French supermarket fridges were pushed to 50°C overnight through Danfoss controllers that no longer get security updates
Description
In October 2026, a large-scale cyberattack targeted French supermarket refrigeration systems, remotely raising temperatures to 50°C and causing food spoilage, fires, and sprinkler floods. The attack exploited legacy Danfoss refrigeration controllers (AK-SM800 and AK-SC355) that no longer receive security updates. These controllers were accessible via the internet, allowing attackers to force defrost cycles and disrupt food preservation across hundreds of stores. The incident caused significant financial losses and operational disruption. The exact attack vector remains undisclosed, but known vulnerabilities in unsupported firmware versions were previously documented. Recovery efforts are ongoing, with long-term impacts expected.
Reddit Discussion
On the night of October 11, someone got into the refrigeration controllers at French supermarkets and put them into forced defrost with the target set to 50°C. A store manager in Gradignan, quoted by [ITPro](https://www.itpro.com/security/cyber-attacks/french-fridges-hacked-in-country-wide-supermarket-attack), said it started around 11pm and staff found out at 4am, after the cold room hit 50°C and set off the sprinklers.
The store counts don't match yet. [BleepingComputer](https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/) cites French outlets putting it at 250 to 350 stores. AFP's per-chain figures, [via CBS](https://www.cbsnews.com/news/cyberattack-supermarkets-refrigerators-france-fires-food-losses/), have at least 300 Intermarché and Netto stores on their own, plus over 100 Coopérative U. Intermarché's CEO expects the losses to pass tens of millions of euros for that one day.
Danfoss told AFP most of the hit equipment was legacy AK-SM800 and AK-SC355 regulators that "no longer receive software or security updates". How the attackers got in isn't public. But the AK-SM 800A already had a [CISA advisory](https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03) from May 2025 for CVE-2025-41450, a login bypass built on a password generated from the device's date. [Claroty's Team82](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers) counted 2,765 of those panels exposed on Censys in August. On Monday, Baptiste Robert found 1,590 exposed Danfoss systems in France alone.
So it's an admin panel on the open internet and firmware nobody patches anymore. Those are the same two conditions I'd point to behind most WordPress takeovers, where it's a default login URL and a plugin its author walked away from.
Intermarché blamed an attack on a service provider that manages its store refrigeration, and Leclerc said one of its refrigeration suppliers was hit. Once Danfoss stopped shipping updates for those units, whose job was it to take them off the internet?
Links cited in this discussion
- https://www.itpro.com/security/cyber-attacks/french-fridges-hacked-in-country-wide-superma…
- https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-fre…
- https://www.cbsnews.com/news/cyberattack-supermarkets-refrigerators-france-fires-food-loss…
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03
- https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vuln…
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Attackers remotely accessed internet-exposed Danfoss refrigeration controllers used in French supermarkets, specifically legacy AK-SM800 and AK-SC355 models that lack ongoing security updates. They forced the refrigeration systems into continuous defrost mode, raising temperatures to 50°C, which triggered sprinkler systems and destroyed food stock. The vulnerability exploited includes a known login bypass (CVE-2025-41450) related to password generation from device dates. Despite patches for newer firmware, these legacy devices remain vulnerable due to discontinued support. The attack affected at least 300 Intermarché and Netto stores, among others, causing tens of millions of euros in losses. The incident highlights risks from unsupported industrial control systems exposed on the internet.
Potential Impact
The attack caused widespread food spoilage, fires, and flooding in hundreds of French supermarkets, leading to significant financial losses estimated in the tens of millions of euros for a single day. It disrupted the food supply chain and required extensive recovery efforts including system inspections and restocking. The incident also raised concerns about the security of legacy industrial control systems and their exposure to internet-based attacks. The operational impact is expected to last for months, affecting retailer reputation and customer trust.
Defensive Guidance
Danfoss has stated that the affected legacy controllers no longer receive software or security updates and has advised customers to migrate to supported, current-generation systems with updated firmware. Organizations using these legacy devices should disconnect them from the internet and replace them with supported models. Since no official patch exists for the legacy devices, removing internet exposure and upgrading hardware are critical. Monitoring and securing third-party service providers managing refrigeration systems is also recommended. Patch status for legacy devices is not applicable as they are no longer supported.
Affected Countries
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":30,"reasons":["external_link","newsworthy_keywords:security update","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":["security update"]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6ace99112cdf04f656acc7d9
Added to database: 10/13/2026, 20:48:17 UTC
Last enriched: 10/13/2026, 20:48:22 UTC
Last updated: 10/13/2026, 22:48:11 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.