Attackers Hijack Danfoss Controllers to Heat French Supermarket Refrigerators
Summary
Attackers remotely manipulated Danfoss refrigeration controllers at hundreds of French supermarkets, warming some units to 50°C and causing food losses. Authorities have not identified the attackers or confirmed how they gained access.
Key points
- The attack on October 11 affected controllers managing fridges and freezers at hundreds of French supermarkets.
- Intermarché said affected stores had to discard the products concerned; Coopérative U reported losses at only a minority of its 80 affected stores.
- CERT-FR identified compromises involving Danfoss AK-SM and AK-SC controller series and urged operators to disconnect them or tightly restrict access.
- Danfoss said many affected units were older models no longer receiving software or security updates; some AK-SM 800A units were running outdated firmware.
- As of October 13, authorities had named no attacker, entry method, vulnerability, firmware version, or indicators of compromise, and had not linked the attack to previously fixed flaws.
- Danfoss recommended firmware updates where available, stronger network protections, and removing direct internet exposure; French prosecutors opened an inquiry.
Article Details
- Victim Organization
- French supermarket chains, including Les Mousquetaires (owner of Intermarché), Coopérative U, and E.Leclerc
- Incident Type
- Remote compromise of refrigeration management controllers, causing fridges and freezers to enter defrost mode and heat up
- Incident Date
- 2026-10-11
- Disclosure Date
- 2026-10-12
- Operational Impact
- Hundreds of French supermarkets were reached. Intermarché said affected stores had to discard all products concerned; Coopérative U said only a minority of its 80 affected stores lost goods. The inquiry is also examining reported equipment damage, including equipment that began to catch fire.
- Claim Status
- confirmed
CVE
CVE-2025-41450CVE-2025-41450 is an authentication bypass, a way past the login, in versions before 4.2. CVE-2025-41451 is a command injection flaw that could lead to remote code execution, and CVE-2025-41452 could allow aCVE-2025-41451CVE-2025-41450 is an authentication bypass, a way past the login, in versions before 4.2. CVE-2025-41451 is a command injection flaw that could lead to remote code execution, and CVE-2025-41452 could allow aCVE-2025-41452before 4.2. CVE-2025-41451 is a command injection flaw that could lead to remote code execution, and CVE-2025-41452 could allow a denial-of-service attack. Both need a login and were fixed in version 4.3.1.
People
Félix AiméSenior threat intelligence analyst at Sekoia; told Reuters that Spain, Portugal, Poland, Germany, and Belgium had also been affected, without further details.SchelcherTold RTL that the cold chain held in most of the 80 affected Coopérative U stores and that a minority lost goods.Sébastien LecornuFrench Prime Minister; a person close to him told AFP that ANSSI had identified a vulnerability in software supplied by a Danish company, without saying it was used in the attack.Thierry CotillardHead of Les Mousquetaires; said he expected losses of tens of millions of euros across France.Vincent StrubelHead of ANSSI; called for the affected controller series to be taken off the internet or access to them tightly filtered.
Vendors
Products
AK-SC12 that it is aware of numerous compromises affecting two Danfoss controller series, the AK-SM and the AK-SC. It told operators to disconnect the controllers or filter access to them.AK-SC 355Danfoss told AFP that most of the units hit were older products that no longer get software or security updates, and it named two: the AK-SM 800 and the AK-SC 355.AK-SMon October 12 that it is aware of numerous compromises affecting two Danfoss controller series, the AK-SM and the AK-SC. It told operators to disconnect the controllers or filter access to them.AK-SM 800Danfoss told AFP that most of the units hit were older products that no longer get software or security updates, and it named two: the AK-SM 800 and the AK-SC 355.AK-SM 800ASome units of the current model, the AK-SM 800A, were also hit. Those were running outdated firmware, according to Danfoss's statement to trade publication Cooling Post, which did not name the versions.
Countries
BelgiumFélix Aimé, a senior threat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. Reuters gave no details on those cases.FranceCERT-FR is part of ANSSI, France's national cybersecurity agency. ANSSI's head, Vincent Strubel, called it urgent to take the two series off the internet or filter access very tightly, AFP reported.GermanyFélix Aimé, a senior threat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. Reuters gave no details on those cases.IsraelPolandFélix Aimé, a senior threat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. Reuters gave no details on those cases.PortugalFélix Aimé, a senior threat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. Reuters gave no details on those cases.RussiaSpainFélix Aimé, a senior threat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. Reuters gave no details on those cases.
Industries
FoodAttackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said.RetailAttackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said.