Vulnerabilities

Hijacked Danfoss controllers heat French supermarket fridges

By Yaali. October 17, 2026, 6 min read, Vulnerabilities, Threat intel, Resilience.

Attackers pushed fridges in hundreds of French supermarkets into defrost, up to 50°C. Which controllers were hit and what CERT-FR says to do now.

Overnight on October 11 to 12, attackers took remote control of the refrigeration in hundreds of French supermarkets and put fridges and freezers into defrost. Les Mousquetaires, which owns Intermarché and Netto, said its units heated to as much as 50°C and that affected stores had to throw away all the products concerned. Coopérative U, Carrefour, Monoprix and E.Leclerc also reported stores hit, and the Paris prosecutor opened an investigation that also covers reported fires.

The way in was the store's refrigeration supervisor, a small web-managed controller that runs every case and cold room and that contractors manage remotely. CERT-FR, the French government's computer emergency response team, named Danfoss AK-SM and AK-SC controllers on October 12 and added Copeland and Dixell XWEB supervisors a day later. If you run cold rooms, pharmacies, kitchens or food logistics anywhere, and a contractor reaches your refrigeration over the internet, this applies to you. CERT-FR says the campaigns are probably still running.

How it works

A supermarket's cases each have a local controller that holds the setpoint and switches the compressor, fans and defrost heaters. Above them sits a supervisor such as the Danfoss AK-SM 800A, which stores the setpoints and defrost schedules for the whole store, logs temperatures for food safety records, and offers a web interface. Refrigeration contractors use that interface to fix faults remotely and to collect the continuous data that cold-chain traceability and "refrigeration as a service" contracts depend on, and it is why so many of these panels sit on public IP addresses.

Defrost is a normal function: heaters melt the ice off the evaporator coil for a short, scheduled period, then cooling resumes. Anyone with admin access to the supervisor can change those schedules and parameters for every case at once. Forcing defrost and raising its limits turns the heaters against the stock, and by morning the food is past saving.

How the attackers got admin access has not been made public. Danfoss says most hijacked units were end-of-life models: the AK-SM 800, end of life since May 2021, and the AK-SC 355, phased out in 2016. Neither gets security updates. Some current AK-SM 800A units were also hit, and Danfoss says they ran outdated firmware, without naming the versions.

For the AK-SM 800A, published flaws exist. Claroty's Team82 described three on August 9, 2026, all in the web management interface:

• CVE-2025-41450 is an authentication bypass in versions before 4.2. The controller accepts a hidden "code of the day" derived from its current date. Team82 rebuilt the algorithm, so anyone who has it can generate the day's code and get an admin session without the configured password.
• CVE-2025-41451 is a command injection through the SMTP email password setting, giving remote code execution once logged in.
• CVE-2025-41452 lets a logged-in user replace the headers.conf file of the device's Nginx web server, which can cause a denial of service.

The fixes shipped in 2025, with all three closed in firmware 4.3.1. Neither CERT-FR nor Danfoss has linked these flaws to the attack, and Claroty's lab work did not cover the two older models. Default passwords and open panels would have been enough on those.

What attackers are doing

The scale is clear in outline but the counts vary by source. Les Mousquetaires told AFP that at least 300 Intermarché and Netto stores were hit; Reuters reported about 150. Coopérative U said 80 of its roughly 2,000 stores were hit and that staff and contractors held the cold chain in most of them. Carrefour put its figure at about 80 stores and Monoprix at about 5%. E.Leclerc said an unnamed refrigeration supplier was attacked, and at least one of its affected stores used Dixell equipment, and CERT-FR widened its alert on October 13 once it was clear that not every victim used Danfoss.

Nobody has claimed the attack and no entry route has been named. A person close to the French Prime Minister told AFP that ANSSI, the national cybersecurity agency, had found a vulnerability in software from a Danish vendor and contacted it, but gave no CVE and did not say it was used.

The exposure is large. Claroty counted 2,765 Danfoss management interfaces reachable from the internet in a Censys scan. Shodan searches on October 12 and 13 returned about 4,500 Danfoss controller interfaces worldwide, with more than half in France, according to The Register and SOCRadar. These counts measure reachable panels, not vulnerable firmware.

Danfoss's October 2025 newsletter records 2022 attacks on AK-SM 800 systems at 16 Russian supermarkets and 40 Israeli stores, all 40 without a proper firewall or VPN. And in late August 2026 about a dozen US military commissaries lost refrigeration; military investigators are looking into it, and Reuters noted the resemblance, but no link to this campaign or to Danfoss has been confirmed.

What to do

Start with an inventory. Ask every refrigeration and building-systems contractor which supervisors they installed, what model and firmware each runs, and how they reach it. Then check from outside: search your public IP ranges in Shodan or Censys for Danfoss, AK-SM and XWEB banners, and look at your firewall for inbound rules forwarding HTTP or HTTPS to a controller.

1. Take panels off the public internet today. CERT-FR asks for this for every unit on a public IP. Before cutting the contractor's data link, read your insurance and maintenance contracts, since cold-chain monitoring may be a condition of cover.
2. Review the configuration, defrost schedules first. Compare defrost timings, setpoints and alarm limits with what the contractor documented. Look for user accounts nobody recognises.
3. Bring remote access back through a VPN or a protected network. A firewall rule that only allows the contractor's source IPs is acceptable for a few days. CERT-FR says it is not a lasting answer.
4. Patch or replace. AK-SM 800A owners should move to the latest package Danfoss lists, 5.3.x as of October 13, and at minimum 4.3.1. A unit on 3.x has to go through 4.x first. Set the security level to Strict and change default passwords. AK-SM 800 and AK-SC 355 owners have no fix coming and need a replacement plan.
5. If a unit was compromised, restart it, and if that does not clear the attacker's changes, restore factory settings. Reconfigure it fully, rotate every password on it and on the contractor's side, check the accounts, and only then reconnect through the VPN. CERT-FR warns that a reset without a patch leaves the unit open to the same attack, and an end-of-life unit put back online will very likely be compromised again.

Watch the supervisor's own alarm and event log, and the temperature records, for defrosts outside the schedule, setpoint changes at night and logins from unknown addresses. A forced defrost across many cases at once in the middle of the night is the pattern from this attack.

Who owns the fridge controller

In most of the affected chains the refrigeration was bought through contractors, and the supervisor never appeared on the IT asset list. Coopérative U's CEO said his stores buy from contractors, not from Danfoss. Installed this way, a controller often gets a public IP for the installer, a password from the manual and no firmware updates for years. Put them in scope for the same inventory, exposure scanning and patch tracking as the rest of the network, and write remote access terms into the maintenance contract.

Our attack surface management work finds controllers and panels like these on your public IP ranges, and our safeguarding and hardening team can move contractor access behind a VPN without breaking monitoring. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: CERT-FR alert CERTFR-2026-ALE-012, The Hacker News, The Register, CSO Online, OCCRP, SOCRadar, Infosecurity Magazine, Security Affairs, iTWire on Claroty's research, Stars and Stripes, Korea Times (Reuters).