Hackers defrost refrigerators at hundreds of French supermarkets via Danfoss systems

Attackers tampered with refrigeration systems at hundreds of French supermarkets overnight from Sunday, October 11, to Monday, October 12, forcing stores to throw away fresh and frozen food. According to reports by BleepingComputer, L'essentiel and Swiss broadcaster RTS, the attack targeted refrigeration controllers made by Danish manufacturer Danfoss, and the Paris prosecutor's office has opened an investigation into what it called a "large-scale cyberattack."

What happened

Citing a source close to the case, L'essentiel reports that Danfoss refrigeration control systems were targeted. BleepingComputer and French broadcaster BFMTV, as cited by L'essentiel, say the attackers hijacked controllers running older Danfoss software and raised temperatures by remotely triggering the units' built-in defrost function on refrigerators, freezers and cold rooms. How the attackers gained access has not been disclosed, and no group has claimed responsibility.

Retailers confirmed the scale to AFP, according to L'essentiel: at least 300 Intermarché and Netto outlets, fewer than 100 Coopérative U stores, around 30 Monoprix stores and "several" E.Leclerc stores. A specialist trade site also reported that Carrefour Market was affected, though this was not officially confirmed. L'essentiel says no data was stolen.

Coopérative U chief executive Dominique Schelcher described the attack on X as "extremely serious" and unprecedented, saying his teams were working with refrigeration technicians. Intermarché said affected stores had to discard fresh and frozen products and that insurance does not cover this type of in-store incident. E.Leclerc said a cyberattack had hit one of its refrigeration equipment suppliers. EU agriculture commissioner Christophe Hansen condemned the attack, BleepingComputer reports.

Technical details

Danfoss said most of the affected units are older products, including AK-SM800 and AK-SC355 system managers as well as AK-SM800A units running outdated firmware, which have reached end of life and no longer receive software or security updates, according to L'essentiel. RTS reports that France's national cybersecurity agency ANSSI identified "a vulnerability in software supplied by a Danish company," contacted the vendor and is working with European counterparts to find and alert other exposed French companies.

BleepingComputer points to a May 2025 CISA advisory on CVE-2025-41450, a high-severity authentication bypass in the Danfoss AK-SM 8xxA series, but stresses that there is no confirmation this flaw was used. RTS separately notes that Danfoss disclosed a flaw on September 18 that gave attackers read and write access to internal values.

What to do

The Paris prosecutor's office has assigned the case to France's anti-cybercrime office to identify victims and link the attack to reported food losses and fires. Operators of refrigeration and building management systems should take the incident as a warning:

• Remove refrigeration controllers and system managers from direct internet exposure and place them behind VPN or segmented networks.
• Identify end-of-life Danfoss AK-SM800 and AK-SC355 devices and plan replacement; apply the latest firmware on supported models.
• Change default credentials, restrict remote access to maintenance providers and monitor for unexpected setpoint or defrost changes.