Attackers Remotely Defrost Refrigerators at Up to 350 French Supermarkets via Danfoss Controllers

Attackers remotely defrosted refrigerators at several French supermarket chains overnight on Sunday, October 11, 2026. French outlets put the number of affected stores at 250 to 350. The result was physical: display cases warmed, fresh and frozen products had to be pulled from sale, and retailers are reporting significant financial losses and food waste. BleepingComputer reported the incident on October 12.

This was not ransomware and no data theft has been reported. The attackers reached the refrigeration control layer directly and used a legitimate feature of the equipment against its owners.

What happened

According to the reporting, the attackers hijacked Danfoss refrigeration controllers running older control software. Once in control, they raised case temperatures by triggering the built-in automatic defrost system. Defrost is a routine maintenance function that normally runs on a short schedule to clear ice from evaporator coils. Run at the wrong time and across a whole store, it does the damage on its own.

The timing matters. A Sunday night attack means low staffing, closed stores and hours of warming before anyone walks the aisles. By the time employees arrived, the cold chain was already broken for the affected units.

Who was hit

Six retail brands are named as victims: Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc and Super U. That spread across competing retailers points to a shared technology dependency, not a breach of any single corporate network.

• An Intermarché spokesperson said some fresh and frozen food display units were "out of service" and that Intermarché and Netto removed products from them.
• Coopérative U president Dominique Schelcher confirmed the attack affected several stores in the network and called it "unprecedented."
• EU agriculture and food commissioner Christophe Hansen condemned the attack and named Leclerc as a victim.
• The Paris prosecutor's office has opened an investigation.
• Leclerc and Coopérative U had not responded to requests for comment when the article was published.

The known Danfoss vulnerabilities

The reporting points to two previously disclosed flaws in the Danfoss AK-SM 8xxA Series, the system manager line used to supervise supermarket refrigeration, HVAC and lighting. CISA warned about both in 2025.

• CVE-2025-41450: an authentication bypass, covered by CISA in May 2025.
• CVE-2025-41451: a command injection flaw, covered by CISA in August 2025.

Claroty's Team82 found both issues. In August 2025 the team published research showing how to achieve remote code execution on publicly accessible AK-SM 800A management interfaces. That research has been public for roughly 14 months. An authentication bypass paired with command injection on an internet-facing management interface is a complete path from the open internet to control of the device.

Whether the attackers used these two CVEs has not been confirmed. What is confirmed is that the affected controllers were running older software, and that a documented route to remote code execution on this product family has existed in public since last year.

Exposure: thousands of controllers on the open internet

Predicta Lab CEO Baptiste Robert found 2,752 Danfoss systems exposed online, 1,590 of them in France. That puts about 58 percent of the exposed population he identified in the country that was attacked. Shodan tracks more than 4,500 reachable Danfoss devices overall.

Those numbers explain how one operation could hit 250 to 350 stores across six brands in a single night. The attackers did not need to breach six retailers. They needed a list of reachable controllers and a working method, and both were obtainable from public sources. Refrigeration controllers are commonly installed and maintained by third-party contractors who need remote access for monitoring and alarms, which is how these devices end up on the public internet outside the view of the retailer's security team.

A second retail incident, no confirmed link

Separately, Ahold Delhaize announced it had taken some systems offline after a "cybersecurity incident." The reporting states there is no evidence the two incidents are connected. It is listed here because the timing will prompt the question, and the current answer is that no link has been shown.

Why this matters beyond France

Most retail security programs are built around payment data, loyalty databases and ransomware on corporate IT. This attack went around all of that. It targeted building and refrigeration systems that often sit outside the security team's asset inventory, are managed by facilities or a contractor, and run software that is rarely updated after installation.

The impact model is also different. There is no encryption to reverse and no backup to restore. Spoiled stock is gone, and the cost lands in shrink, disposal, lost sales and food safety review. The same controller family manages refrigeration in grocery, convenience, food distribution and cold storage worldwide, and the exposed device counts are not limited to France.

Three facts should drive the conversation inside any organization with a cold chain: the affected controllers ran older software, a public route to remote code execution on this product line has existed since August 2025, and thousands of these devices answer on the open internet. Organizations that do not know whether their refrigeration controllers fall into that group have a visibility gap in their OT environment, and that gap is what this attack exploited at scale.