French Supermarkets Lost Fresh Food to Unpatched Fridge Controllers

Hackers drove supermarket fridges to 50°C across France overnight on October 11, spoiling food after they seized refrigeration controllers that Danfoss had already stopped patching. The Paris prosecutor’s office called it a large-scale attack on connected refrigerators at several major food retailers. No group has claimed the job.

Dominique Schelcher, chief executive of Coopérative U, confirmed the hit on his network on Monday morning. The Danish maker later said most of the boxes that failed were legacy products, or current ones still running old firmware.

Overnight Heat in the Frozen Aisle

The attackers did not have to invent a new way to ruin a cold room. They turned on a function the plants already had, a defrost cycle meant to clear frost, and they left it running. At Intermarché stores owned by Les Mousquetaires, fridges sat at 50°C (122°F) for six hours. Staff then threw out the fresh and frozen stock rather than sell it.

Charles Dezon, who runs the Intermarché in Gradignan, said the job probably started about 11 p.m. His team only learned at 4 a.m., when a delivery driver found the stock room flooded. In central Paris, a resident watched Intermarché workers dump cartfuls of thawed frozen food into a street bin, with ice cream running out of broken tubs.

The Paris prosecutor’s office opened a probe through its anti-cybercrime office and said the damage included food losses and fires. Les Mousquetaires later said some equipment overheated enough to make smoke, and that its stores had not reported fires. Those two accounts have not been reconciled in public.

Schelcher put the first on-the-record confirmation on X while stores were still recovering the cold chain.

Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU.
Nos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra…

— Dominique Schelcher (@schelcher) October 12, 2026

S’attaquer à des équipements essentiels à la conservation des produits frais et à l’approvisionnement alimentaire des Français est d’une extrême gravité et est inédit. C’est inacceptable.

Dominique Schelcher, CEO, Coopérative U, on X

Christophe Hansen, the European Union’s commissioner for agriculture and food, used a harder word for the same night. He said food security needs more attention at every level, “because the weaponization of food has become a reality.”

How Many Stores Lost Their Cold Chain?

Retailers gave their own counts, and they do not add up to one official national total. Carrefour said 80 of its stores were hit and that the vast majority of its about 6,000 shops were not. Schelcher, in a follow-up on October 13, said 80 of nearly 2,000 Coopérative U outlets were touched, and that in most of those shops staff stopped a break in the cold chain. Where they could not, the food came off the shelves and was destroyed.

STORES THAT NAMED A FIGURE

Les Mousquetaires, which also owns Netto, is the group that described the six-hour heat. Intermarché chief executive Thierry Cotillard said the night would mean tens of millions of euros in losses nationwide in a single day. His group later put its own damage in the range of several million euros. Schelcher said a smaller shop might lose tens of thousands of euros, and that a large one could pass 200,000 euros (about $224,000).

Prime Minister Sébastien Lecornu told ANSSI, France’s national cybersecurity agency, to investigate. His office said France was coordinating with European counterparts because other countries might also be at risk. CERT-FR’s public alert, though, names the equipment and the French incident, not a confirmed map of foreign victims.

Danfoss Named the Controllers It No Longer Patches

Danfoss, the Danish manufacturer whose store managers sit above rows of cases and freezers, said it was in close contact with French supermarket customers after the Sunday-night attack. In a statement, it said the majority of units affected were legacy products or current products running outdated firmware.

The legacy names were specific. The AK-SM800 was declared end-of-life in 2021. The AK-SC355 line was phased out in 2016. Those models no longer receive software or security updates. Current AK-SM800A systems that were hit, the company said, were running outdated firmware. Danfoss said it had long advised customers to keep supported systems updated and to move legacy kit onto current products.

THE BOXES DANFOSS PUT ON THE RECORD

• AK-SC355: Phased out in 2016, with no further software or security updates.
• AK-SM800: Declared end-of-life in 2021, same patch cutoff.
• AK-SM800A: Current platform; the units in this incident, Danfoss said, still ran old firmware.
• What it is doing now: Working with affected customers on firmware updates where they exist, stronger network protections, and taking direct internet exposure off the boxes.

The company kept providing firmware and security updates for supported products, it said, and it did not publish a count of how many French systems were involved.

We are working with affected customers to implement appropriate mitigation measures, including firmware updates where available, stronger network protections and removing direct internet exposure where applicable.

Danfoss, statement, October 12, 2026

A person close to Lecornu said ANSSI had identified a vulnerability in software from a Danish company and had contacted the vendor. CERT-FR’s alert does not name a CVE or pin the night on a single flaw. Danfoss’s own account points at age and missed updates, which is the vendor’s reading, not a finished forensic finding.

A Code of the Day and Three Flaws From 2025

The current AK-SM 800A is the box a contractor logs into to set temperatures, schedule defrosts, read alarms, and check that a store’s plant is behaving. Claroty’s Team82 spent time on that web console and, in research it published on August 9, 2026, described how the management page can sit on the public internet. The team counted 2,765 exposed interfaces on Censys. It also found a hidden code-of-the-day login that accepted a password derived from the device’s date instead of the administrator’s password.

Danfoss had already shipped fixes. Advisory DSA-2025-03-01, dated March 24, 2025, covered an authentication bypass in AK-SM 8xxA units before version 4.2. A later advisory, and firmware 4.3.1, closed two more bugs. CISA told operators that successful abuse of the set could let a remote attacker bypass authentication and run code remotely.

