Attack on French supermarket fridges hit outdated Danfoss controllers

Many of the refrigeration controllers hijacked in the attack on French supermarkets were end-of-life units that Danfoss no longer patches, the Danish manufacturer said on Monday. Others in the affected pool still ran old firmware, according to the company.

Investigators were still hunting the culprits on Tuesday, and neither a hacktivist collective nor a ransomware crew has taken credit. A person familiar with the inquiry found that silence puzzling, since such groups typically rush to profit from a hack or to claim it for political reasons.

Overnight from Oct. 11 into Oct. 12, attackers drove fridge and freezer temperatures up to 50 degrees Celsius (122 degrees Fahrenheit). Food spoiled and fires broke out at several stores. Upward of 350 supermarkets were affected, a small portion of all the stores operating in France.

Paris prosecutors described a widespread assault on connected refrigeration at several large grocery chains nationwide. Prime Minister Sebastien Lecornu directed ANSSI, France’s National Cybersecurity Agency, to look into the incident, and a member of his staff said the agency had pinpointed a flaw in Danfoss-made software.

CERT-FR, the incident response team inside ANSSI, published an alert on Oct. 12 reporting numerous compromised units from the Danfoss AK-SM and AK-SC product lines. Putting a management console on the open internet breaks with good practice, the bulletin warned, and it told operators to disconnect those devices or tightly filter who can reach them.

ANSSI said it is assisting possible victims in France and working with partner agencies elsewhere in Europe. Authorities are also reviewing which other French firms could face the same risk, the prime minister’s office added.

In a statement, Danfoss acknowledged problems with a small number of its refrigeration management systems in France. For years, the company explained, it has advised customers to keep supported equipment on current firmware and to swap legacy units for current-generation products. Asked again on Tuesday, Danfoss declined to elaborate.

Carrefour counted 80 affected supermarkets. Les Mousquetaires, the group behind Intermarche, put its figure at about 150 stores, where fridge temperatures reached 50 C and stayed there for six hours. Monoprix, with roughly 490 locations in France, reported that 5% of its network was hit.

Cooperative U confirmed it was among the targets but gave no store count. Dominique Schelcher, the group’s chief executive, wrote on X that going after equipment vital to preserving fresh produce and feeding the French public was “of extreme gravity and is unprecedented.” E.Leclerc and Auchan did not reply to requests for comment.

Every item from the affected units went into the trash to rule out health hazards, a Les Mousquetaires spokesperson told reporters. Geert de Clercq, who lives in Paris, saw employees at an Intermarche in the heart of the city tip cartloads of thawed frozen goods into a large bin as melted ice cream ran onto the street.

Losses at Les Mousquetaires, which also runs the Netto chain, could climb to several million euros, the group estimated. Thierry Cotillard, Intermarche’s chief executive, put the countrywide bill at tens of millions of euros for a single day during a television interview. Industry-wide figures have not yet been released.

Public warnings about Danfoss controller flaws predate the attack. On Aug. 9, Claroty’s Team82 researchers published findings on the AK-SM 800A. They described a hidden daily login code capable of bypassing normal authentication and a command injection bug that opens the door to remote code execution.

Fixes were already available, since firmware R4.3.1 addresses the issues and a Danfoss security advisory covering two of the flaws dates to Aug. 1, 2025. Danfoss named the older AK-SM 800 and AK-SC 355 models among the affected equipment, and the CERT-FR alert did not tie the attack to any specific vulnerability.

How the intruders got in has not been made public. Store cold aisles usually answer to a single control panel that oversees refrigeration across the site and is reachable online, so maintenance contractors can change settings from anywhere.

Three cybersecurity specialists judged the attack easy to carry out. Each indication points toward a simple stunt made possible by skipped Danfoss updates and by device interfaces exposed online, they said.

Ken Munro, a partner at British security firm Pen Test Partners, framed the incident as a question of basic cyber hygiene. “Get it wrong and you get a smelly mess of defrosted food,” he warned. Because the flaws were so well documented, the attackers met little resistance, Munro argued, and the culprits could easily be youngsters fooling around.

Munro also doubted that a nation-state was involved. Plenty of other countries have fridges connected to the internet, he pointed out, so a state actor would have little reason to strike only a portion of French units. Skipping any ransom or demand, in his reading, suggests the attackers did not grasp the commercial losses facing store owners.

Felix Aime, a senior threat intelligence analyst at Sekoia, reported that Spain, Portugal, Poland, Germany and Belgium were affected as well. Christel Delberghe, director general of European retail association Eurocommerce, said the incident “underlines the importance of resilience across the entire supply chain.”