French supermarket fridges forced into defrost: internet-exposed Danfoss controllers hijacked

What happened

Overnight on Sunday 11 October 2026, attackers remotely took over supermarket refrigeration controllers in France and triggered their built-in defrost function, raising temperatures in fridges and freezers (BleepingComputer). BFM TV reported setpoints of up to 50 C, and in some stores temperatures rose for six hours before staff noticed (SecurityWeek). Fires broke out at several stores (Al Jazeera).

Who was hit. Counts come from retailers and press reports and differ:

SecurityWeek also lists stores in Belgium, Germany, the Netherlands, Poland, Portugal and Spain. Intermarche’s CEO Thierry Cotillard estimated losses of “tens of millions of euros nationwide in a single day” (Al Jazeera); BFM TV counted EUR 270,000 of lost stock at one Intermarche and one Super U in Haguenau alone (Infosecurity Magazine).

Timeline:

• 9 August 2026: Claroty Team82 published three flaws in the Danfoss AK-SM 800A store management platform and found 2,765 exposed devices on Censys, identifiable by the “Danfoss StoreView” page title (Claroty). At DEF CON 34 the same month, Claroty showed a compromised AK-SM 800A could disable cooling while falsifying temperature readings (Infosecurity Magazine).
• 11 to 12 October: the attack. Intermarche said it followed “a cyberattack reportedly affecting a service provider that manages refrigeration systems in stores” (BleepingComputer).
• 12 October: the Paris prosecutor’s office opened an investigation into “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France” (BleepingComputer). CERT-FR issued alert CERTFR-2026-ALE-012, saying it was aware of “numerous compromises” of these controllers (CERT-FR). Predicta Lab’s Baptiste Robert counted 2,752 Danfoss systems exposed online, 1,590 of them in France (BleepingComputer).
• 13 October: CERT-FR added Copeland xweb and Dixell xweb supervisors to the alert (CERT-FR). Prime Minister Sebastien Lecornu ordered ANSSI to investigate; ANSSI identified a vulnerability in Danfoss software (Al Jazeera). The retail federation FCD called on Danfoss for “full transparency”.
• 16 October: CERT-FR updated its recommendations (CERT-FR).

What Danfoss said. Danfoss said it was “aware of incidents in France affecting a limited number of refrigeration management systems” and that the affected units “were running outdated firmware” (Al Jazeera). It confirmed the targeted models were either obsolete (AK-SM 800 and AK-SC 355) or not updated (AK-SM 800A) (Infosecurity Magazine).

How attackers got in: not confirmed. Infosecurity Magazine reports the stores ran consoles with remote control that “lacked a secured communication channel”. Whether the attackers used the Claroty flaws is unknown (SecurityWeek). Those flaws are, per Claroty:

No group has claimed the attack and no attribution has been made.

Am I affected?

You are exposed if you own, or a refrigeration contractor runs for you, any of the products in the CERT-FR alert: Danfoss AK-SM series, Danfoss AK-SC series, Copeland xweb or Dixell xweb (CERT-FR), and its web interface can be reached from the internet.

Check from outside your network (a phone hotspot or a cloud VM), against each store’s public IP:

# Danfoss AK-SM 800A web UI identifies itself as "StoreView" (Claroty)
curl -sk --max-time 10 "https://STORE_PUBLIC_IP/" | grep -i -o 'storeview' \
  && echo "EXPOSED: Danfoss management interface reachable from internet"
curl -s  --max-time 10 "http://STORE_PUBLIC_IP/"  | grep -i -o -E 'storeview|danfoss|xweb|dixell'

Then, on each unit:

• Model and firmware. Danfoss calls the AK-SM 800 and AK-SC 355 obsolete. An AK-SM 800A below R4.3.1 is missing the Claroty fixes (Claroty).
• Defrost schedules and setpoints. CERT-FR asks operators to review the full configuration, especially defrost schedules (CERT-FR).
• Do not trust the controller’s own temperature display alone. Claroty showed a compromised AK-SM 800A can report false temperatures while cooling is off. Compare against a standalone probe or data logger in each cabinet.

What to do now

CERT-FR’s steps, in order (CERT-FR):

1. Remove internet exposure from the affected units and from any unit on a public IP address. CERT-FR notes you should check your insurance terms before cutting the data link to your refrigeration contractor.
2. If a unit was compromised: restart it, or restore factory settings if a restart is not enough, then reconfigure it before returning it to service. CERT-FR warns that a factory reset removes existing persistence but leaves the device vulnerable, so an exposed end-of-life unit “will likely be compromised again”.
3. Restore remote access only through a secure VPN or protected network. Filtering the contractor’s source IPs on a firewall is acceptable as an emergency measure only.
4. Apply vendor hardening. For Danfoss this includes setting the security level to Strict and changing default passwords. Update AK-SM 800A to firmware R4.3.1 or later (Claroty). For Dixell xweb, follow Dixell’s secure use recommendations, referenced by CERT-FR.
5. Plan to replace AK-SM 800 and AK-SC 355. Danfoss calls them obsolete, and CERT-FR warns that keeping an end-of-life device with no security fixes on the internet carries a very high risk of compromise.
6. Ask your refrigeration contractor in writing how they connect to each store’s controllers, which accounts they use, and whether those interfaces were reachable from the internet on 11 October.

Sources

• CERT-FR, CERTFR-2026-ALE-012: incident targeting refrigeration remote controllers, 12 October 2026, updated 13 and 16 October
• BleepingComputer, Cyberattack shuts down refrigerators at French supermarkets
• SecurityWeek, Refrigeration controller hack spoils food across European supermarkets
• Infosecurity Magazine, Major French supermarket chains hit by cyber-attack
• Al Jazeera, Hundreds of supermarkets in France hit by “unprecedented” cyberattack
• Claroty Team82, Freeze the controller, defrost the food: vulnerabilities in Danfoss refrigeration controllers, 9 August 2026
• Dixell, Recommendations for secure use of XWEB supervisors (French, PDF)