Danfoss refrigeration controllers hijacked at hundreds of French supermarkets, forcing continuous defrost and mass food loss

During the night of October 11 to 12, 2026, attackers remotely took control of Danfoss refrigeration supervisory controllers at several hundred French supermarkets and forced display cabinets, freezers and cold rooms into a continuous defrost cycle with setpoints raised to about 50°C. The first manipulations were logged shortly after midnight; the Intermarché in Grand-Couronne (Seine-Maritime) timed the change on its own system at 4:44 a.m. Staff arriving on Monday morning found freezers normally held at -18°C reading positive temperatures, a Danfoss display still showing 26°C, and, at the Intermarché in La Haye (Manche), cabinets deformed by heat that reportedly reached 80°C. The Paris prosecutor's office stated that the attack caused food losses and fires; at a store in Gironde a cold room that reached 50°C triggered the sprinkler system. Le Monde reported that the attackers also lengthened the defrost duration from one hour to eight, which delayed temperature alarms, and several store employees told the trade site Je Bosse en Grande Distribution that the alerting function had been disabled, so on-call refrigeration technicians were never paged. The compromised equipment consisted of Danfoss ADAP-KOOL system managers: the AK-SM 800 (declared end of life in May 2021), the AK-SC 355 (phased out in 2016) and current-generation AK-SM 800A units running outdated firmware. Danfoss told AFP that most affected units were legacy products that no longer receive software or security updates. The AK-SM 800A had been the subject of CISA advisory ICSA-25-140-03 covering CVE-2025-41450, an authentication bypass through a hidden, date-derived "code of the day" support login (CVSS v3.1 8.2, fixed in release R4.2 in March 2025), together with CVE-2025-41451, a post-authentication command injection in the alarm-to-mail settings, and CVE-2025-41452, an nginx configuration injection, both fixed in R4.3.1 in August 2025. Claroty Team82 published the underlying research as "Freeze the Controller, Defrost the Food" on August 9, 2026 and counted 2,765 AK-SM 800A web interfaces reachable from the internet. On October 12, Predicta Lab counted 2,752 exposed Danfoss systems, 1,590 of them in France, and LeMagIT found close to 3,000 French IP addresses serving the Danfoss StoreView console. A Danfoss technical note from October 2025 had already described 2022 attacks on 16 supermarkets in Russia and 40 stores in Israel that ran AK-SM 800 units without firewall or VPN protection. Neither Danfoss, ANSSI nor the prosecutor has confirmed which vulnerability or access path was used, and nothing public indicates that Danfoss's own hosted infrastructure was breached. Investigators have not excluded exposed legacy controllers, exploitation of the published CVEs, stolen maintenance credentials or a hijacked remote-access session at a refrigeration contractor. Les Mousquetaires (Intermarché and Netto) reported at least 300 affected stores, roughly 100 of which discarded all refrigerated stock. Coopérative U reported just under 100 stores, Carrefour confirmed 80 of its roughly 6,000 stores, Monoprix about 30, and E.Leclerc said "several stores" were hit through one of its refrigeration equipment suppliers. Employees also reported problems at Carrefour Market, Carrefour City, Metro, Picard and independent butchers, none of which were officially confirmed. An Intermarché internal note dated October 12 "confirms the existence of a cyberattack that occurred during the night at Danfoss", and a crisis meeting with Danfoss and the refrigeration contractor Axima took place at 11 a.m. The cybercrime section of the Paris prosecutor's office opened an investigation the same day and assigned it to the Office anti-cybercriminalité (OFAC). Prime Minister Sébastien Lecornu tasked ANSSI, which said it had identified a vulnerability in the Danish vendor's software, contacted Danfoss, begun searching for other exposed French operators and started coordinating with European counterparts. CERT-FR issued a notice stating that it was aware of numerous compromises of Danfoss AK-SM and AK-SC series devices and that exposing a management interface to the internet is contrary to good practice. EU Agriculture Commissioner Christophe Hansen said that "the weaponisation of food has become a reality". No group has claimed responsibility and no attribution has been made. Over the same weekend, Ahold Delhaize disclosed a separate "cybersecurity incident" that began on Sunday afternoon, October 11. It took websites, apps, customer service and logistics systems offline at Albert Heijn, Etos and Gall & Gall in the Netherlands, blocked online ordering at Delhaize in Belgium, stopped work at several Albert Heijn distribution centers, left electronic shelf labels displaying the previous week's promotional prices, and took down the websites of Food Lion, Hannaford, Stop & Shop and Giant in the United States. No evidence links the two events.

Fresh and frozen stock destroyed at several hundred stores across France: at least 300 Intermarché and Netto outlets, just under 100 Coopérative U stores, 80 Carrefour stores, about 30 Monoprix stores and several E.Leclerc stores. Reported per-store losses ranged from about 50,000 euros (Intermarché Haguenau, Intermarché Guerlédan) to 150,000 to 200,000 euros (60 cubic metres of food at a Gironde store) and 220,000 euros (Super U Wasselonne). Les Mousquetaires estimated national losses at several million euros, and Intermarché warned that store insurance policies may not cover this type of event. Fires and sprinkler activations were reported, and cabinets were physically damaged at La Haye. Fresh and frozen aisles stayed closed for days, suppliers had orders cancelled, and some stores expected frozen sections to reopen only at the end of the week. No injuries, no data theft and no disruption of checkout systems were reported in France. The concurrent Ahold Delhaize incident suspended online grocery delivery in the Netherlands and Belgium, cancelled all orders already placed, halted several distribution centers and left electronic shelf labels showing stale prices.