Supermarket Fridge Hack: Attackers Heated French Freezers to 50°C — and Started Fires

On the night of 11–12 October 2026, attackers took remote control of the refrigeration systems at hundreds of French supermarkets and did something unusually physical for a cyberattack: they turned the cold off. Fridges and freezers were forced into a continuous defrost cycle, with target temperatures set as high as 50°C (122°F).

The result was spoiled stock across chains including Intermarché, Netto, Carrefour, Monoprix, Coopérative U, Auchan and E.Leclerc — and, in some stores, equipment that caught fire.

France's cybersecurity agency ANSSI called for the affected controllers to be taken off the internet immediately. The Paris prosecutor's office has opened an inquiry. Two days on, nobody has claimed responsibility, and no one has publicly established how the attackers got in.

What happened

The attack ran overnight, when stores were closed and nobody was watching the cold aisle. French broadcaster BFMTV, which first reported it, said attackers remotely triggered forced defrosting across numerous stores.

CERT-FR, the French government's computer emergency response team, published an alert on 12 October stating it was aware of numerous compromises affecting two Danfoss controller families — the AK-SM and AK-SC series. Its instruction was blunt: disconnect these controllers, or tightly filter access to them. ANSSI's director, Vincent Strubel, described taking the two series off the internet as urgent.

Scale, by chain

Figures come from the retailers themselves, via AFP, Reuters and RTL. They count stores the attack reached — not stores that necessarily lost stock.

Losses are uneven and still being counted. Thierry Cotillard, who heads Les Mousquetaires, told BFMTV he expected losses in the tens of millions of euros across France, and said affected Intermarché stores had to discard all products concerned. Coopérative U's chief executive, Dominique Schelcher, deliberately tempered the picture on RTL: the cold chain held in most of his 80 affected stores, and only a minority could not react in time. He credited the speed of store staff and refrigeration contractors.

Both things are true at once. A store being compromised did not automatically mean a store losing its stock — it depended on who noticed, and how fast.

Beyond France

Félix Aimé, a senior threat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium were also affected. SecurityWeek additionally lists the Netherlands. Reuters published no detail on those cases, and the overwhelming majority of confirmed damage is French. ANSSI is coordinating with cybersecurity agencies in other European countries.

Internet scans found exposed Danfoss controllers well beyond Europe, including South Africa, the US and the UK. Exposure is not compromise — but it maps the potential blast radius.

How the attack works

The device in the middle

A supermarket's cold aisle is not a row of independent fridges. It is typically run by a single control panel that manages every refrigerated case and cold room in the building — setpoints, defrost schedules, alarms. These panels are reachable over the internet by design, so that maintenance contractors can adjust them without driving to the site.

That design decision is the heart of this incident. One compromised panel equals one store's entire cold chain.

What the attackers actually did

They didn't need malware on a till or a ransomware payload. They changed configuration — using the controller's own legitimate functions:

1. Forced defrost. Every freezer defrosts periodically; it's a normal maintenance cycle that briefly applies heat to clear ice. The attackers forced it continuously, turning a routine function into a heater.

2. Raised the setpoint to 50°C, so the system actively worked toward that temperature rather than returning to cold.

3. Suppressed the warning. This is the detail that shows intent. Le Monde reported that in some freezers and cold rooms, attackers extended the defrost cycle from one hour to eight — long enough that the system treated the heat as a legitimate ongoing cycle and did not raise an alarm. SecurityWeek reports temperatures rose for around six hours in some equipment before staff discovered the problem.

That third step is what turned a nuisance into tens of millions of euros of damage. The monitoring system did not fail; it was told the situation was normal.

The fires

Running refrigeration equipment in a sustained heating state is not something it is designed for. Reuters, ABC and CNBC all report that the attack sparked fires in some stores, and the Paris inquiry is specifically tasked with establishing the link between the attack and reported damage, including equipment that began to catch fire. This moves the incident out of "data breach" territory entirely: it is a cyberattack with a physical safety consequence.

Which controllers, and the end-of-life problem

Danfoss told AFP that most of the units hit were older products that no longer receive software or security updates, naming two:

For owners of the two older models, CERT-FR's standard advice to "apply all available security fixes" offers nothing, because there are none. Disconnection is the only real control available.

How they got in: still unknown

This needs stating plainly, because it is being widely glossed over:

• As of 13 October, CERT-FR had named no vulnerability, no firmware version and no entry point, and had published no indicators of compromise — so operators have no official signs to hunt for.

• A source close to French Prime Minister Sébastien Lecornu told AFP that ANSSI had identified a vulnerability in software supplied by a Danish company and contacted the vendor. No CVE was named, and the statement does not say that flaw was used in this attack.

• Danfoss's own security advisories page listed no advisory about the attack as of 13 October.

There is a tempting and plausible candidate. In August 2026, researchers at Claroty's Team82 published work on the newer AK-SM 800A describing three 2025 flaws — CVE-2025-41450 (an authentication bypass, i.e. a way past the login), CVE-2025-41451 (command injection that could lead to remote code execution) and CVE-2025-41452 (denial of service). They showed the flaws could be chained, and reported finding thousands of AK-SM 800A management interfaces reachable from the internet. Danfoss issued fixes.

But that research was laboratory work on the newer model, describes no real-world attacks, and does not cover the two older models that took most of the damage. Neither French authorities nor Danfoss has linked those CVEs to this attack. Treat the connection as unproven.

One historical note from Danfoss's own October 2025 newsletter: the AK-SM 800 was attacked before — 16 Russian supermarkets and 40 Israeli stores in 2022. All 40 Israeli stores lacked proper firewall or VPN protection.

