When the Freezers Turned Into Ovens: Inside the Danfoss Supermarket Attack in France

On the morning of Monday, 12 October 2026, store managers across France unlocked their supermarkets and walked into a wall of hot air. The freezer aisles, which should have been sitting at around −20 °C, were warm. One ice-cream freezer photographed by BFMTV read 26.5 °C. Intermarché said some of its units had been held at 50 °C for six hours overnight. In a few stores, equipment had started to burn.

Nobody had broken a window or touched a single fridge. Somewhere between Sunday evening and dawn, attackers had logged into the systems that manage store refrigeration and told every freezer to defrost, then stopped the defrost from ever ending.

Within hours, hundreds of stores belonging to Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc were throwing out fresh and frozen food. The Paris prosecutor's office opened a criminal investigation into what it called a "large-scale cyber-attack affecting the refrigerators of several major food retail chains across France."

This is a breakdown of what happened, how the attack worked, why it was possible, and what any organisation running connected building or industrial equipment should do about it.

At a glance

• When: Night of 11–12 October 2026
• Targets: Supermarket refrigeration controllers: mostly Danfoss, plus some Copeland/Dixell
• Systems: Danfoss AK-SM 800 and AK-SC 355 (end of life), AK-SM 800A on outdated firmware; Dixell/Copeland XWEB
• Technique: Remote takeover of the store system manager; defrost forced on and setpoints changed, apparently by automated tooling
• Impact: Roughly 350–500 stores in France; food discarded; small fires; losses expected in the tens of millions of euros
• Way in: Not confirmed publicly
• Attribution: None. No claim, no ransom demand (as of 14 October)

Who was hit

Exact numbers vary by source because each chain has reported its own figures, and those figures moved over the first 48 hours.

Reuters put the total at at least 350 French supermarkets, while figures supplied by the chains add up to around 400 of France's roughly 15,000. Threat intelligence firm Sekoia told Reuters that systems in Spain, Portugal, Poland, Germany and Belgium were also affected, though without details. A cyber incident at Ahold Delhaize that began the same Sunday evening has so far been described by Dutch authorities as unrelated.

The financial damage is still being counted. Two supermarkets in Haguenau, in Alsace, reported €270,000 in spoiled stock between them. Les Mousquetaires' CEO Thierry Cotillard said he expects losses in the tens of millions of euros across France.

How supermarket refrigeration is controlled

To understand the attack, it helps to know how a modern supermarket keeps its food cold.

Every refrigerated display case has its own small case controller. Those controllers are coordinated by a central system manager in the back office, which in many stores is a Danfoss unit: the AK-SC 355, the AK-SM 800, or its successor, the AK-SM 800A. The system manager sets temperatures, schedules defrost cycles, raises alarms and logs readings for food-safety records. It has a web console, which Danfoss calls StoreView, so that refrigeration contractors can monitor and adjust a store remotely instead of driving out for every alarm.

There is a regulatory reason these systems are connected, too: European rules require supermarkets to keep timestamped temperature records and alarms for abnormal temperature rises, and remote monitoring is the cheapest way to do that across hundreds of stores. That remote access is the convenience that made this attack possible.

Defrost is the key detail. Freezer coils build up ice, so several times a day the system briefly switches off cooling and warms the coils, usually with electric heaters, to melt it. A normal defrost lasts tens of minutes and the case is then pulled back down to temperature. It is a routine, legitimate function. The attackers did not need to break the refrigeration logic. They only needed to start the defrost and keep it running.

The attack path: an internet-exposed console leads to the store's system manager, which pushes a forced defrost to every case.

What the attackers did

According to BFMTV and the retailers, the attackers remotely triggered forced defrost cycles with temperatures programmed to reach as high as 50 °C, and kept the units in that state for hours. At one store near Bordeaux, Le Monde reported that freezer setpoints were changed from −22 °C to 150 °C, and a technician watched several settings change every second, a strong sign that the attack was scripted rather than done by hand. Because the system manager controls every case in the store at once, a single compromised device was enough to take out an entire store's cold chain.

The difference between a normal night and the attack night looks like this:

Illustrative profile based on reported figures. A scheduled defrost briefly lifts the case temperature and recovers. The forced defrost climbs past the −18 °C frozen-food limit within minutes and stays there.

