TL;DR - Overnight on Sunday 11 October, attackers forced refrigeration systems into defrost cycles at 250 to 350 French supermarkets, including Intermarché, Carrefour Market, Monoprix, Leclerc, and Super U. Fridge temperatures hit 50°C, one Normandy store reported 80°C, food was dumped, and France's cyber agency has confirmed compromises of Danfoss refrigeration controllers, most of them legacy AK-SM 800 and AK-SC 355 units that reached end of life years ago and receive no security updates. Nobody has confirmed how attackers got in, and that is exactly why this matters to you: the vendor's own checklist, change the default password, keep it off the internet, keep it patched, is the checklist that was not followed, and two of those three items are impossible on end-of-life gear. Every business has its own version of that fridge. What you need to do: inventory the gear nobody patches, classify it as patched, EOL-but-isolated, or EOL-and-exposed, pull anything in that third column off the internet, and ask who else can reach it remotely.
By The Numbers
| Item | Value |
|---|---|
| Supermarkets affected | 250 to 350 across six chains (BFM TV) |
| Peak fridge temperatures | 50°C forced defrost, 80°C at one Normandy store |
| Defrost cycle stretched from | 1 hour to 8 hours (Le Monde) to delay alarms |
| Internet-exposed Danfoss controllers | 4,500+ as of 12 October, more than half in France |
| France's share of the world's exposed controllers | Nearly 60% (internet scans reported by TIME) |
| Controllers named as end of life | AK-SM 800 (EOL May 2021) and AK-SC 355 (phased out 2016) |
| Prior flaws on the platform | 2, CVE-2025-41450 and CVE-2025-41451, patched August 2025 |
| Confirmed entry point | None, investigation ongoing |
I read the first report of the French fridge attack on Monday morning at the kitchen bench, and I did the thing I always tell you not to do: I checked whether it could happen here before I understood what actually happened there.
Here is what actually happened there. Attackers did not steal card data, did not encrypt a file server, did not leave a ransom note. They spent Sunday night remotely forcing the refrigeration into defrost cycles at hundreds of supermarkets, then left. Fridges and freezers that exist to hold food at 2°C climbed to 50°C. At one Intermarché in La Haye, Normandy, temperatures reportedly reached 80°C, hot enough that equipment started to melt. Staff arrived to dumpsters of ruined stock.
By Monday, France's national cyber agency, ANSSI, had published an alert confirming numerous compromises of Danfoss refrigeration controllers. The Paris prosecutor's office opened an investigation the same day. French media reported between 250 and 350 stores affected, and investigators told TIME the attack may have sparked equipment fires at some sites.
Then came the sentence that made me put my coffee down. Danfoss told reporters that most of the affected units were legacy products, the AK-SM 800 and the AK-SC 355, which reached end of life in 2021 and 2016 respectively and no longer receive software or security updates at all.
That is the part that has nothing to do with French supermarkets. Every organisation I have ever audited owns a version of that fridge: a vendor appliance that quietly passed its end-of-life date, still humming away, still on the network, invisible because it just works. Nobody patches it because there is nothing to patch it with. Nobody replaces it because replacing it costs money and it has not caused a problem yet.
Now the problem has a news cycle, a prosecutor, and 50°C shelf temperatures.
Let me walk you through what happened, why end-of-life gear turns a burglary into an arson, and the four-step audit that finds your version of that fridge before somebody else does.
What actually happened in France
The attack started overnight on Sunday 11 October, from around midnight. The attackers did not quietly nudge setpoints up by two degrees and hope nobody noticed. They triggered forced defrost cycles, the industrial version of the melt cycle your freezer runs once a blue moon, across entire store fleets.
Le Monde reported that in some freezers and cold rooms the defrost cycle was extended from one hour to eight hours, which pushed the alarms that would normally fire well past the point where anyone was awake to hear them. That is not a smash-and-grab. That is someone who understood how the equipment behaves and used its own maintenance functions against it.
The scale, per the retailers themselves:
- Les Mousquetaires (Intermarché and Netto) told TIME around 180 of its supermarkets were targeted; BFM TV reported a higher count of up to 300. It said damage could amount to several million euros.
- Carrefour confirmed around 80 stores.
- Monoprix said roughly 5% of its 490 stores were hit.
- Coopérative U reported at least 100 stores, with several E.Leclerc outlets also affected.