Why it matters

This is an operational technology attack with a consumer-visible result. Most OT incidents are abstract to the public. This one emptied freezer aisles and put "Rayons surgelés fermés" signs on supermarket doors.

Three things make it significant beyond France:

1. The target was configuration, not data. There was nothing to encrypt and nothing to leak. Defences built around ransomware and exfiltration would not have fired.

2. The alarm was part of the attack surface. Extending the defrost window to avoid tripping alerts shows the attackers understood the equipment's logic, not just its network.

3. The exposure is structural, not exceptional. Thousands of these interfaces sit on the public internet because remote maintenance is the business model. Food retail runs on thin margins and long equipment lifecycles, and a controller installed in 2015 is still doing its job — which is precisely the problem.

Who is affected

• Food retailers across Europe running Danfoss AK-SM or AK-SC controllers — particularly the end-of-life AK-SM 800 and AK-SC 355.

• Franchise and independent operators, who are often the least equipped to respond. Coopérative U's stores do not buy from Danfoss directly; they are customers of refrigeration contractors who supply the system. The security relationship is mediated by a third party.

• Refrigeration and HVAC maintenance contractors, whose remote-access credentials and connectivity are now an obvious target.

• Any sector depending on controlled temperature: cold-chain logistics, food manufacturing, catering, hospitals and pharmacies storing vaccines and medicines, and data centre cooling. The equipment differs; the architecture does not.

• Consumers, through shuttered aisles, discarded stock and the costs that follow.

What attackers can do with this kind of access

• Destroy perishable inventory at scale, across many sites at once, overnight.

• Suppress or delay alarms so damage compounds before anyone reacts.

• Create physical hazards — overheating equipment, as the reported fires demonstrate.

• Extort. Nobody has claimed this attack, but the capability is an obvious ransom lever: a retailer facing a second night of losses has strong incentive to pay.

• Disrupt a food supply chain at a regional level, which is why this is being treated as a national security matter rather than a retail IT problem.

• Repeat. Where controllers remain exposed and unpatchable, nothing prevents a second pass.

What organisations should do

Immediate — CERT-FR's instruction

1. Disconnect every AK-SM and AK-SC controller from the internet, or tightly filter access. CERT-FR's alert states that exposing a management interface to the internet goes against good practice. Where remote administration is unavoidable, restricting access to trusted IP addresses is a first, temporary step only.

2. Where compromise is suspected, CERT-FR lists six steps in order: limit network access to service providers only; factory reset; apply all available security fixes; change device secrets such as passwords; review existing accounts; reconfigure the device completely. Note that step three is empty for the two end-of-life models.

3. For the AK-SM 800A, the latest package listed on 13 October was 5.3.x. A system on 3.x must move to 4.x first, and a controller cannot be downgraded once it runs 5.3.x. From version 4.0, a setting called Strict Session Control is enabled by default and makes HTTPS mandatory. Danfoss has not said whether 5.3.x was released in response to the attack.

Structural

4. Inventory your building-management and OT estate. Most organisations cannot currently answer "how many internet-reachable controllers do we own, and who maintains them?" That question is the whole lesson of this incident.

5. Replace end-of-life controllers. Danfoss said in October 2025 it would end all services for these older products and urged customers to plan replacements. That guidance is now a year old and considerably more urgent.

6. Put remote maintenance behind a single managed gateway — VPN or jump host with multi-factor authentication — rather than exposing device interfaces directly. Change default passwords at installation.

7. Segment OT from IT. A refrigeration controller has no business being reachable from the same network as the corporate estate, or from the open internet.

Detection and response

8. Alarm on the alarm. Monitor for configuration changes themselves — altered setpoints, extended defrost windows, modified alarm thresholds — not just temperature excursions. In this attack, the temperature alarm was deliberately engineered not to fire.

9. Set an independent temperature check. A monitoring path that does not run through the same controller (a separate sensor, or a simple out-of-band log) would have caught this in the first hour.

10. Brief night staff and contractors that unexplained defrost or equipment warmth may be deliberate, and give them an escalation route that does not depend on the controller agreeing there is a problem.

11. Treat it as potential evidence. The Paris inquiry is working to link the attack to reported damage. Preserve controller logs and configuration before factory-resetting, where you can.

For the wider market

12. Press your suppliers. France's retail federation, the FCD, has publicly called on Danfoss for full transparency. If your refrigeration is mediated by a contractor, ask which controller models you run, which firmware, whether any are end of life, and whether their interfaces are internet-facing.

Final thoughts / key lesson

The striking thing about this attack is how little of it was technically novel. No malware, no encryption, no stolen database. The attackers used a controller's own defrost function — a feature, working exactly as designed — and simply extended its timer so the alarm stayed quiet.

The lesson: in operational technology, the attacker's best tool is usually your own equipment's legitimate functionality, and your monitoring is part of the attack surface rather than a safeguard above it. A temperature alarm that can be silenced by changing a setting is not an independent control.

There is a second, less comfortable lesson about lifecycle. A large share of the damage landed on controllers the manufacturer stopped supporting in 2016 and 2021. Those devices did not become insecure in October 2026; they became unsupportable years earlier and stayed online anyway, because they were still doing their job and replacing them cost money. Every sector has equipment in that category.

Two actions follow regardless of whether you run Danfoss hardware: find out what of your operational equipment is reachable from the internet, and verify that something other than the device itself would tell you if it started misbehaving.

Finally, a word of caution on the reporting. The scale figures come from retailers counting their own stores, loss estimates vary widely between chains, and the entry point remains officially unknown. The Claroty vulnerabilities are a plausible lead, not an established cause. Expect this picture to change.