Frozen food in the EU must be held at −18 °C or colder. Once a case climbs above that and stays there for hours, retailers cannot prove the cold chain held, so the stock has to go. That is why the damage was so large even where food was not visibly spoiled: Intermarché said it threw away everything in the affected units to avoid any health risk.

How did they get in?

This is the part that is not yet confirmed, and it is worth being precise about what is known and what is not.

Confirmed: most affected units were end-of-life AK-SM 800 (no updates since 2021) and AK-SC 355 (phased out in 2016) systems, or current AK-SM 800A units running outdated firmware. CERT-FR, France's national CERT, issued alert CERTFR-2026-ALE-012 on 12 October describing "numerous compromises" of Danfoss AK-SM and AK-SC series devices, and also listing Dixell/Copeland XWEB controllers as affected.

Not confirmed: the exact way in. Neither Danfoss, ANSSI nor prosecutors have said whether attackers used weak or default credentials, a known vulnerability, or a maintenance provider's access.

What we do know points strongly in one direction.

1. Thousands of consoles were sitting on the internet

These controllers are supposed to live on isolated networks. They often do not. Scans in the days around the attack found:

• 2,765 AK-SM 800A interfaces exposed online (Claroty, via Censys, August 2026)
• 2,752 Danfoss systems exposed, 1,590 of them in France (Predicta Lab, 12 October)
• 2,700+ StoreView systems, about 1,700 in France (Sekoia, via Censys)
• 4,500+ Danfoss interfaces visible on Shodan (Reuters, 13 October)

French scanning firm Onyphe noted that only a small minority of the exposed devices appeared to run the latest software. The scanners use different methods so the numbers are not directly comparable, but the pattern is consistent: thousands of management consoles reachable by anyone, concentrated in France.

2. The software had a long list of known, published flaws

None of these vulnerabilities has been officially linked to the attack. But they show how much was already public about these devices:

CVE-2025-41450 is the one to look at closely. Claroty's Team82 found that the AK-SM 800A accepted a hidden password derived from the date. In the days after the attack, comments circulated online claiming that the hacked systems used "admin" with the date as the password. That claim is unverified, and the end-of-life AK-SM 800 and AK-SC 355 were not part of Claroty's research. But if it turns out to be true, it would mean the attack required no exploit at all, just a login.

The French Prime Minister's office has said ANSSI identified a vulnerability in software from a Danish company and contacted the vendor, without naming a CVE.

It is also not a Danfoss-only problem. CERT-FR's alert lists Dixell XWEB controllers (Dixell is an Italian brand owned by the US company Copeland) alongside the Danfoss units, and France 3 reported that an E.Leclerc store in the Tarn region was disrupted while running Dixell equipment, not Danfoss. Copeland has acknowledged a vulnerability and said it is working with affected customers. The common factor is not one vendor, but management consoles reachable from the internet.

3. End-of-life means no fix exists

For the AK-SM 800 and AK-SC 355, there is nothing to patch. Danfoss stopped software and security updates years ago, and in October 2025 it told customers it was ending all services for older products and urged them to plan replacements. Every one of those units still in service, and still online, was a permanent open door.

End-of-life notices, patched vulnerabilities and published research that preceded the attack.

Why this attack is unusual

Most attacks on retailers are about money: ransomware, card theft, extortion. This one does not fit that pattern.

• No ransom and no claim. Investigators told Reuters they were puzzled, because criminal groups and hacktivists usually take credit or demand payment quickly. None has.
• Physical damage, not data theft. No records were reported stolen. The impact was entirely in the physical world: spoiled food, empty shelves, and fires.
• Not sophisticated, but deliberate. Ken Munro of Pen Test Partners called it a matter of basic cyber hygiene and suggested the attackers could even be amateurs exploiting well-known weaknesses. Claroty CTO Amir Preminger agreed it was not sophisticated, but stressed it was planned: "Somebody needed to guide the exploit, the campaign to have that impact." Settings changing several times per second across hundreds of stores in one night points to automation.
• Not the first time. Danfoss refrigeration systems were reportedly targeted in 16 Russian supermarkets and 40 Israeli stores in 2022, all without proper firewall or VPN protection.

That combination, low effort and high physical impact with no visible motive, is exactly why European Food Commissioner Christophe Hansen called it a sign that "the weaponisation of food has become a reality."

