Shared Danfoss Controllers Left French Store Fridges Open

A cyberattack on French supermarket fridges pushed units to about 50C overnight on 11 to 12 October, forcing stores to dump fresh and frozen food. The breach ran through refrigeration controllers made by Denmark’s Danfoss, a supplier shared by rival French chains.

Intermarche chief executive Thierry Cotillard put nationwide losses at tens of millions of euros in a single day. Prime Minister Sebastien Lecornu ordered the national cyber agency ANSSI to investigate, and his office said the agency had already found a flaw in software from that Danish firm.

Overnight Defrost Became a Six-Hour Heat Cycle

Staff walking into cold aisles on Monday morning found cases that had been heating instead of cooling. Attackers used a built-in defrost function that normally runs for about two hours in a day, then held it on. A Groupement Mousquetaires spokesman said units sat near 50C (122F) for about six hours.

In shops where the change began around midnight, meat, vegetables and frozen goods did not last until opening. An ice-cream case still read 26C on Monday. An Intermarche in Guerdedan said on Facebook that it had to throw all of its fresh products, including meat. The Paris prosecutor’s office opened a case into a large-scale attack on connected refrigerators and said it would tie that intrusion to food losses and fires.

THE NIGHT THE CASES WARMED

1. Sunday afternoon, 11 October 2026: Ahold Delhaize, in a separate event, begins taking Dutch systems offline after a security issue.
2. Sunday night into Monday, 11 to 12 October 2026: Attackers reach Danfoss refrigeration controllers in French stores and force a continuous defrost cycle.
3. Monday morning, 12 October 2026: Shop teams find spoiled stock, empty the cases, and start calling refrigeration specialists.
4. Monday, 12 October 2026: Coopérative U chief Dominique Schelcher confirms the attack on X; the Paris prosecutor opens a criminal inquiry.
5. Monday, 12 October 2026: Lecornu’s office says ANSSI has identified a vulnerability in Danfoss software and has contacted the vendor.

Schelcher, who heads the cooperative behind Super U, Hyper U and U Express, said teams were working with refrigeration specialists and that an inquiry would be needed to “shed full light on this attack.”

Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented. It is unacceptable.

Dominique Schelcher, chief executive, Coopérative U, on X

Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU.
Nos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra…

— Dominique Schelcher (@schelcher) October 12, 2026

Rival French Chains Share One Danish Controller

The banners compete on price and loyalty cards. They do not each run a private cold-chain stack. Store cases are steered by a control panel that can sit on the internet so a maintenance firm can change setpoints from elsewhere. When that panel is a Danfoss box, a single weak login path reaches Intermarche, Netto, Coopérative U, E. Leclerc, Carrefour and Monoprix at once.

That is the part the first headlines underplayed. No one needed to break Intermarche’s own office network, then repeat the job at Leclerc. They needed the remote path into the controller that several chains already used for defrost and alarms. Connecting those boxes for after-hours service is what made a vendor incident into a national dump of food.

E. Leclerc said a cyberattack had hit one of its refrigeration equipment suppliers and that the incident had affected cooling in several stores. Intermarche said a service provider that manages refrigeration in stores had been hit, and that Intermarche and Netto were pulling products from the dead units as fast as they could. Carrefour said the trouble “primarily affected 80 out of our 6000 stores.”

France’s food-retail federation, the FCD, called on Danfoss to give “full transparency.” It also said some of the hit stores were already running again.

Store Counts the Retailers Have Confirmed

Early on Monday the figures moved as each group counted its own shops. By 13 October the chains had given the AFP news agency a clearer set of totals, and those are the numbers that hold in this account.

CONFIRMED STORE HITS BY CHAIN

Local bills arrived faster than a national total. In Haguenau, in Alsace, an Intermarche lost its frozen stock, about €50,000. A nearby Leclerc threw out frozen and fresh goods worth about €220,000. Together those two shops reached €270,000 ($302,000). Cotillard’s “tens of millions of euros” line is the national figure for one day, not a second count of the same two aisles.

Intermarche told insurers and lawyers to start work and said it could not yet say how much food would be wasted across the group.

Danfoss Says the Hit Units Were Already Obsolete

Danfoss said it was “aware of incidents in France affecting a limited number of refrigeration management systems.” It said the affected units “were running outdated firmware” and that it had “long advised customers” to keep systems updated and to replace older equipment.

THE DANFOSS BOXES NAMED IN THE INCIDENT

• AK-SM800: End of life, and it no longer receives software or security updates.
• AK-SC355: Also end of life, with the same cutoff on patches.
• AK-SM 800A: Still in the field, but the hit units were running old firmware.

Those names matter because the attack did not invent a new physics trick. A supermarket freezer already knows how to heat itself. Defrost bars melt frost so the unit can cool again. Hold that heat on, and the same cabinet becomes a warming box. No exotic malware is required once someone can change the setpoint.

