Interesting Read

The cyber-attack targeted refrigeration systems in multiple French supermarket chains, including Coopérative U, Groupement Mousquetaire, Carrefour, and others. Attackers exploited vulnerabilities in outdated Danfoss refrigeration controllers (models AK-SM800, AK-SC355, AK-SM800A) that had remote-control features without secure communication channels. This allowed hackers to remotely trigger forced defrost cycles and raise temperatures up to 50 °C, causing widespread food spoilage and financial damage. Danfoss had previously disclosed critical vulnerabilities in these controllers (e.g., CVE-2023-25915, CVE-2025-41450, CVE-2025-41451, CVE-2025-41452) that could allow privileged access and manipulation of physical equipment. Research by Claroty’s Team82 demonstrated how compromised controllers could falsify temperature readings to conceal failures. Many such devices remain exposed to the public internet, increasing attack surface. Danfoss advises keeping systems updated and plans to showcase new products with integrated cybersecurity features. The incident is under investigation by French authorities.

The attack caused significant operational disruption by manipulating refrigeration systems, leading to food spoilage and financial losses estimated in the hundreds of thousands of euros for some stores. Approximately 150 Intermarché stores, 30 Netto stores, 80 Carrefour stores, and 5% of Monoprix supermarkets were affected. The incident also raised concerns about food security and supply chain integrity. The attack exploited known vulnerabilities in obsolete or unpatched refrigeration controllers, demonstrating the risk of industrial control systems being accessible remotely without adequate security. The incident triggered legal and insurance investigations and drew condemnation from European food security officials.

Danfoss has advised businesses to keep refrigeration control systems updated and supported. Organizations should ensure that management interfaces for industrial control systems are not exposed insecurely to the public internet. Access to administrative services should be restricted to trusted networks or secured through VPNs and network segmentation. The affected Danfoss models are obsolete or unpatched, so upgrading to supported versions with integrated cybersecurity features is recommended. The vendor is actively promoting new products with enhanced security. French authorities are investigating the incident. No indication that the vulnerability is already fully mitigated without updates.