Attackers took distant management of fridges and freezers at a whole bunch of French supermarkets on the night time of October 11 and warmed them, forcing shops to throw meals away, a number of retail chains mentioned.
The attackers reached them by way of the controller that runs all of a retailer’s fridges and freezers, a tool made by Danish firm Danfoss that upkeep companies can handle remotely. Les Mousquetaires, which owns the Intermarché chain, mentioned its fridges and freezers had been put into defrost and heated to as a lot as 50°C.
CERT-FR, the French authorities’s pc emergency response crew, mentioned in an alert revealed in French on October 12 that it’s conscious of quite a few compromises affecting two Danfoss controller sequence, the AK-SM and the AK-SC. It advised operators to disconnect the controllers or filter entry to them.
CERT-FR is a part of ANSSI, France’s nationwide cybersecurity company. ANSSI’s head, Vincent Strubel, referred to as it pressing to take the 2 sequence off the web or filter entry very tightly, AFP reported.
Neither French authorities nor Danfoss has to date mentioned who carried out the assault or how the attackers received into the controllers. Danfoss mentioned many of the items hit had been older fashions that it not updates.
Which Chains Had been Hit
The chains gave their very own figures to AFP, Reuters and broadcaster RTL. Every counts the shops the assault reached.
| Retailer | Shops Reported Hit | Supply |
|---|---|---|
| Intermarché and Netto (Les Mousquetaires) | Not less than 300 throughout each manufacturers, per AFP. About 150 shops, per Reuters | Firm statements, October 12 |
| Coopérative U | 80 of two,000 | Chief govt Dominique Schelcher, on RTL, October 13 |
| Carrefour | 80 supermarkets | Firm statements to AFP and Reuters, October 12 |
| Monoprix | About 30 | Firm assertion to AFP, October 12 |
| E.Leclerc | A number of shops | Firm assertion to AFP, October 12 |
A retailer on that listing didn’t at all times lose its inventory. Schelcher advised RTL that the chilly chain held in many of the 80 Coopérative U shops hit, and that solely a minority couldn’t react quick sufficient and misplaced items, based on AFP. He praised the fast response of retailer employees and refrigeration contractors.
Intermarché, against this, mentioned its affected shops needed to throw away all of the merchandise involved.
Thierry Cotillard, who heads Les Mousquetaires, advised broadcaster BFMTV he anticipated losses of tens of tens of millions of euros throughout France, based on Reuters.
In its statements on October 12, Danfoss gave no determine for what number of programs had been hit. It advised Reuters it was “conscious of incidents in France affecting a restricted variety of refrigeration administration programs.”
Which Controllers, and Whether or not They Can Be Patched
Danfoss advised AFP that many of the items hit had been older merchandise that not get software program or safety updates, and it named two: the AK-SM 800 and the AK-SC 355.
Danfoss declared the AK-SM 800 end-of-life in Could 2021 and phased out the AK-SC 355 in 2016. In an October 2025 publication, it mentioned it might finish all providers for such older merchandise and urged prospects to plan replacements.
Some items of the present mannequin, the AK-SM 800A, had been additionally hit. These had been working outdated firmware, based on Danfoss’s assertion to commerce publication Cooling Put up, which didn’t identify the variations.
| Controller | Standing, In line with Danfoss | Recommendation From CERT-FR and Danfoss |
|---|---|---|
| AK-SM 800 | Finish of life since Could 2021. No software program or safety updates | Disconnect it or filter entry. Danfoss urges substitute |
| AK-SC 355 | Phased out in 2016. No software program or safety updates | Disconnect it or filter entry. Danfoss urges substitute |
| AK-SM 800A | Present mannequin. Bundle 5.3.x, dated October 2026, was the most recent listed on October 13 | Disconnect it or filter entry. Danfoss advises protecting firmware updated |
As of October 13, Danfoss’s safety advisories web page listed no advisory in regards to the assault or about both older mannequin.
What Operators Ought to Do
CERT-FR’s first instruction covers each AK-SM and AK-SC controller: disconnect it or filter entry to it. Exposing a administration interface to the web goes in opposition to good observe, the alert says.