Two supermarkets in Alsace reported combined losses of 270,000 euros. One retailer described nationwide losses in the tens of millions of euros in a single day. Staff posted photos of entire cabinets of chilled food going into skips.
ANSSI's alert, published by its CERT-FR arm on 12 October as CERTFR-2026-ALE-012, is the document I would actually read. It confirmed numerous compromises of Danfoss AK-SM and AK-SC series remote refrigeration controllers. ANSSI's head, Vincent Strubel, called it urgent to take those controllers off the internet or filter access to them very tightly. And in an update that shows this story is still moving, the alert's current version (last revised 16 October) also names Copeland xweb and Dixell xweb controllers, two more refrigeration control families. The blast radius is not one vendor's product line. It is a category.
Reuters, citing a cyber threat intelligence analyst, reported that Spain, Portugal, Poland, Germany, and Belgium were also affected. As for who did it and why: nobody knows. The prosecutor's investigation is ongoing, and neither French authorities nor Danfoss has said how the attackers got in.
The panel that runs every fridge in the store
Here is the detail most people skimmed past, and it is the detail that matters.
Supermarkets do not have a thermostat on each fridge. They have a central control panel, a controller about the size of a small switchboard, that runs every cabinet and cold room in the building: defrost schedules, alarm thresholds, temperature setpoints, compressor staging. The Danfoss AK-SM and AK-SC series are exactly this kind of kit. It is good equipment. It has run food retail cold chains for decades.
Many of those panels are connected to the internet so that refrigeration maintenance companies can remote in. That is not stupidity, it is economics. If a cabinet starts drifting warm at 6 a.m. on a Saturday, the contractor wants to look at the controller from their desk in Lyon before they dispatch a van. TIME reported that many control panels are connected for exactly this reason, and French government guidance now says flatly that exposing a management interface to the internet is contrary to best practice.
The internet noticed. Shodan scans showed more than 4,500 internet-exposed Danfoss controller endpoints as of Monday 12 October, more than half of them in France, nearly 60% of the world's total. A French researcher counted 2,752 exposed systems on his own scan, 1,590 of them in France. Four and a half thousand of the boxes that decide whether food is cold were reachable by anyone with a browser.
And when Intermarché was asked what happened, its spokesperson told BleepingComputer the attack affected "a service provider that manages refrigeration systems in stores". Keep that phrase in your pocket. We will come back to it.
End of life is a vendor date, not a defence
Danfoss's statement to reporters deserves to be read slowly. Most of the units hit were older products, the AK-SM 800 and the AK-SC 355. The AK-SM 800 was declared end of life in May 2021. The AK-SC 355 was phased out in 2016. Neither receives software or security updates any more. Danfoss told its customers in an October 2025 newsletter that it was ending all services for these older products and urged them to plan replacements.
The current-generation AK-SM 800A was hit too, and Danfoss said those units were running outdated firmware.
There is history here. In August 2025, Claroty's Team82 research team published a piece with the best title of the year: "Freeze the Controller, Defrost the Food". They found a hidden authentication mechanism in the AK-SM 800A that accepted a code generated from the device's current date, letting anyone who reproduced the algorithm bypass the configured administrator password entirely. CISA had separately warned in May 2025 about an authentication bypass (CVE-2025-41450) and in August 2025 about a command injection flaw (CVE-2025-41451) in the same platform. Danfoss patched these in August 2025 firmware.
So, did the attackers use the date-code bypass, the command injection, a default password, or something else entirely? Nobody has said. CERT-FR named no vulnerability, no firmware version, and no entry point as of 13 October, and I am not going to pretend otherwise. Attribution and method are unconfirmed. If you read a headline telling you exactly how they got in, treat it as speculation.
But step back from the unknowns and look at the shape of the thing. Danfoss's own security guidance, published in French on its site, tells operators three things: keep controllers unreachable from the internet, change default passwords when a system is installed, and require remote users to come through a single managed entry point.
That checklist was published by the vendor in advance. And on end-of-life gear, two of its three items are impossible: there are no more patches to apply, and the firmware that shipped is the firmware you have forever.
This is why I keep saying end of life is a date on the vendor's calendar, not a defence. When a vendor EOLs a device, nothing visible happens. The lights stay green. The cabinet stays cold. The audit passes because the device responds. What actually happened is that the device entered a state where every vulnerability discovered from that day forward is permanent. The AK-SM 800 has been permanently vulnerable to whatever the next Claroty finds since May 2021. This week somebody demonstrated the market price of that condition across 250 to 350 stores.
