1,590 French Danfoss Systems Were Still Online Hours After the Hack
Most of the Danfoss controllers behind France's supermarket freezer attack were models that no longer get security fixes. Why the food had to go, and whether it can happen elsewhere.
The notice at a supermarket in Grand-Couronne, near Rouen, gave a time: the attack struck "ce matin à 4h44," at 4:44 this morning. The trade blog Je Bosse En Grande Distribution, which collected that store's notice among a run of Intermarché ones, published it. Every fridge and freezer was emptied and the contents destroyed as a health precaution.
Grand-Couronne was one of hundreds. Overnight from Sunday, Oct. 11, into Monday, Oct. 12, attackers took over the refrigeration controllers in stores run by Intermarché and Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc, forcing fridges and freezers into continuous defrost at temperatures as high as 50°C (122°F). France's cyber emergency team, CERT-FR, said on Oct. 12 that it knew of "numerous compromises" of Danfoss AK-SM and AK-SC series controllers. Danfoss says most units hit were models it stopped supporting years ago.
Then came the number that frames the rest. On Monday, hours after the attack, researcher Baptiste Robert, CEO of Predicta Lab, counted 2,752 Danfoss systems reachable from the open internet, and 1,590 of them were in France. That is 57.8%, nearly three in five, sitting in the country that had just been hit.
This was less a feat of hacking than a bill coming due for a decade of connected refrigeration left online past its support life, colliding with EU cold-chain rules that turn a few silent hours into the compulsory destruction of frozen stock. As of Tuesday, Oct. 13, nobody has been named as the attacker, and no official has said how they got in.
One box runs every freezer in the store
A supermarket's cold aisles are not managed fridge by fridge. One supervisory controller, which Danfoss sells as a "system manager" (the AK-SM line and the older AK-SC line, with a web console called StoreView), sets temperatures, schedules defrost cycles and raises alarms for every cabinet and cold room in the building. Maintenance contractors reach that console over the internet so they can adjust it without sending a van.
That convenience is the attack surface.
"Attackers do not necessarily need to hack individual fridges."
Ryan Ko, director, University of Queensland Cyber Research Centre, to the ABC
Once inside the controller, Ko said, "they can potentially change temperature set points across many locations at once."
The weapon was defrost. Freezers routinely warm their coils to melt ice, so a controller expects a temperature rise. Le Monde, cited by TIME, reports the attackers stretched that cycle in some units from one hour to eight hours to delay alarms. Staff accounts gathered by Je Bosse En Grande Distribution say the hack also neutralised alerts in some stores, "donc l'astreinte n'a pas sonné" (so the on-call alarm never rang, translated). The clever part was not the heat but the silence: a freezer warming under a defrost label looks, to its own controller, like a freezer doing its job.
How the attackers reached those consoles is unknown. CERT-FR, as of Tuesday, had named no vulnerability, firmware version or entry route and published no indicators of compromise, The Hacker News reported. The retailers point to the supply chain. An Intermarché spokesperson told BleepingComputer the outage followed "a cyberattack reportedly affecting a service provider that manages refrigeration systems in stores," and E.Leclerc told AFP one of its refrigeration suppliers was hit.
Hardware that stopped getting fixes years ago
Danfoss told the trade outlet Cooling Post that most affected units were legacy products or current products on outdated firmware. It named the AK-SM800, "officially declared end-of-life in 2021," and the AK-SC355, "phased out in 2016." Neither receives security updates. The newer AK-SM800A units that were hit ran old firmware; BFMTV, via the trade magazine Points de Vente, reported that versions before version 4 were targeted.
So the AK-SC355 left the catalogue about 10 years before the attack, and the AK-SM800 has been unsupported for about five. A freezer controller is bought like a boiler, not like a phone.
"We are working with affected customers to implement appropriate mitigation measures, including firmware updates where available, stronger network protections and removing direct internet exposure where applicable."
Danfoss, statement to Cooling Post
"Where available" carries a lot of weight there. For an AK-SC355 or AK-SM800 there is no update, so the only fixes are cutting the box off the internet or replacing it. Danfoss told Reuters it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions." Sound advice, landing on a gap: the store owns the equipment, a contractor runs it and the vendor writes the code, so nobody clearly owns the decision to retire it. France's retail federation, the FCD, wants "full transparency" from Danfoss.
The exposure counts come from different tools and should not be added up. Claroty's Team82 reported in August that a Censys scan found 2,765 exposed AK-SM 800A devices. Shodan tracks more than 4,500 Danfoss devices reachable online, according to BleepingComputer. LeMagIT editor Valery Rieß-Marchive found nearly 3,000 French IP addresses exposing a StoreView console, Points de Vente reported. And according to the cyber intelligence firm UK Cyber Defence, cited by TIME, France held nearly 60% of the world's exposed Danfoss controllers detected by scans, with others in South Africa, the U.S. and the U.K.
Post by @fs0c131y
Robert's post, in French, reads: "2,752 Danfoss 'systems' online... 1,590 of 2,752 are in France." Two separate counts land on almost the same share, and that agreement matters more than any single figure. The attack hit the country with by far the largest pool of reachable consoles.
