October 2026, hundreds of French supermarkets found their refrigerated counters and freezers switched off or, worse, heating up. Attackers took remote control of the refrigeration control systems, made by Danish manufacturer Danfoss, and triggered a forced defrost of the units. Fresh and frozen products had to be thrown away.

On 12 October CERT-FR published an alert on compromises of Danfoss AK-SM and AK-SC units with their management interface exposed to the Internet, which we have already covered on ARX News. This article gathers what has emerged since: victims, mechanism, affected models and known vulnerabilities.

What happened

The attack was publicly confirmed by Dominique Schelcher, CEO of Coopérative U (Hyper U, Super U, U Express), who called it “extremely serious” and “unprecedented”. Figures on the affected stores vary by source:

• Groupement Mousquetaires told Infosecurity Magazine that 150 Intermarché and 30 Netto stores were hit; it told AFP 150–200 Intermarché stores, according to DataBreaches.net; broadcaster BFMTV, quoted by The Record, reports about 300 Intermarché and Netto stores;
• Coopérative U: fewer than 100 stores according to BFMTV, almost 100 according to AFP;
• Carrefour: 80 stores out of 6,000, according to a spokesperson speaking to Infosecurity Magazine; Groupe Casino reports 5% of Monoprix stores;
• E.Leclerc was named by EU agriculture commissioner Christophe Hansen; the chain has not commented.

Overall, according to BleepingComputer, French media estimate between 250 and 350 affected stores. Two stores in Haguenau, Alsace, alone reportedly lost €270,000 worth of goods (BFMTV). The Paris prosecutor’s office has opened an investigation, and ANSSI said it is mobilised at national and European level. No group has claimed the attack.

Technical details

The mechanism. According to BFMTV, picked up by several outlets, the attackers forced continuous defrost cycles with a setpoint of up to 50 °C. ZATAZ points out that 50 °C is the configured value, not necessarily the temperature reached in the cabinets. In many stores the changes reportedly began around midnight, hours before staff arrived; according to Help Net Security some stores saved part of their stock because they were hit later or thanks to alarms received in time.

The devices. Danfoss, in a statement to ZATAZ also reported by Infosecurity Magazine and LeMagIT, speaks of a “limited number” of systems and says most of them are:

• AK-SM800 and AK-SC355: older-generation, end-of-life products that no longer receive software or security updates;
• AK-SM800A running outdated firmware.

An Intermarché spokesperson told Infosecurity Magazine that the affected consoles had remote-control capabilities without an adequately secured communication channel. ZATAZ, citing a single industry source, reports that software versions earlier than 4 were targeted.

Known vulnerabilities. No source has confirmed which access path was used. For the AK-SM 800A, the following are known:

• CVE-2025-41450, authentication bypass, which according to LeMagIT affects versions earlier than 4.2;
• CVE-2025-41451, command injection leading to remote code execution;
• CVE-2025-41452, configuration injection into the embedded web server.

Dates differ: LeMagIT places Danfoss’s first advisory in March 2025, while BleepingComputer cites CISA advisories from May and August 2025. Infosecurity Magazine also lists CVE-2023-25915. The vulnerabilities were found by Claroty’s Team82, which showed in August 2026 how a compromised controller can switch off cooling while still displaying normal temperatures.

Exposure. Estimates of Danfoss devices reachable from the Internet vary: more than 2,700 according to Claroty, 3,726 controllers in a Shodan search on 19 August cited by Infosecurity Magazine, 2,752 systems including 1,590 in France according to Baptiste Robert (Predicta Lab), nearly 3,000 in France according to LeMagIT.

MITRE ATT&CK for ICS. Based on the reported facts, our reading is: T0883 (Internet Accessible Device), T0836 (Modify Parameter) for the defrost and temperature changes, T0879 (Damage to Property) for the destroyed goods. The sources publish no indicators of compromise.

Also on 12 October, Ahold Delhaize took some systems offline after an incident in the Netherlands and Belgium: according to Help Net Security and BleepingComputer, there is no evidence linking the two cases.

Impact for European and Italian companies

AK-SM and AK-SC units are widespread across Europe in food retail, cold-chain logistics and, as Claroty points out, warehouses, pharmaceuticals and chemicals. The French case shows that an attack on a poorly protected OT system causes immediate physical damage: lost goods, stores to restock, food safety risks. Production, processing and distribution of food are among the sectors covered by the NIS2 directive: if your company falls within them, the compromise of a plant controller is an incident to assess for notification to your national CSIRT (in Italy, CSIRT Italia at ACN). The same applies to the cold chain for medicines in healthcare.

What to do right now

1. Inventory: list the Danfoss controllers (and refrigeration control systems in general) at every site, with model and firmware version.
2. Remove direct exposure: the management interface must not be reachable from the Internet. Remote access, including the installer’s, should go through a separate management network or a VPN, as Danfoss also recommends; in the short term, restrict access to trusted IP addresses.
3. Update AK-SM800A units to the latest available firmware and plan the replacement of AK-SM800 and AK-SC355 units, which will receive no further fixes.
4. Credentials and accounts: change passwords, removing default ones, and review the accounts on the controllers.
5. Check the settings: defrost schedules, temperature setpoints and alarms, against the expected configuration.
6. Independent alarms: since a compromised controller can falsify readings, add temperature probes and alarms that do not depend on the controller itself.
7. If you suspect a compromise, follow the CERT-FR measures: filter access, factory reset, apply fixes, rotate secrets and fully reconfigure the device.

How ARXDOME helps

ARX Expose shows what an attacker sees from outside: open ports and recognised products on your company’s public addresses, to find out whether a controller’s interface is reachable from the Internet. ARX Watch finds devices on the corporate network with nothing installed on them, such as plant controllers, and alerts you when a new one appears. With ARX Sentry, firewall logs flow into the portal and access to the perimeter stays under control.

Last updated: 12 October 2026