Security Operations

Danfoss fridge hack hits French supermarkets: lessons for UK retail

Attackers forced defrost cycles on Danfoss controllers in hundreds of French supermarkets. What UK retailers should check in their OT estate now.

Illustration of a networked supermarket refrigeration system under cyber attack

Overnight on Sunday, attackers took remote control of Danfoss refrigeration controllers in hundreds of French supermarkets and forced fridges and cold rooms into prolonged defrost cycles. Stores had to discard fresh and frozen stock. Any UK retailer or cold-chain operator with an internet-facing building controller should check its own estate this week.

What happened

On the night of Sunday 11 October 2026, refrigeration systems began failing across several of France’s biggest grocery chains. On Monday morning Dominique Schelcher, president of Coopérative U, confirmed on X that a cyber attack had been affecting refrigeration systems in several stores in the group’s network since the previous evening. He called it “unprecedented” and “unacceptable”. His teams were working with refrigeration specialists.

Estimates of the scale vary, so the figures need attributing:

  • Intermarché: a spokesperson told Infosecurity Magazine that 150 stores were affected. Euronews put the figure at 150 to 200.
  • Coopérative U: nearly 100 outlets were hit, according to both Euronews and Cybernews.
  • Carrefour and Monoprix: Carrefour told Infosecurity Magazine the incident mainly affected 80 of its 6,000 stores. Groupe Casino said about 5% of Monoprix supermarkets were affected.
  • E.Leclerc: broadcaster BFMTV reported it was also targeted, and EU agriculture commissioner Christophe Hansen named it as a victim. The chain had not confirmed this when the reports were published.

Overall totals differ by source. BleepingComputer, summarising French reporting, gives a range of 250 to 350 stores. Cybernews, citing BFMTV, puts the total nearer 400 once Intermarché’s sister brand Netto is included.

The Paris prosecutor’s office has opened an investigation. It aims to identify the victims and link them to reported food losses and to fires or triggered fire alarms. According to Cybernews, France’s national cyber security agency ANSSI has contacted the equipment supplier and is coordinating with European counterparts. At the time of writing, no group had publicly claimed the attack and no attribution had been reported.

The technical picture

The affected systems are run by Danfoss, the Danish manufacturer whose controllers manage refrigeration and HVAC across much of European food retail. An Intermarché spokesperson told Infosecurity Magazine two things:

  • The attackers went after outdated versions of the Danfoss control software.
  • The vulnerable stores were running consoles with remote-control capability that lacked a properly secured communication channel.

Infosecurity Magazine reports Danfoss confirmed the targeted models were either obsolete (AK-SM800 and AK-SC355) or not updated (AK-SM800A).

According to BFMTV, the attackers abused a legitimate function: the defrost cycle that normally clears ice from evaporators. Forcing it to run continuously, with setpoints reportedly as high as 50°C, turned the controller against the stock it was meant to protect. BFMTV reported that two stores in Haguenau, in Alsace, had already lost about €270,000 of goods. Intermarché told AFP that affected stores would have to discard all fresh and frozen products, and warned that store insurance may not cover an incident of this kind.

How the controllers were reached has not been confirmed, but the background is well documented:

  • CISA advisory, May 2025: CISA published advisory ICSA-25-140-03 for the Danfoss AK-SM 8xxA series of system managers. It covers CVE-2025-41450, an authentication weakness rated 8.2 under CVSS v3.1, which comes from a password generated from the date and time. Versions before R4.2 are affected.
  • Claroty Team82 research, August 2026: Claroty’s Team82, which reported that flaw, presented further research at DEF CON 34 in August 2026. It showed that a compromised AK-SM 800A could switch off cooling while sending false temperature readings to whoever was watching.
  • Internet exposure: a Shodan scan cited by Infosecurity Magazine found 3,726 of these controllers reachable from the public internet on 19 August.
  • Later fix: Danfoss later released firmware R4.3.1 to address the Team82 findings.

None of the reporting so far confirms that any of these specific vulnerabilities was used on Sunday night.

Timeline from the 2025 Danfoss advisory to the October 2026 attack on French supermarket refrigeration

Why it matters for UK organisations

CISA lists this equipment as deployed worldwide in the commercial facilities sector. Supermarkets, convenience chains, cold stores, food distributors, pharmacies and hospital catering all depend on the same class of system manager. In the UK they are usually installed and maintained by refrigeration contractors rather than IT, and remote access set up for out-of-hours alarm response is rarely revisited.

The French incident also changes the threat model. Most retail security programmes are built around card data, customer records and ransomware on corporate IT. This attack produced physical loss, food waste, fire alarms and potential safety issues without, as far as has been reported, touching any of that. For organisations designated as essential services, and for suppliers to them, it is a clear example of the operational technology risk that UK resilience regulation is increasingly concerned with.

Expert view

In my experience, building management and refrigeration controllers are among the most neglected devices on any network we assess. They rarely appear in the asset register, often keep installer credentials, and sit behind port forwards opened for long-forgotten maintenance contracts.

The detail that worries me most is that the attackers used a normal function. A defrost command is a routine instruction, so signature-based tools will not flag it. The Team82 work on falsified temperature readings matters too: the controller’s own dashboard cannot be treated as the single source of truth. Detection has to come from independent signals, such as standalone temperature loggers, alerts on configuration or setpoint changes, and network monitoring of who is talking to the controller.

Response is the other gap. A SOC that sees an unusual login to a refrigeration manager at 2am needs a playbook. It should say who calls the contractor, who can isolate the device without stopping cooling, and who decides when stock is discarded.

What to do now

  1. Find every controller. Ask facilities teams and refrigeration contractors for a list of Danfoss and other system managers, with firmware versions. Run external attack surface scans of your own IP ranges for exposed management interfaces. This maps to the Cyber Essentials firewall control.
  2. Take them off the internet. Remove direct port forwards. Put remote engineer access behind a patched VPN or a brokered remote access service with multi-factor authentication, and use allow-lists where possible. This covers the Cyber Essentials firewall and user access control requirements.
  3. Patch and harden. Replace obsolete models and move AK-SM 800A units to current firmware: at least R4.2 for CVE-2025-41450, and R4.3.1 or later for the Team82 issues. Change installer and default passwords and turn off unused services. This maps to security update management and secure configuration.
  4. Segment. Separate building and refrigeration controllers from corporate and point-of-sale networks, and restrict which hosts can reach them.
  5. Monitor independently. Forward controller logs and authentication events to your SIEM. Alert on setpoint and defrost schedule changes outside maintenance windows, and keep separate temperature loggers in critical cold rooms.
  6. Write the playbook. Agree escalation paths with contractors and define safe manual fallback modes. Check whether your insurance actually covers cyber-induced stock loss.

Bottom line

A legitimate defrost function, outdated software and poorly secured remote access were enough to spoil food across hundreds of French stores in a single night. UK retailers should treat refrigeration and building controllers as security-relevant assets: inventory them, take them off the open internet, and give the SOC visibility of them before someone else finds them.

Sources

Related Posts