Attackers hijack Danfoss refrigeration controllers at French supermarkets

Attackers took control of refrigeration controllers at hundreds of French supermarkets overnight from Sunday 11 to Monday 12 October 2026 and forced fridges and freezers into a defrost cycle, according to the retailers affected. Les Mousquetaires, which owns Intermarché, said its units were heated to as much as 50°C.

What happened? #

On 12 October, CERT-FR, the French government's computer emergency response team, published an alert saying it is aware of numerous compromises of Danfoss AK-SM and AK-SC series controllers. These devices manage the fridges and freezers in a store.

Danfoss told the trade publication Cooling Post that most of the affected units were legacy products or current products running outdated firmware:

• AK-SM800: declared end of life in 2021. No longer receives software or security updates.
• AK-SC355: phased out in 2016. No longer receives software or security updates.
• AK-SM800A: the current model. The affected units were running outdated firmware.

Which retailers were affected? #

Retailers gave their own figures, and they differ between outlets. The Hacker News compiled them from company statements:

Intermarché told AFP that affected stores had to throw away all fresh and frozen products concerned. Coopérative U's chief executive said the cold chain held in most of its affected stores.

How did the attackers get in? #

That has not been established. CERT-FR's alert names no vulnerability, firmware version or entry point. It does say that exposing a management interface to the internet goes against good practice.

In August, researchers at Claroty described three flaws in the AK-SM 800A that Danfoss had fixed in firmware R4.3.1. Neither French authorities nor Danfoss has linked those flaws to this attack.

No one has publicly claimed or been blamed for the attack. The Paris prosecutor's office has opened an inquiry, AFP reported.

What should operators of Danfoss controllers do? #

CERT-FR's instruction for every AK-SM and AK-SC instance is to disconnect it or filter access to it. Where remote administration is essential, restricting access to trusted IP addresses is a first, temporary step.

If a compromise is suspected, CERT-FR lists six steps, in this order:

1. Restrict network access to the controllers to service providers only.
2. Perform a factory reset.
3. Apply all available security fixes.
4. Rotate secrets such as passwords.
5. Check existing accounts.
6. Reconfigure the device completely.

Because the AK-SM800 and AK-SC355 no longer receive updates, step 3 offers their owners no new fix. Danfoss says it has long advised customers to migrate legacy systems to current-generation products, and that it is working with affected customers on firmware updates where available, stronger network protections and removing direct internet exposure.