Danfoss cooling controllers hacked in hundreds of French supermarkets

On the night of 11 to 12 October 2026, attackers remotely took control of refrigeration systems in several hundred supermarkets in France. Next reported the incident on 12 October, drawing in particular on BFMTV, Le Monde and ZATAZ. The Paris public prosecutor’s office has opened an investigation.

What the attackers changed

According to BFMTV, as cited by Next, the attackers targeted the automatic defrost function of refrigerated display cabinets, cold rooms and central refrigeration plants. The usual cycle, roughly two hours of defrosting per day, was reportedly replaced with forced, continuous defrosting, with the temperature set to 50 °C.

The time at which the changes began made a significant difference. In some stores, the changes reportedly started before midnight. The equipment would then have been heating for several hours before the first employees arrived, and the stock was reportedly lost entirely. Elsewhere, the changes began later and part of the stock may have been saved. The Paris prosecutor’s office, quoted by Le Monde, also refers to “fires breaking out”.

Again according to BFMTV, around a hundred U cooperatives were reportedly affected, along with 300 Intermarché and Netto stores. Leclerc stores are also mentioned. These figures come from a single outlet, and the source available to us contains no confirmation from the retailers.

Controllers that were obsolete or never updated

All of these installations have one thing in common: a controller made by the Danish manufacturer Danfoss. These devices are used, among other things, for the temperature monitoring required by the European Union. This includes timestamped readings, alarms when temperatures rise abnormally, and remote maintenance operations.

Asked by BFMTV, Danfoss said the targeted devices fall into two categories. The first covers obsolete models, the AK-SM 800 and the AK-SC 355. The latter is no longer sold, and the manufacturer recommends replacing it with a device from the AK-SM 800 range. The second covers the AK-SM 800A, the current model, which receives regular updates but had not been updated in the affected stores. With this statement, the manufacturer shifts the question of responsibility towards the stores and the subcontractors in charge of the equipment.

Known vulnerabilities, but no established link

The AK-SM 800A has already been the subject of two sets of public vulnerabilities. In August 2023, three flaws affected version 3.3 of the firmware. The most serious allowed an authenticated attacker to execute commands remotely. In 2025, the company Claroty reported three more, fixed in versions 4.2 and 4.3.1. The most significant, CVE-2025-41450, makes it possible to obtain an administrator session remotely. Last August, Claroty counted 2,765 AK-SM 800A interfaces reachable from the internet.

At this stage, nothing links these vulnerabilities to the attack. Claroty’s research covers only the AK-SM 800A, not the two obsolete models mentioned by Danfoss. According to ZATAZ, the attackers reportedly targeted versions earlier than version 4, which therefore carry both the 2023 and the 2025 flaws. Next points out, however, that changing a setpoint or a defrost cycle is a routine administrative operation: valid credentials are enough, without exploiting any vulnerability at all.

An investigation handed to OFAC

The cybercrime section of the Paris prosecutor’s office is leading the investigation, which has been assigned to the Office anti-cybercriminalité (OFAC), France’s national cybercrime unit. It will have to establish how the intrusion happened and who is responsible.

Whatever its findings, the incident raises questions about how connected industrial equipment is looked after. Who updates it? For how long does the manufacturer provide updates? And who checks that it does not remain reachable from the internet years after it was installed?

As long as a device keeps working, it does not draw the attention of maintenance teams. That is precisely what makes it vulnerable when it stays reachable from the internet with no one keeping track of it.