Find the fridges: the unpatchable gear audit
Right. The part you can use. Every network I have ever looked at has gear that nobody has patched in years, and the reason is always the same: it works, it is fiddly to update, and it has no owner. Here is the audit. It takes one afternoon for a small network.
Step 1: find the fridges. You are looking for anything on the network that runs its own firmware and has never appeared in a patch report. In most Australian businesses the usual suspects are: printers and multifunction devices, IP cameras and video recorders, building management and HVAC controllers, door access control, refrigeration and cold storage (yes, even here; cafes, pharmacies, and medical practices all have it), NAS boxes, phone systems, and that one server in the comms room nobody can identify. Your fridge may not chill food. It may print payslips.
Pull the list from DHCP leases, switch MAC tables, and firewall rules rather than from the asset register, because the asset register is where optimism lives. Anything you cannot name goes on the list as "unknown" and becomes the top priority.
Step 2: classify every item into one of three columns.
| Column | What it means | What it deserves |
|---|---|---|
| Still patched | Vendor support active, firmware current | Normal patch cadence, nothing to see |
| EOL but isolated | No updates, but no route from the internet or user networks | Verify the isolation is real, then monitor |
| EOL and exposed | No updates AND reachable, directly or via a vendor's remote access | This is the fire. Act this week |
Most inventories will surprise you in column three. It is rarely the server room; it is the air conditioner controller with a 4G dongle the installer added in 2019 "for monitoring".
Step 3: treat by column. Still patched: keep going. EOL but isolated: confirm it with firewall rules you have actually read, put it on its own VLAN, and alert on any traffic leaving it. EOL and exposed: isolate now (VLAN, firewall rules, no inbound internet, VPN or trusted-IP filtering for the contractor if they must reach it), rotate its credentials, and get a replacement budgeted. And be honest about the last one: end of life plus exposed plus business-critical or life-safety means replace, budget be damned. An unpatchable device guarding cold chain, access control, or fire systems is not a risk you monitor. It is a risk you retire.
CERT-FR's alert says this better than I can. Keeping an internet-exposed device that no longer receives security patches online, the agency warned, exposes it to a very high probability of compromise, and a factory reset alone is not sufficient to fix a compromised unit, because the device remains vulnerable the moment it comes back.
Step 4: write the EOL dates down. For every device, record vendor, model, firmware version, and end-of-support date, and put the dates in the same calendar as your certificate renewals. Vendors publish end-of-life dates years ahead. The AK-SM 800's EOL was announced, in writing, four years before this attack. A scheduled failure you can see coming is a budget line. The same failure discovered on a Monday morning is a disaster.
Who else can reach your fridges? The maintenance-provider path
Now back to that Intermarché quote: the attack affected "a service provider that manages refrigeration systems in stores". The most likely way into hundreds of buildings at once is not hundreds of break-ins. It is one shared path that reaches all of them.
Here is the part of this story I find most instructive. Coopérative U's stores do not buy directly from Danfoss at all. A company representative told reporters they are customers of refrigeration contractors who supply and run the systems. So the vendor relationship that mattered was not retailer-to-vendor. It was retailer-to-contractor, and the contractor's remote access tooling became part of the attack surface of every store they service. Even Coopérative U, which reported at least 100 affected stores, had to work out its exposure through its suppliers.
Ask the same questions about your building. Who else can reach your devices remotely, and through what?
- Does your HVAC, refrigeration, alarm, or printer vendor have remote access accounts on your network? Named how many?
- How do they connect: a proper VPN, a cloud relay service the vendor operates, or a port forward someone's apprentice set up in 2019?
- Can they reach those devices from anywhere in the world, or only from their office ranges? If only from known ranges, can your firewall filter those source IPs today?
- What happens to their access when the contract ends? Is that written down anywhere?
- If you cut the remote link tonight, do you break a monitoring service your insurance or service agreement depends on? CERT-FR's alert includes a line I did not expect: check your insurance conditions before cutting the data feed back to the refrigeration contractor. The most boring line in the whole alert, and the one that gets missed at 11 p.m. during an incident.
