Danfoss refrigeration controllers led to mass defrost in France

The attackers took control of refrigeration controllers made by Danfoss, a Danish company that sells temperature control systems to food retailers. These boxes let staff and service contractors watch and adjust fridge temperatures from anywhere, which is why many were left reachable over the internet.

Once inside, the hackers did not need to break anything. Every commercial fridge runs regular defrost cycles to clear ice, and the controllers can trigger them on command. By forcing those cycles on overnight, the attackers pushed temperatures up in fresh and frozen food displays. One report put peak temperatures at 50C (122F), and the Paris prosecutor’s office said it was looking into reported fires as well as food losses.

Danfoss confirmed its equipment was targeted. It said most of the affected controllers were either older models that no longer get security updates, the AK-SM800 and AK-SC355, or newer AK-SM800A units running out-of-date firmware. The company says it had already advised customers to upgrade those older systems.

French outlets estimated that 250 to 350 stores were affected. Named chains include Leclerc, France’s largest supermarket group, plus Monoprix, Carrefour Market, Super U, Coopérative U, Intermarché and Netto. At least 180 stores in the Les Mousquetaires group, which owns Intermarché and Netto, and more than 100 Coopérative U outlets were caught up in it. One later report claimed more than 700 stores, a figure the earlier counts do not support.

Intermarché said a service provider that manages store refrigeration had been hit, and that staff cleared food out of the affected units quickly. Coopérative U president Dominique Schelcher called the attack on equipment used to keep fresh food safe unprecedented and unacceptable. EU agriculture commissioner Christophe Hansen also condemned it.

The same Monday, Ahold Delhaize, one of the world’s biggest grocery groups, said it had taken some systems offline after a cybersecurity incident while its stores stayed open. Some reports have linked that incident to the French attack, but there was no evidence the two were connected when it was first disclosed.

Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU.
Nos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra…

— Dominique Schelcher (@schelcher) October 12, 2026

Nobody has confirmed exactly how the attackers got in, and no group has claimed responsibility. The most likely route, security researchers say, is known flaws in Danfoss controllers that were exposed online and never patched.

Those flaws are not new. In 2025 Danfoss fixed three vulnerabilities in its AK-SM 800A controllers, and the US Cybersecurity and Infrastructure Security Agency (CISA) published warnings about two of them: CVE-2025-41450, which lets an attacker skip the login, and CVE-2025-41451, which lets them run commands. Researchers at industrial security firm Claroty later showed the pair could be chained to take full remote control, disable cooling and even fake the temperature readings so staff would not notice.

Exposure was widespread. The day after the attack, one researcher counted 2,752 Danfoss systems online, 1,590 of them in France, while the Shodan device search engine tracked more than 4,500 worldwide.

The response was fast, though not in the way security experts usually hope. Researchers at Censys, which scans the internet for connected devices, counted 1,825 Danfoss StoreView control panels exposed in France on October 11. By October 14 that was down to 537, a 71% fall in three days.

Censys said the data shows operators were simply taking the panels off the internet, not installing the fixes, because patched and unpatched versions shrank by about the same share. Its researchers called that probably the best choice, since there is no good reason for these controllers to face the open internet. Most exposed units worldwide still ran old, unpatched software, and Poland, Romania and Belgium had an even higher unpatched share than France.

The Paris prosecutor has opened a criminal investigation, and France’s national cybersecurity agency, ANSSI, is investigating alongside European counterparts.

For shoppers, the immediate risk was empty chiller aisles and thrown-out stock, not unsafe food on shelves, since stores removed products from affected units. The bigger lesson is about cost: every spoiled freezer is a loss someone absorbs, and attacks like this can push those losses into prices.

For anyone running a shop, restaurant or warehouse with smart refrigeration, the advice from CISA is simple:

• Do not connect fridge or HVAC controllers directly to the internet unless you really must.
• If remote access is needed, put it behind a secure VPN and only allow known IP addresses.
• Ask your refrigeration contractor which controller model and firmware you run, and whether it still gets security updates.
• Replace controllers that the maker no longer supports.

The attack fits a wider pattern. US authorities warned in April 2026 about Iranian hackers going after exposed industrial systems, and in July 2026 a coordinated attack on controllers hit more than 30 water treatment plants in Minnesota.