Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said.
The attackers reached them through the controller that runs all of a store’s fridges and freezers, a device made by Danish company Danfoss that maintenance firms can manage remotely. Les Mousquetaires, which owns the Intermarché chain, said its fridges and freezers were put into defrost and heated to as much as 50°C.
CERT-FR, the French government’s computer emergency response team, said in an alert published in French on October 12 that it is aware of numerous compromises affecting two Danfoss controller series, the AK-SM and the AK-SC. It told operators to disconnect the controllers or filter access to them.
CERT-FR is part of ANSSI, France’s national cybersecurity agency. ANSSI’s head, Vincent Strubel, called it urgent to take the two series off the internet or filter access very tightly, AFP reported.
Neither French authorities nor Danfoss has so far said who carried out the attack or how the attackers got into the controllers. Danfoss said most of the units hit were older models that it no longer updates.
Which Chains Were Hit
The chains gave their own figures to AFP, Reuters and broadcaster RTL. Each counts the stores the attack reached.
| Retailer | Stores Reported Hit | Source |
|---|---|---|
| Intermarché and Netto (Les Mousquetaires) | At least 300 across both brands, per AFP. About 150 stores, per Reuters | Company statements, October 12 |
| Coopérative U | 80 of 2,000 | Chief executive Dominique Schelcher, on RTL, October 13 |
| Carrefour | 80 supermarkets | Company statements to AFP and Reuters, October 12 |
| Monoprix | About 30 | Company statement to AFP, October 12 |
| E.Leclerc | Several stores | Company statement to AFP, October 12 |
A store on that list did not always lose its stock. Schelcher told RTL that the cold chain held in most of the 80 Coopérative U stores hit, and that only a minority could not react fast enough and lost goods, according to AFP. He praised the quick reaction of store staff and refrigeration contractors.
Intermarché, by contrast, said its affected stores had to throw away all the products concerned.
Thierry Cotillard, who heads Les Mousquetaires, told broadcaster BFMTV he expected losses of tens of millions of euros across France, according to Reuters.
In its statements on October 12, Danfoss gave no figure for how many systems were hit. It told Reuters it was “aware of incidents in France affecting a limited number of refrigeration management systems.”
Which Controllers, and Whether They Can Be Patched
Danfoss told AFP that most of the units hit were older products that no longer get software or security updates, and it named two: the AK-SM 800 and the AK-SC 355.
Danfoss declared the AK-SM 800 end-of-life in May 2021 and phased out the AK-SC 355 in 2016. In an October 2025 newsletter, it said it would end all services for such older products and urged customers to plan replacements.
Some units of the current model, the AK-SM 800A, were also hit. Those were running outdated firmware, according to Danfoss’s statement to trade publication Cooling Post, which did not name the versions.
| Controller | Status, According to Danfoss | Advice From CERT-FR and Danfoss |
|---|---|---|
| AK-SM 800 | End of life since May 2021. No software or security updates | Disconnect it or filter access. Danfoss urges replacement |
| AK-SC 355 | Phased out in 2016. No software or security updates | Disconnect it or filter access. Danfoss urges replacement |
| AK-SM 800A | Current model. Package 5.3.x, dated October 2026, was the latest listed on October 13 | Disconnect it or filter access. Danfoss advises keeping firmware up to date |
As of October 13, Danfoss’s security advisories page listed no advisory about the attack or about either older model.
What Operators Should Do
CERT-FR’s first instruction covers every AK-SM and AK-SC controller: disconnect it or filter access to it. Exposing a management interface to the internet goes against good practice, the alert says.
Where remote administration cannot be avoided, limiting access to trusted IP addresses is a first, temporary step. Beyond that, the alert advises following CERT-FR’s hardening recommendations, which were written for the energy and water sector.
Where a controller may have been compromised, the alert lists six steps, in this order:
- Limit network access to the controllers to service providers only.
- Do a factory reset.
- Apply all available security fixes.
- Change the device’s secrets, such as passwords.
- Check the existing accounts.
- Reconfigure the device completely.
Danfoss no longer issues fixes for the AK-SM 800 and the AK-SC 355, so the third step offers their owners no new fix.
For the AK-SM 800A, the latest software package Danfoss listed on October 13 was 5.3.x. A system on version 3.x should move to 4.x first, and a controller cannot be downgraded once it runs 5.3.x, according to the package’s readme.
Starting with version 4.0, a setting called Strict Session Control is enabled by default and makes HTTPS mandatory. Danfoss’s pages do not say whether the 5.3.x package was released in response to the attack.
Danfoss told Cooling Post it was working with customers on “firmware updates where available, stronger network protections and removing direct internet exposure where applicable.”
Its general security guidance, published in French, also tells operators to keep controllers unreachable from the internet, change default passwords when a system is installed, and require remote users to log in through a single managed entry point.
CERT-FR had published no indicators of compromise as of October 13, so operators have no official signs to check for.
Coopérative U’s stores do not buy directly from Danfoss. They are customers of refrigeration contractors that supply them with the Danfoss system, Schelcher said.
How the Attackers Got In Is Not Established
As of October 13, CERT-FR had named no vulnerability, no firmware version, and no way in. Its alert warns against exposing management interfaces to the internet without saying that was the route.
A person close to French Prime Minister Sébastien Lecornu told AFP that ANSSI had identified a vulnerability in software supplied by a Danish company and had contacted the vendor. No CVE was named, and the statement does not say the vulnerability was used in the attack.
E.Leclerc told AFP that a cyberattack had affected one of its refrigeration equipment suppliers, with effects on cold equipment in several of its stores. The supplier was not named.
Danfoss issued fixes for three flaws in the newer AK-SM 800A in 2025. Neither French authorities nor Danfoss has linked them to this attack.
CVE-2025-41450 is an authentication bypass, a way past the login, in versions before 4.2. CVE-2025-41451 is a command injection flaw that could lead to remote code execution, and CVE-2025-41452 could allow a denial-of-service attack. Both need a login and were fixed in version 4.3.1.
Researchers at Claroty described the three flaws in August, said they could be combined into attack chains, and reported finding thousands of AK-SM 800A management interfaces reachable from the internet. Their tests of the flaws were laboratory work on the newer model. The report describes no attacks and does not mention the two older models.
Danfoss’s October 2025 newsletter records earlier attacks on the AK-SM 800: 16 Russian supermarkets using the model were targeted in 2022, and 40 Israeli stores were hacked the same year. All 40 lacked proper firewall or VPN protection, and the newsletter names no vulnerability in either case.
The Inquiry and Reports From Other Countries
The Paris prosecutor’s office has opened an inquiry on its own initiative, it told AFP. Its cybercrime section leads the inquiry, which is assigned to the anti-cybercrime office known as OFAC.
The inquiry is to count the victims and establish the link between the attack and the damage they reported, which includes lost food and equipment that began to catch fire.
ANSSI is in contact with cybersecurity agencies in other European countries because those countries may be affected, the person close to the Prime Minister said.
Félix Aimé, a senior threat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. Reuters gave no details on those cases.