Danfoss is due at the Chillventa refrigeration fair in Nuremberg on 13 October, where it had planned to show a new drive with built-in cybersecurity features. The older boxes still sitting in French aisles are the ones that just dumped a day’s food.

What August’s Lab Demo Already Proved

In August, Claroty’s Team82 published research on the AK-SM 800A and showed how a compromised controller could stop cooling while lying about the temperature on the display. The write-up, presented at DEF CON 34, described a hidden code-of-the-day authentication mechanism, a command-injection bug that can lead to remote code execution, and a way for a logged-in user to inject Nginx settings and knock the web interface over. Team82 said it told Danfoss privately and that the firm shipped firmware R4.3.1 to close those holes.

The U.S. Cybersecurity and Infrastructure Security Agency had already flagged the same platform. In an August 2025 advisory, CISA said bugs in the AK-SM 8xxA series were exploitable remotely and that a successful attack could bypass authentication and execute code. The advisory lists a CVSS v4 score of 8.7. CVE-2025-41450 is an authentication bypass tied to a datetime-based password, fixed in release R4.2. CVE-2025-41451 and CVE-2025-41452 were fixed in 4.3.1.

None of that proves these CVEs were the door used on 11 October. It does show the door types were documented, patched in firmware, and still present on boxes that stores had not moved off.

CONTROLLERS STILL REACHABLE ON THE OPEN INTERNET

• Monday scan: Predicta Lab chief executive Baptiste Robert found 2,752 Danfoss systems exposed online the day the French stores were emptying cases.
• Inside France: 1,590 of those exposed systems were in France.
• The risk: A public login page on a fridge controller is a target list, not a convenience feature.

Robert’s count is a snapshot of what a researcher could see, not a victim list. It still explains how a remote defrost command can be aimed at hundreds of shops without walking into any of them.

Empty Apps and Last Week’s Prices in the Netherlands

While French stores were throwing out food, Ahold Delhaize said it was dealing with a security issue within its network. The Dutch group said teams were taking some systems offline to protect them and that stores were still open. It also said there was no reason to see a link with the French fridge attack.

Albert Heijn, the group’s main Dutch grocer, shut websites, apps and customer service. Online orders, about 10 percent of its sales, stopped. The chain cancelled all placed online orders and said paying customers would be compensated once systems return. Electronic shelf labels still showed the previous week’s promotions, so the till price could be higher than the tag. Loyalty savings on the Mijn AH app and personal cards were down, with a promise to make good missed discounts.

Etos and Gall & Gall, the group’s Dutch drugstore and drinks banners, were hit too. Sites for U.S. chains Stop & Shop, Giant, Hannaford and Food Lion showed downtime notices. Work at several Albert Heijn distribution centres stopped, which raises a later risk of thin fresh shelves even though the checkouts still run.

That outage is an IT lockdown. The French event is a physical one: heaters on, food gone. Mixing them into one European grocery hack blurs the vendor problem that only the French case has so far shown in public.

Food Waste, Fires and a Paris Inquiry

The Paris prosecutor’s office said the attack affected connected refrigerators at several major food retailers across France and that it would identify victims and link the intrusion to reported food losses and fires. Lecornu’s office said France was coordinating with European counterparts because other countries could be affected, and that officials were checking whether other French firms were at risk.

EU agriculture and food commissioner Christophe Hansen condemned the hack and wrote that “food security requires more attention at all levels,” adding that “the weaponisation of food has become a reality.” Felix Aime, a senior cyberthreat intelligence analyst at Sekoia, said Spain, Portugal, Poland, Germany and Belgium had also been affected. That wider map has not been confirmed by those governments.

WHAT WE KNOW

• The vector: Remote commands on Danfoss refrigeration controllers, including end-of-life AK-SM800 and AK-SC355 units and unpatched AK-SM 800A firmware.
• The effect: Forced defrost toward 50C, spoiled fresh and frozen stock, and fires cited by prosecutors.
• The French count: At least 300 Intermarche and Netto stores, more than 100 Coopérative U sites, 80 Carrefour stores, about 5 percent of Monoprix, and several E. Leclerc shops.

WHAT IS UNCONFIRMED

• The actor: No group has been named, and no ransom note has been published.
• The exact bug: ANSSI has identified a vulnerability in Danfoss software; it has not said which CVE was used.
• The bill: Cotillard’s tens of millions of euros is a one-day national estimate, not an audited loss.

ANSSI has the vendor on the phone, prosecutors have a fire-and-food file, and the FCD wants Danfoss to explain the controllers still hanging on the public internet. The cold cases that came back on Monday did so after staff pulled the plugs on remote control, not after anyone showed the shared software layer had been closed.