Skip to content
Hacker Posts

Danfoss controllers hijacked in French supermarket fridge attack

Attackers remotely forced defrost cycles on Danfoss refrigeration controllers at roughly 300 French supermarkets overnight Oct 11–12. Paris prosecutors and ANSSI are investigating.

Published 4 min read
cvedanfossicsretail

Overnight on Sunday, October 11 into Monday, October 12, attackers remotely triggered the automatic defrost function on Danfoss refrigeration controllers at hundreds of French supermarkets, raising case temperatures and spoiling fresh and frozen food. The Paris prosecutor's office has opened an investigation, and France's cyber agency ANSSI says it is mobilised to handle the incident nationally and coordinate at the European level. No vendor advisory or CVE has been tied to this attack; this post is based on reporting at BleepingComputer and The Record, plus CISA's 2025 advisory on Danfoss controllers.

What happened

Rather than disabling cooling outright, the attackers abused a legitimate feature: the controllers' built-in automatic defrost cycle. Forcing that cycle on raised temperatures across refrigerated and frozen cases. Because the manipulation rides a normal control function, staff may not see an obvious fault until product is already warm.

Affected chains

Store counts are early and reported by French outlets rather than confirmed by each chain:

  • Groupement Les Mousquetaires (Intermarché, Netto): The Record, citing BFMTV, puts this at about 300 stores.
  • Coopérative U (Super U): "fewer than 100" stores; CEO Dominique Schelcher called the attack "unacceptable."
  • BleepingComputer additionally names Carrefour Market, Monoprix, and Leclerc among affected banners. French reporting puts the overall total in the 250–350 store range, which BleepingComputer did not independently confirm.

How these controllers are exposed

The vector in this specific attack is not confirmed — BleepingComputer states no information is available on how the controllers were compromised. What is documented is that this device class is widely internet-reachable and has a public exploitation history:

  • Industrial-security firm Claroty's Team82 demonstrated remote code execution on publicly accessible management interfaces of the AK-SM 800A platform, and showed a compromised controller could switch off cooling while still reporting normal temperatures to staff.
  • CISA flagged Danfoss controller vulnerabilities in 2025, including CVE-2025-41450 (authentication bypass) and CVE-2025-41451 (command injection).
  • Researchers at Predicta Lab counted 2,752 Danfoss systems exposed online, 1,590 of them in France; Shodan tracks over 4,500 reachable Danfoss devices. Reporting indicates the hijacked units ran older control software.

Treat the 2025 CVEs as precedent and plausible surface, not as a confirmed root cause for this incident.

Attribution

No group has claimed responsibility, and neither reporting outlet names an actor. Danfoss was not immediately available for comment and has not publicly confirmed it was the target. Separately, retailer Ahold Delhaize took systems offline on Monday; there is no evidence the two events are connected.

Action checklist

If you operate Danfoss AK-SM/AK-SC refrigeration controllers, or any OT that drives a physical process:

  1. Pull every Danfoss controller off the public internet. No direct exposure of management interfaces; reach them only through a VPN into a segmented OT network.
  2. Inventory models and firmware (AK-SM 800/800A, AK-SC series) and identify end-of-life units that can no longer be patched; isolate those behind a jump host.
  3. Patch to supported firmware and apply the fixes referenced in CISA's 2025 Danfoss advisory.
  4. Alert on anomalous setpoints and commands — forced defrost, out-of-range temperature targets — and log remote control actions so manipulation is visible before product warms.
  5. Keep an out-of-band temperature check and a spoilage fallback plan, so loss of controller trust does not mean loss of the cold chain.

Context

This is a destructive OT attack with no data theft and a direct physical cost, and it fits a known pattern: cheap-to-reach, often end-of-life industrial controllers sitting on the public internet in front of an expensive process. The exposure numbers were published well before Sunday — the devices and their internet-facing posture did not change; an attacker simply used them. Until the vector is confirmed, the defensible assumption for anyone running this gear is that a reachable refrigeration controller is a controllable one.

Related stories