Hijacked Danfoss Controllers Warmed Supermarket Fridges Across France

Overnight on 11 October, attackers remotely took over refrigeration controllers at hundreds of French supermarkets. They switched chilled and frozen cabinets into defrost and drove some up to around 50°C, and stores had to throw away food. France's national CERT has issued an urgent alert. The way the attackers got in has not been established, and no one has been publicly blamed.

What happened

The devices involved are Danfoss store controllers. A single box manages every fridge and freezer in a shop, and refrigeration contractors often administer it remotely. CERT-FR, part of the national cybersecurity agency ANSSI, said on 12 October that it knew of numerous compromises affecting two controller families, AK-SM and AK-SC. ANSSI's director called it urgent to take them off the internet or filter access tightly.

According to statements the retailers gave to AFP, Reuters and RTL, the impact was wide but uneven:

Outcomes varied too. Coopérative U said the cold chain held in most of its affected stores because staff and contractors reacted quickly. Intermarché said its affected stores discarded all of the products concerned, and the group's head expects losses in the tens of millions of euros. Paris prosecutors have opened an inquiry that covers lost stock and equipment that reportedly started to catch fire. A Sekoia analyst told Reuters that Spain, Portugal, Poland, Germany and Belgium were also hit, but no details have been published.

What we know about the controllers

• AK-SM 800: end-of-life since May 2021, so it gets no software or security updates.
• AK-SC 355: phased out in 2016, also with no updates.
• AK-SM 800A: the current model. Some units running outdated firmware were also affected. Danfoss listed a 5.3.x package as the latest on 13 October.

Danfoss says most of the affected units were the older, unsupported models. It described the incident as affecting "a limited number" of systems.

On vulnerabilities, keep the hedge. In 2025, researchers disclosed three AK-SM 800A flaws: an authentication bypass (CVE-2025-41450, versions before 4.2), command injection (CVE-2025-41451) and denial of service (CVE-2025-41452). The last two require a login, and all three were fixed by 4.3.1. The researchers also counted thousands of these interfaces exposed online. Neither Danfoss nor French authorities have linked these CVEs to this attack. A government source said ANSSI had found a vulnerability in the vendor's software, but did not say it was used. CERT-FR has not published indicators of compromise.

Why it matters

This is operational technology with physical consequences: spoiled stock, safety risk and possibly fire. It reached a sector that rarely thinks of itself as critical infrastructure. Retailers often don't buy these systems directly. Contractors install and run them, so exposure can hide in a third party's remote-access setup. End-of-life controllers that are still in service and reachable from the internet cannot be patched, and isolation is the only real control. Danfoss's own history shows the same pattern: earlier attacks on AK-SM 800 units in Russia and Israel in 2022 involved stores without proper firewall or VPN protection.

What to do

1. Find every Danfoss AK-SM / AK-SC controller in your estate, including units managed by refrigeration contractors. Ask them directly.
2. Take management interfaces off the internet. If remote access is unavoidable, allowlist trusted IPs as a stopgap, then move access behind a single managed VPN or jump host.
3. If compromise is possible, follow CERT-FR's order: restrict access to service providers only → factory reset → apply all available fixes → rotate passwords and secrets → review accounts → fully reconfigure.
4. Upgrade the AK-SM 800A to the latest firmware. Units on 3.x must pass through 4.x first, and 5.3.x cannot be downgraded. Version 4.0+ enables Strict Session Control and enforces HTTPS by default.
5. Plan to replace the AK-SM 800 and AK-SC 355. No fixes are coming for them.
6. Monitor temperatures out-of-band and alert on sudden defrost or setpoint changes, so staff can react before stock is lost.

Reporting credit: original coverage by The Hacker News, drawing on CERT-FR, AFP and Reuters. This summary was written by the 4Tify Team.