Overnight on Sunday, Oct. 11, someone ordered the refrigeration controllers in hundreds of French supermarkets into a defrost cycle that did not stop, heating cases meant for frozen food to as much as 50C (122F) and leaving stores from Paris to Alsace to throw out their fresh and frozen stock the next morning.
Nobody had to enter a store. The command reached supervisory controllers made by the Danish company Danfoss, which are kept online so that maintenance contractors can manage a store’s cases from anywhere. Danfoss told Cooling Post that most of the units hit were legacy products: the AK-SM800, declared end-of-life in 2021, and the AK-SC355, phased out in 2016. Neither receives software or security updates. The current-generation AK-SM800A units that were hit were running outdated firmware, the company said.
The weakness was on file. The U.S. Cybersecurity and Infrastructure Security Agency warned in May 2025 that flaws in Danfoss’s AK-SM 8xxA series could let a remote attacker bypass authentication and run arbitrary code. In August, researchers at the security firm Claroty published the mechanics and counted 2,765 of the controllers reachable from the open internet. On Monday a French researcher counted 2,752 Danfoss systems online, 1,590 of them in France.
Still unknown: who sent the command, which hole they used and whether the same hand sent freezers at U.S. military commissaries into defrost in late August. The route itself is old. A refrigeration contractor’s stolen login opened Target’s network in 2013, and an unused VPN account protected by a single password opened Colonial Pipeline’s in 2021. Each time, the opening was remote access set up for convenience and left lightly guarded.
Six hours at 50C
Les Mousquetaires, which owns Intermarché, said about 150 of its stores had their fridges held at 50C for six hours and that all the food had been thrown away to avoid any health risk, the Guardian reported. The Paris prosecutor’s office called it a large-scale attack “affecting connected refrigerators in several major food retailers across France,” with “food losses and fires.”
The count kept moving. Intermarché and Coopérative U told Agence France-Presse that 150 to 200 Intermarché stores and nearly 100 Coopérative U outlets had been hit, Euronews reported. Carrefour said 80 of its supermarkets were affected, and Monoprix, which has about 490 stores in France, said 5 percent of them were, according to Reuters, in a report published by CBC. BFM TV put the Intermarché and Netto total near 300. E.Leclerc, the country’s largest grocer, did not answer questions at first and later said several of its stores were targeted, France 24 reported.
In Issy-les-Moulineaux, just outside Paris, the store director Ina Genetay put her losses at €55,000 and told France 2 that she had cut the store’s digital link to its refrigeration. “We switched everything off, disconnected everything,” she said. An employee at a Paris store told the channel that cases meant to hold minus 18 or minus 19C had passed 40C. In central Paris, a resident, Geert de Clercq, watched staff at an Intermarché tip cartfuls of thawed frozen food into a giant container as melted ice cream leaked from broken tubs, Reuters reported.
Two stores in Haguenau, in Alsace, an Intermarché and an E.Leclerc, put their combined stock losses at €270,000, according to the regional paper Sud Ouest, as cited by The Independent. Thierry Cotillard, Intermarché’s chief executive, told BFM TV the attack would mean losses of “tens of millions of euros nationwide in a single day.” Intermarché warned that its insurance may not “cover this type” of incident. Standard property policies frequently exclude physical damage caused by cyber events, John Farley of the broker Gallagher said, as paraphrased by Insurance Business.
By Monday afternoon the prosecutor’s office was using narrower words. Its investigation aims “to identify the victims and establish a link with the damage they have reported, in terms of losses of foodstuffs and the triggering of fire alarms.” How many stores had fires, and how many only had alarms, has not been made public.
Dominique Schelcher, the chief executive of Coopérative U, was the first retail chief to confirm the attack, in a post on X early Monday. Later in the day he wrote that “targeting equipment that is essential for preserving fresh products and for the food supply of people in France is extremely serious and without precedent.”
Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU.
Nos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra…
The way in
A supermarket’s cold aisle is usually run by one control panel that manages every case and cold room in the building, and Reuters reported that those panels can be reached over the internet so maintenance companies can adjust them from anywhere. Defrost is routine, a short burst of heat that clears ice from the coils. The attackers kept it running, with a set point of 50C, IT-Connect reported. Citing BFM TV, the site said the targets ran Danfoss software older than version 4.
Danfoss sold that remote reach as a saving. In a 2019 article on its website, the company wrote that after staff, energy is the biggest bill most supermarkets have, and that most of it goes to refrigeration. Then it made the pitch.
Connecting your case controller to the internet offers further opportunities to generate savings. If you can diagnose issues and control the case remotely, service engineers needn’t be called out to simple situations like starting a defrost.
Starting a defrost is what the attackers did, in hundreds of stores at once. In research published Aug. 9 and presented at the DEF CON conference in Las Vegas, Amir Zaltzman of Claroty’s Team82 described a hidden “code of the day” login in the AK-SM 800A. It accepted a password generated from nothing but the device’s date and opened a full administrative session. A second flaw, in the controller’s email settings, let a logged-in attacker run code. Claroty advised firmware R4.3.1 or later.