Third-party remote access is not a footnote to your attack surface. For appliance-class devices, it frequently is the attack surface. The badge you issue your contractor should be as visible, as scoped, and as revocable as the ones you issue staff.
Why this could be good
I try to find the optimistic read in these stories, and this one has a genuine one: the fix list here is configuration, not capital.
Most of the damage-reducing actions CERT-FR and ANSSI recommend cost almost nothing. Take management interfaces off the internet. Filter remote access to trusted source IPs or a VPN. Change default passwords at install. Verify defrost schedules have not been tampered with. None of that requires new hardware, and for most sites it is an hour of a contractor's time. The stores that had done those things, and plenty had, watched this news cycle from the sidelines.
The exposure problem is also observable and therefore fixable. Unlike most risk stories, you can look this one up: search engines like Shodan index these controllers, so you can confirm your own exposure from outside your network the same way an attacker would. There are few security questions you can answer that definitively on a Tuesday afternoon.
And the institutional response was fast and concrete. An agency alert with named product families and step-by-step remediation inside a day, a prosecutor's investigation, and a vendor at least stating plainly which of its products are EOL and why that matters. Food retail is now being treated as infrastructure that can hurt people when it fails, because it is. That reframing will drive better defaults from vendors and contractors alike, the same way the clean-tech and medical device markets moved once regulators paid attention.
The uncomfortable version is better too: four and a half thousand exposed controllers were counted on Monday, and by Tuesday several thousand operators had a written, sourced, step-by-step list of exactly what to do about theirs. How many other categories of unpatchable gear in your building have never had that moment of clarity? This week gave you a rehearsal.
What to do right now
- Ask your contractors the direct question this week. Refrigeration, HVAC, alarms, access control, printers: is any of our kit a Danfoss AK-SM or AK-SC, a Copeland xweb, or a Dixell xweb? Who holds admin accounts, and how do they connect?
- Check internet exposure. Review inbound firewall rules for anything appliance-class, and run an external scan (Shodan, Censys) for your public IP ranges. If a controller's admin page is reachable from the internet, that is the finding; everything else is commentary.
- Classify what you find into still patched, EOL but isolated, and EOL and exposed. One afternoon. The third column is your work list.
- Pull EOL-and-exposed devices off the internet now. Remove the port forward, apply trusted-IP or VPN-only access, and rotate every credential on the device. CERT-FR says source-IP filtering is an acceptable emergency stopgap, not a permanent home.
- If you suspect compromise, follow CERT-FR's steps: remove internet exposure, factory reset and fully reconfigure the unit, apply the latest firmware, set the security mode to Strict if it is a Danfoss, confirm default passwords were changed, and check the configuration, including defrost schedules, for tampering. Note the CERT-FR warning: on EOL gear a reset alone is not enough, because the device stays vulnerable.
- Log the EOL dates and budget the replacements. End-of-life dates are published years ahead. Gear in the third column gets a replacement line in next quarter's budget, not next year's someday.
- Put contractor access in writing. Named accounts, connection method, allowed source IPs, and what happens at contract end. If your contractor cannot answer those four questions, that answer is your real audit finding.
Key Takeaways
- Attackers forced defrost cycles at 250 to 350 French supermarkets overnight on 11 October, pushing fridges to 50°C and one Normandy store to 80°C. Food was discarded and some equipment reportedly caught fire.
- CERT-FR confirmed compromises of Danfoss AK-SM and AK-SC controllers, and its alert now also names Copeland xweb and Dixell xweb. This is a device category problem, not a single vendor problem.
- Most affected units were end-of-life Danfoss models, the AK-SM 800 (EOL May 2021) and AK-SC 355 (phased out 2016), which receive no security updates at all. Current-gen AK-SM 800A units were hit too, running outdated firmware.
- The entry point is unconfirmed. No CVE, no method, no attribution has been established. Treat confident claims, including about default passwords, as speculation.
- The vendor's own checklist predates the attack: keep controllers off the internet, change default passwords at install, one managed entry point for remote access. Two of those three are impossible on EOL gear.
- 4,500+ controllers were internet-exposed when this broke, more than half in France. Exposure this visible is also exposure you can find and fix yourself.
- Third-party remote access is part of your attack surface. Coopérative U's affected stores bought through contractors, not from the vendor directly. Ask who else can reach your devices.
FAQ
Were any Australian supermarkets affected?