What defenders should do now

Immediate response (from CERT-FR)

CERT-FR's core instruction is simple: disconnect these controllers from the internet or filter access to them, urgently. If remote administration cannot be avoided, restrict it to trusted IP addresses only. For devices that may already be compromised, CERT-FR lists six steps, in order:

1. Limit network access to your service providers only.
2. Factory-reset the device.
3. Apply all available security fixes.
4. Change all secrets, including passwords.
5. Review existing user accounts.
6. Fully reconfigure the device.

For AK-SM 800A units, Danfoss's upgrade path runs from 3.x to 4.x before moving to 5.x, and from version 4.0 Strict Session Control is on by default, making HTTPS mandatory. For the end-of-life models, step 3 does nothing, because there are no fixes. Those units need to be isolated and replaced.

Find your exposure before someone else does

• Inventory every building and OT system that has a web interface: refrigeration, HVAC, building management, lighting, access control. These are often installed and maintained by contractors and never appear in the IT asset register.
• Check your own public IP ranges with the same tools attackers use (Shodan, Censys, or your attack-surface management platform). Claroty noted that exposed AK-SM 800A devices typically show the StoreView web console title, which makes them easy to spot.
• Ask your maintenance contractors exactly how they connect to your sites. A contractor's always-on remote access is often the weakest link.

Detection ideas for the SOC

Even without vendor indicators of compromise (CERT-FR had published none as of 13 October), there are signals worth monitoring:

• Inbound connections to controller management ports from any address that is not your maintenance provider. With proper filtering in place this should be zero.
• Logins and configuration changes outside maintenance windows, especially defrost commands or setpoint changes issued to many cases at once.
• Independent temperature monitoring. Use standalone wireless sensors that report through a separate path, not through the system manager. A compromised controller controls what it reports, so it should not be the only witness.
• Alarm silence. A store whose refrigeration alarms suddenly go quiet, or stop reaching the alarm mailbox, deserves a phone call.

A starting point for a firewall or SIEM rule, to adapt to your own log schema:

title:  Inbound access to refrigeration / BMS management interface from untrusted source
logic:  network connection
        WHERE destination IN <refrigeration_and_bms_controller_ips>
          AND destination_port IN (80, 443)
          AND source NOT IN <maintenance_provider_allowlist>
          AND direction = inbound
level:  high
note:   Any match is either a misconfigured firewall or an intrusion attempt.

Fix the lifecycle problem

The deeper lesson is about ownership. A supermarket freezer can run for fifteen years; its controller's software support ends long before that. Organisations need to:

• track end-of-support dates for operational equipment the same way they track them for servers and laptops;
• budget for replacing unsupported controllers, not just repairing them;
• design for graceful failure: local manual override, segmented networks, and the ability to isolate a site in minutes;
• put security requirements into maintenance contracts: named accounts, MFA, VPN-only access and logging.

Regulation has gaps here too. The EU's NIS2 directive covers food businesses in wholesale distribution and industrial production, but supermarkets themselves are largely outside its scope. This attack is a strong argument that the systems keeping a country's food cold deserve the same scrutiny as the systems keeping its lights on.

The takeaway

The French freezer attack was not a clever piece of malware. It was the predictable result of old, unsupported controllers left on the internet for years, with known flaws, published research and repeated end-of-life warnings all ignored. Attackers used a legitimate maintenance function, the defrost cycle, to turn the cold chain against itself.

Anything connected to the internet and capable of changing the physical world needs to be treated as critical infrastructure, because, as hundreds of French supermarket managers found out on a Monday morning, it is.

The investigation is ongoing. This article reflects public information as of 14 October 2026 and will be updated as the access method and attribution become clearer.

Sources

• BBC News: French supermarket fridges and freezers hit by cyber-attack
• Infosecurity Magazine: Major French supermarket chains hit by cyber-attack
• Infosecurity Magazine: French supermarket cyber-attack impacts more refrigeration controllers
• The Hacker News: Attackers heat French supermarket fridges up to 50°C by hijacking Danfoss controllers
• BleepingComputer: Cyberattack shuts down refrigerators at French supermarkets
• Reuters via Rappler: Investigators hunt French supermarket fridge hackers, no claim of responsibility
• Cooling Post: Danfoss moves to mitigate cyberattack
• FoodNavigator: French supermarket fridges hit by cyber attack
• ANSSI / CERT-FR alert on Danfoss AK-SM and AK-SC series
• Claroty Team82: Freeze the controller, defrost the food
• DIVD: CVE-2023-25915
• Danfoss security advisories