Once inside, the researchers said, they had “every management function” the device exposed, including the ability to “configure temperature thresholds,” The Stack reported. A scan with the Censys search engine turned up 2,765 of the devices facing the internet. Team82’s report put it flatly.
Numerous controllers were directly accessible from the public Internet.
What Danfoss knew
Danfoss had the fixes well before the report. Its security advisories show the authentication bypass fixed in version 4.2, in an advisory dated March 24, 2025, and the two other flaws fixed in 4.3.1 in August 2025. Several outlets tied the attack to a Danfoss advisory dated Sept. 18. By the company’s own listing, that advisory covers its iC7 industrial drives and marine inverters, not refrigeration controllers.
The larger gap is in the older models. The AK-SM800 and AK-SC355 fall outside those advisories, and Danfoss says they get no fixes at all. How the attackers got into them has not been disclosed. The French site Cyberattaque.org laid out four possibilities: direct exploitation of old controllers exposed online, a known vulnerability, stolen maintenance credentials or hijacked remote access at a refrigeration contractor. It said nothing showed that Danfoss’s own central systems had been breached.
The chains tell it differently. An internal Intermarché memo, quoted by BFM TV and Help Net Security, confirmed “the existence of a cyberattack that occurred during the night at Danfoss.” Les Mousquetaires has said the refrigeration systems were under Danfoss’s management, Insurance Business reported, which leaves insurers room to pursue the supplier. Danfoss said it was working with customers on “firmware updates where available, stronger network protections and removing direct internet exposure where applicable.” The French retail federation, the FCD, asked Danfoss for “full transparency,” Reuters reported.
Baptiste Robert, who runs the French security firm Predicta Lab, posted his count of exposed Danfoss systems as a quick thread on X on Monday. BleepingComputer reported that Shodan, another search engine for connected devices, listed more than 4,500 reachable Danfoss devices.
On compte 2752 “systèmes” Danfoss en ligne.
On va faire un thread vite et mal à l’ancienne.
1ere observation : 1590 “systèmes” sur 2752 sont en France
Who is suspected
No one has claimed the attack, and no government has named a suspect. Prime Minister Sébastien Lecornu put ANSSI, the national cybersecurity agency, on the case. A person in his office said ANSSI had found a vulnerability in Danfoss software, that France was coordinating with European counterparts “as other countries may also be affected,” and that the authorities were checking whether other French companies were at risk.
Félix Aimé, a senior cyber threat intelligence analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. No government had confirmed that by Tuesday.
The political frame arrived before any evidence. Last month President Emmanuel Macron, a firm backer of Ukraine, ordered measures to protect critical infrastructure from Russian “hybrid attacks.” Christophe Hansen, the European commissioner for agriculture and food, wrote on X, in French, that he strongly condemned the attack and that “the weaponization of food has become a reality.” Mr. Hansen named no culprit.
Je condamne fermement la cyber attaque visant des produits alimentaires chez @intermarche @CooperativeU @Leclerc
La sécurité alimentaire nécessite plus d’attention à tous les niveaux. Car l’instrumentalisation de l’alimentation est devenue une réalité.@UEFrance
The same controller has been hit before. A Danfoss technical note from October 2025, as described by Cyberattaque.org, cited attacks in 2022 on 16 supermarkets in Russia that used AK-SM 800 controllers, and on 40 stores in Israel that Danfoss said lacked adequate firewall or VPN protection.
The Dutch grocer Ahold Delhaize had its own trouble the same day, and so far it looks separate. A “cybersecurity incident” that began Sunday afternoon stopped most of Albert Heijn’s distribution centers in the Netherlands, NL Times reported, took down websites and the delivery app, and left electronic shelf labels showing the previous week’s prices. In the United States, the websites of Stop & Shop, Giant, Hannaford and Food Lion read “site temporarily down.” Ahold said there was no reason to see a link with the French attack, according to Reuters.
The closer parallel is American. Starting Aug. 26, commissaries on U.S. military bases reported freezers and refrigerators failing within days of one another, some of them switching into defrost mode, Stars and Stripes reported. Six installations confirmed outages publicly: Fort Irwin, Calif.; F.E. Warren Air Force Base, Wyo.; Fort Huachuca, Ariz.; Naval Station Newport, R.I.; Columbus Air Force Base, Miss.; and Travis Air Force Base, Calif. The Army Criminal Investigation Division’s Cyber Field Office and the Air Force Office of Special Investigations confirmed investigations. The Pentagon would acknowledge only a “possible refrigeration disruption.”
The first person to raise the possibility of a hack in public was M. Elizabeth, who writes the Substack newsletter Signal and Silence. On Aug. 28 she noted that every freezer at Fort Huachuca had gone into defrost while the power stayed on, and that the commissary agency’s own specifications say defrost is controlled through its remote monitoring system. She pointed to Claroty’s Danfoss research and was careful about what she could prove.
To be very clear: I do not have evidence that the Defense Commissary Agency was hacked.