No Australian stores have been reported as affected; the confirmed impact is France plus possibly nearby European countries. But internet scans found exposed Danfoss controllers in South Africa, the US, the UK, and other countries, so the category exists everywhere. The 10-minute check is to ask your refrigeration contractor what controllers you run and whether any have internet-facing access.
Did the attackers use default passwords?
Nobody knows. No entry point has been confirmed by French authorities or Danfoss, and CERT-FR named no vulnerability as of 13 October. Default password hygiene is genuinely part of Danfoss's own published guidance, so the lesson stands, but claiming it as the method would be guessing.
Which Danfoss controllers are affected?
CERT-FR's alert names the Danfoss AK-SM and AK-SC series, and its current revision also lists Copeland xweb and Dixell xweb controllers. Danfoss said most affected units were the legacy AK-SM 800 and AK-SC 355, both end of life, with some current AK-SM 800A units hit while running outdated firmware.
Were the 2025 vulnerabilities used in this attack?
Unconfirmed. Claroty's Team82 disclosed a hidden date-code authentication bypass in the AK-SM 800A in August 2025, and CISA separately flagged CVE-2025-41450 and CVE-2025-41451. Danfoss patched those in August 2025 firmware. No investigator has said whether any of them played a role here.
How do I check whether my business has exposed controllers?
Start with your firewall's inbound rules for anything that is not a server or workstation, then ask each contractor how they access your equipment remotely. An external scan service such as Shodan or Censys will show you what the internet can see on your public ranges. Anything appliance-class with an open management port is a finding.
My gear is end of life but it works perfectly. Do I really need to replace it?
It depends on the third column. EOL and fully isolated with monitored firewall rules can be managed risk. EOL and exposed is the combination CERT-FR warns carries a very high probability of compromise, and where a factory reset does not fix anything. If it guards cold chain, access, fire, or anything life-safety, replace it. Budget be damned.
My Take
The phrase I keep coming back to is "it just works", because it is the sentence every one of those 4,500 exposed controllers heard for years. It just works is not a security assessment. It is the sound of a risk nobody has priced.
What gets me about this incident is that none of it required a prediction. The EOL dates were published years ago. The vulnerabilities were disclosed and patched over a year ago for current-gen gear. The vendor's checklist was public. The controllers were countable on a public scan engine. This was a scheduled failure that arrived on schedule, and the only surprise was the creativity of the sabotage: using the machines' own defrost cycles, stretched from one hour to eight, to cook the food they existed to protect.
Food retail just joined hospitals and water utilities in the category of stuff where a cyberattack produces a physical mess you have to mop up. That changes the regulatory weather, and I would rather businesses in that category move before the regulators write the deadlines for them.
So here is the whole post in one line: the fridge was never the problem, the unreachable-to-you, reachable-by-everyone management interface was. Find your fridges this week. One afternoon, one spreadsheet, three columns. You will find something; everyone does.
Mathew Clark Founder, SecureInSeconds Currently: checking whether my own air conditioner has a 4G dongle and being afraid to look Drafted with AI assistance - read, verified, and fixed by a human.
Further Reading
- The Register: Cyberattacks crank French supermarket refrigeration systems up to 50°C - the write-up I would start with; it has the retailer-by-retailer counts and the Claroty history
- BleepingComputer: Cyberattack shuts down refrigerators at French supermarkets - first-day coverage, including the Intermarché service-provider statement
- The Register: Cyberattacks crank French supermarket refrigeration systems up to 50°C - the Normandy 80°C store report, the CERT-FR alert, and the Reuters reporting on other affected countries
- CERT-FR alert CERTFR-2026-ALE-012 - ANSSI's live advisory, updated as more controller families were confirmed; the remediation steps are concrete
- Claroty Team82: Freeze the Controller, Defrost the Food - the August 2025 research on the AK-SM 800A's hidden date-code authentication
- Danfoss cybersecurity best practices (published in French) - the vendor's own checklist: controllers off the internet, default passwords changed at install, one managed entry point
- Cooling Post: Danfoss moves to mitigate cyberattack - the trade publication Danfoss briefed directly on firmware status for current-gen units
- Papercut NG zero day: the MSP checklist - the same pattern, print servers instead of fridges: vendor appliance, contractor remote access, fleet-wide blast radius
- FortiMail CVE-2026-104286: a 9.8 on the appliance you never revisit - why appliances drift out of patch currency and how to catch it