The newer model has known holes, too. Danfoss fixed CVE-2025-41450, an authentication bypass in the AK-SM 8xxA, in version 4.2 with an advisory on March 24, 2025, and fixed a remote-code-execution flaw (CVE-2025-41451) and a configuration bug (CVE-2025-41452) in version 4.3.1 on Aug. 1, 2025. By Monday those patches were 567 and 437 days old. Claroty's August research, published Aug. 9, 2026, described a hidden login mechanism "likely intended for vendor support or maintenance" that accepts a generated "code of the day."
Some coverage places Claroty's flaws right beside the attack, as if they were the way in. That is not established: Claroty's report covers lab work on the AK-SM 800A, describes no attacks and does not mention the older models, and neither French authorities nor Danfoss has linked the 2025 flaws to this attack. Jennifer Williams, a cyber security lecturer at Macquarie University, told the ABC: "It could be that there was a vulnerability that was already known with the software, but it wasn't patched because they didn't update it." For the legacy boxes, there was no patch to skip.
Three degrees of tolerance
Why not refreeze? EU Directive 89/108/EEC says quick-frozen food "must be stable and maintained, at all points in the product, at -18 °C or lower," with brief upward fluctuations of no more than 3 °C; member states may allow up to 6 °C in retail display cabinets. Points de Vente reported installations going from -18°C to +30°C in this attack.
The French trade is blunter. "Rupture de la chaîne du froid = produit impropre à la vente. On ne trie pas, on jette," wrote Je Bosse En Grande Distribution (a broken cold chain means the product is unfit for sale; you don't sort, you throw it out, translated). A remote command became, by rule and by habit, an order to destroy stock.
Outcomes then came down to timing. At the Intermarché in Haguenau, Axima's technicians saved all the chilled products, but every frozen item went in the bin. Grand-Couronne lost everything. In most of the 80 Coopérative U stores hit, the cold chain held, chief executive Dominique Schelcher told RTL. An Intermarché in La Haye, Normandy, reported 80°C and melted equipment (via TIME), and the Paris prosecutor's office, which has opened an investigation, cites fires as well as food losses. In central Paris, resident Geert de Clercq told Reuters he saw staff tip cartfuls of defrosted food into a giant container as molten ice cream sloshed onto the street.
Schelcher told RTL radio, Reuters reported, that a smaller store faces losses of "several tens of thousands of euros," and a bigger hypermarket up to €200,000 ($223,480). Thierry Cotillard, head of Intermarché owner Les Mousquetaires, told BFM TV the cost was "tens of millions of euros nationwide in a single day."
| Chain | Stores affected | Source of the count |
|---|---|---|
| Intermarché / Netto (Les Mousquetaires) | About 150; about 180; at least 300 | Les Mousquetaires to Reuters; Les Mousquetaires to TIME; retailers to AFP |
| Coopérative U | Over 100 (Monday); 80 of about 2,000 (Tuesday) | AFP; CEO Dominique Schelcher on RTL, via Reuters |
| Carrefour | 80 of 6,000 | Carrefour, via Reuters |
| Monoprix | About 5% of roughly 490 (about 25); 30 | Reuters; TIME |
| E.Leclerc | "Several" | E.Leclerc to AFP |
The chains' own figures imply about 335 to about 510 stores, plus Leclerc's "several"; Cooling Post estimates "around 500." The counts came on different days, to different outlets. As a share of each chain the damage is small, 4% of Coopérative U's stores and about 1.3% of Carrefour's.
From Fort Irwin to Albert Heijn
Félix Aimé, a senior threat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium were also affected, without details.
Americans have a closer precedent. In late August there were refrigeration outages at U.S. military commissaries, at least six confirmed, including Fort Irwin, Fort Huachuca and Travis Air Force Base. Some units went into defrost mode. Army CID's Cyber Field Office and the Air Force Office of Special Investigations are investigating; no cause has been stated.
On the same Monday, Ahold Delhaize, owner of Albert Heijn and of Food Lion and Stop & Shop in the U.S., took systems offline over "a security issue within its network." No link to France has been established. In Australia, Ko and Williams said centralised chains could be exposed if they use similar systems, though Ko added that "being a target is not the same as being vulnerable." As with connected devices that talk to the internet unwatched, the risk depends less on the brand than on who can reach the box.
The alert from CERT-FR is short: disconnect or filter access to AK-SM and AK-SC instances, restricting remote administration to trusted IP addresses if it is truly needed. Where compromise is suspected, operators should limit access to service providers, factory-reset the controller, apply available patches, rotate secrets, check accounts and reconfigure the equipment. As The Hacker News noted, the patch step offers nothing to owners of the legacy models. Claroty advises inventorying controllers, checking whether they face the internet and keeping administration behind trusted network segments or a VPN.
The cheapest fix on offer, CERT-FR's first instruction to disconnect, costs nothing. Yet as of Tuesday nobody has said how the attackers got in, and the next internet scan will show how many of those 1,590 French systems are still answering.