The place distant administration can’t be averted, limiting entry to trusted IP addresses is a primary, momentary step. Past that, the alert advises following CERT-FR’s hardening suggestions, which had been written for the vitality and water sector.
The place a controller could have been compromised, the alert lists six steps, on this order:
- Restrict community entry to the controllers to service suppliers solely.
- Do a manufacturing unit reset.
- Apply all accessible safety fixes.
- Change the gadget’s secrets and techniques, resembling passwords.
- Verify the prevailing accounts.
- Reconfigure the gadget fully.
Danfoss not points fixes for the AK-SM 800 and the AK-SC 355, so the third step presents their homeowners no new repair.
For the AK-SM 800A, the newest software program package deal Danfoss listed on October 13 was 5.3.x. A system on model 3.x ought to transfer to 4.x first, and a controller can’t be downgraded as soon as it runs 5.3.x, based on the package deal’s readme.
Beginning with model 4.0, a setting referred to as Strict Session Management is enabled by default and makes HTTPS necessary. Danfoss’s pages don’t say whether or not the 5.3.x package deal was launched in response to the assault.
Danfoss advised Cooling Put up it was working with prospects on “firmware updates the place accessible, stronger community protections and eradicating direct web publicity the place relevant.”
Its common safety steering, revealed in French, additionally tells operators to maintain controllers unreachable from the web, change default passwords when a system is put in, and require distant customers to log in by way of a single managed entry level.
CERT-FR had revealed no indicators of compromise as of October 13, so operators don’t have any official indicators to verify for.
Coopérative U’s shops don’t purchase instantly from Danfoss. They’re prospects of refrigeration contractors that provide them with the Danfoss system, Schelcher mentioned.
How the Attackers Received In Is Not Established
As of October 13, CERT-FR had named no vulnerability, no firmware model, and no approach in. Its alert warns in opposition to exposing administration interfaces to the web with out saying that was the route.
An individual near French Prime Minister Sébastien Lecornu advised AFP that ANSSI had recognized a vulnerability in software program provided by a Danish firm and had contacted the seller. No CVE was named, and the assertion doesn’t say the vulnerability was used within the assault.
E.Leclerc advised AFP {that a} cyberattack had affected considered one of its refrigeration gear suppliers, with results on chilly gear in a number of of its shops. The provider was not named.
Danfoss issued fixes for 3 flaws within the newer AK-SM 800A in 2025. Neither French authorities nor Danfoss has linked them to this assault.
CVE-2025-41450 is an authentication bypass, a well beyond the login, in variations earlier than 4.2. CVE-2025-41451 is a command injection flaw that would result in distant code execution, and CVE-2025-41452 might enable a denial-of-service assault. Each want a login and had been fastened in model 4.3.1.
Researchers at Claroty described the three flaws in August, mentioned they could possibly be mixed into assault chains, and reported discovering hundreds of AK-SM 800A administration interfaces reachable from the web. Their exams of the failings had been laboratory work on the newer mannequin. The report describes no assaults and doesn’t point out the 2 older fashions.
Danfoss’s October 2025 publication data earlier assaults on the AK-SM 800: 16 Russian supermarkets utilizing the mannequin had been focused in 2022, and 40 Israeli shops had been hacked the identical 12 months. All 40 lacked correct firewall or VPN safety, and the publication names no vulnerability in both case.
The Inquiry and Stories From Different Nations
The Paris prosecutor’s workplace has opened an inquiry by itself initiative, it advised AFP. Its cybercrime part leads the inquiry, which is assigned to the anti-cybercrime workplace often known as OFAC.
The inquiry is to rely the victims and set up the hyperlink between the assault and the injury they reported, which incorporates misplaced meals and gear that started to catch hearth.
ANSSI is in touch with cybersecurity businesses in different European nations as a result of these nations could also be affected, the individual near the Prime Minister mentioned.
Félix Aimé, a senior risk intelligence analyst at Sekoia, advised Reuters that Spain, Portugal, Poland, Germany and Belgium had additionally been affected. Reuters gave no particulars on these circumstances.