She has not shown that the affected commissaries run Danfoss equipment. An agency inventory she found lists a Danfoss AK-SM880 at Naval Air Facility El Centro, a base not on the list of outages. She has filed three Freedom of Information Act requests for logs, root-cause findings and controller inventories. The Pentagon has not said what caused the failures.
The case for connecting
Among readers, the strongest defense of networked refrigeration came from people who said they had worked with it. On Hacker News, a reader who said he worked on supermarket control systems in 2008 described why the panels are online.
These systems are internet connected and remotely controllable because the managers need to be able to see shifts in usage over time and take action to save electricity and provide better food storage.
On Reddit’s r/europe, another reader made the cost argument: the alternative to remote supervision, he wrote, is paying trained refrigeration staff in every store around the clock, and food prices would rise. A third, who described working in refrigeration, wrote that even small stores now run CO2 systems that are impossible to manage without remote access.
Back on Hacker News, one reader drew the line somewhere else, between watching a freezer and steering one.
There’s huge difference between _sensors_ and _actuators_. You can put sensors online if you don’t care too much about data leaking out. You put _actuators_ online... You need to be able to deal with the consequences.
The record supports parts of both arguments. Monitoring paid off on Sunday night: some stores saved part of their stock because managers got alerts about the changes, Help Net Security reported. But Danfoss’s own pitch is about control, with a remote defrost as its example, and Claroty reached every management function on the device it tested. Neither monitoring nor control requires a login page on the open internet. Danfoss’s security guidance tells customers to keep devices behind firewalls and to use a VPN for remote access. The thousands of interfaces counted on Monday were reachable without one.
Another Hacker News reader argued that blaming store managers misreads who runs the gear.
But I’d setup Tailscale and-- would you, the grocery store manager running on 3% margin, really? What if you’re part of a chain and it’s centrally controlled elsewhere, like all the other decade-old tech you use but have to call and wait for a dispatched tech to handle?
The 3 percent margin is the reader’s figure. The point about outside control fits what the chains have said: Les Mousquetaires called the systems Danfoss-managed, and contractors including Axima sat in Monday’s crisis meeting with Danfoss. A different reader called Danfoss’s upgrade advice a way of pushing stores to buy new equipment. The dates complicate that charge. The AK-SM800 had been out of support for five years, and fixes for its successor had been available since 2025. Whether Danfoss or its contractors told stores those updates were urgent is not on the record.
Target, Colonial and Oldsmar
On Nov. 15, 2013, attackers entered Target’s network with credentials stolen from Fazio Mechanical Services, a refrigeration and HVAC contractor in Sharpsburg, Pa., Brian Krebs reported in February 2014. About 40 million credit and debit cards were exposed. Ross Fazio, the contractor’s president, said its data link with Target was used only for electronic billing, contract submission and project management, and that his firm did not remotely monitor or control Target’s refrigeration.
Colonial Pipeline shut its entire gasoline system in 2021, the first time in its 57-year history, after a ransomware attack. Its chief executive, Joseph Blount, told a Senate committee in June 2021 that the attackers had used a legacy VPN profile “that was not intended to be in use,” Dark Reading reported. “In the case of this particular legacy VPN, it only had single-factor authentication,” he said. Colonial paid a $4.4 million ransom.
Oldsmar, Fla., is the warning in the other direction. In February 2021, officials said an intruder had remotely raised the sodium hydroxide setting in the town’s water from about 100 parts per million to 11,100. In March 2023, the former city manager, Al Braithwaite, said the F.B.I. had found “no evidence of any access from the outside,” Route Fifty reported, and the F.B.I. said it could not confirm a cyber intrusion, the Tampa Bay Times reported. In France, the vendor, the government and the chains all call Sunday’s event an attack. For the commissaries, the question is still open.
Exposed controllers have kept turning up. In December 2023, U.S. agencies warned that cyber actors affiliated with Iran’s Islamic Revolutionary Guard Corps had been compromising Israeli-made Unitronics controllers, including at U.S. water facilities. On the same day as its Danfoss report, Claroty published 23 flaws in Copeland’s XWEB Pro refrigeration controllers and showed it could switch compressors, fans and defrost on and off while setting the displayed temperature to anything it chose.
France has its own recent record of breaches through third parties. In August, hackers broke into tax agency systems and compromised income and property records for 678,000 taxpayers and businesses. In early 2024, criminals breached the payment processors Viamedis and Almerys, exposing data on 33 million health policyholders and pushing pharmacies back to manual processing.
What comes next
The Paris prosecutor’s cybercrime section has given the case to the national anticybercrime office, OFAC, ICI reported. ANSSI has not said publicly which vulnerability it found, or whether it was in the retired models or the current one.
Christel Delberghe, director general of the European retail association Eurocommerce, said the incident “underlines the importance of resilience across the entire supply chain.”
European law has only just begun to reach manufacturers. Since Sept. 11, the E.U.’s Cyber Resilience Act has required makers of connected products to report actively exploited vulnerabilities, with an early warning due within 24 hours, according to the European Commission. The act’s requirements for secure design and security updates take effect on Dec. 11, 2027.