THE THREE FLAWS AND THE FIXES THAT EXISTED

• CVE-2025-41450: Improper authentication from a datetime-based password, CVSS 8.2, fixed in firmware R4.2.
• CVE-2025-41451: Command injection through alarm-to-mail settings after login, CVSS 7.6, fixed in 4.3.1.
• CVE-2025-41452: Web-server configuration injection after login, CVSS 5.4, also fixed in 4.3.1.

Tomer Goldschmidt of Claroty Team82 reported the bugs. CISA first published on May 20, 2025, and added the second pair on August 26, 2025. No authority has said those identifiers were the door used on October 11. The fact that still matters for stores is simpler. Patches for the current platform were on the shelf, the older platforms were out of support, and a lot of management pages were never meant to face the open internet.

Ken Munro, a partner at the British firm Pen Test Partners, called the night a failure of basic cyber hygiene. The louder technical complaint among people who work on these boxes is the same one: a food-safety controller that will accept a date-based support password, or that still speaks to the world on an old build, is doing the attacker’s first hour of work for them.

CERT-FR Warns the Campaign Is Probably Still Running

CERT-FR, the incident team inside ANSSI, published alert CERTFR-2026-ALE-012 on October 12 and updated it on October 13. The first version named numerous compromises of Danfoss AK-SM and AK-SC remote refrigeration controllers. The update added Copeland xweb and Dixell xweb units to the same warning. Putting a management interface on the internet, the agency said, runs against good practice.

THE WEEK THE COLD CHAIN BROKE

1. March 24, 2025: Danfoss publishes DSA-2025-03-01 for the AK-SM 8xxA authentication flaw and points customers at firmware 4.2.
2. August 26, 2025: CISA’s updated industrial advisory lists all three AK-SM 8xxA flaws and the R4.2 and 4.3.1 fixes.
3. August 9, 2026: Claroty Team82 publishes its full write-up of the web console, including the date-based login and the internet-facing count.
4. October 11, 2026: Attackers seize remote fridge controllers overnight and force defrost cycles that ruin stock.
5. October 12, 2026: CERT-FR issues CERTFR-2026-ALE-012; the Paris prosecutor opens a large-scale case; Schelcher confirms the hit on Coopérative U.
6. October 13, 2026: CERT-FR adds Copeland xweb and Dixell xweb and says attack campaigns against these devices are probably still under way.

The operational advice is blunt. Stores that are not compromised should pull management pages off the public internet and check defrost ranges. Access should come back only through a VPN or a protected network. Filtering the contractor’s source addresses on a firewall can buy time, CERT-FR said, and it is not a lasting fix. Danfoss boxes should get current firmware, Strict security mode, and new passwords in place of defaults.

If a unit is already compromised, the agency wants the same internet cut, then a factory reset, then a full rebuild of the config. On end-of-life gear that still has no security patch, a reset is not enough. The persistence is gone, the hole is not, and the box will almost certainly be taken again if it stays reachable. CERT-FR also told operators to read their insurance contracts before they cut the data feed that a refrigeration contractor uses to watch the plant.

Who Pays When a Fridge Becomes a Furnace?

A large share of the damaged shops sit in cooperative networks of independently owned stores. The bill for a ruined aisle, and for the labour to restock it, lands first on those owners, not on a distant headquarters. Intermarché warned that insurance policies may not cover this kind of in-store incident. CERT-FR’s note about checking cover before anyone unplugs the contractor’s telemetry is the same problem from the other side: the monitoring that keeps food safe is also the path that just cooked it, and cutting that path can itself be a claims issue.

WHAT WE KNOW

• The method: Remote control of refrigeration supervisors, with forced defrost and setpoints pushed to 50°C in named Intermarché stores.
• The kit: Danfoss AK-SM and AK-SC families, plus Copeland xweb and Dixell xweb in CERT-FR’s October 13 update.
• The vendor line: Most affected Danfoss units were out of support or current AK-SM800A boxes on old firmware.

WHAT IS UNCONFIRMED

• The entry flaw: No authority has tied the night to CVE-2025-41450 or its two companions.
• The actor: No group has claimed the attack, and no public forensic note names a country.
• The full bill: Store-level figures exist; a closed national total does not.

Guessing a foreign service from the fact that food was the target is a habit, not a finding. The stores that failed sit across several banners, which points at shared plant, shared contractors, and shared remote-access habits more than at one chain’s office network. Technicians described defrost programmes stretched for hours and thresholds shoved to 50°C, which is the controller doing what its own menus already allow. Until connection logs, accounts, and the routers in front of those boxes are on the record, the honest status is the one CERT-FR already printed: numerous compromises, campaigns probably still running, and end-of-life units left on the internet sitting at high risk.

Thousands of Consoles Remain on the Public Internet

Claroty’s 2,765 internet-facing StoreView pages were a research snapshot, not a live map of October 11. The warning still holds. The AK-SM 800A exists so a technician can keep a store cold without driving to it. That convenience is why the web console is there, and why so many of those consoles were reachable from outside the shop. Schelcher made the same trade-off explicit for Coopérative U: the plants are on the internet so temperatures can be watched day and night, and so someone can step in when a case fails.

Lecornu’s instruction to ANSSI, the Paris prosecutor’s file, and CERT-FR’s two-day alert are the official trail. Danfoss is pushing firmware where it still writes firmware, and telling everyone else to replace the rest. The stores that already ran current code behind a private path had a boring Sunday night. The ones that did not spent Monday throwing away dinner.

On October 13, CERT-FR was still telling operators that campaigns against these controllers were probably active. A factory reset on an unpatched, end-of-life unit, left on a public address, is a short pause before the next defrost.