French Supermarket Fridges Hacked: Outdated Danfoss Firmware,…

Hundreds of French stores hit in attack on Danfoss refrigeration controllers. Unpatched firmware, temperatures forced to 50°C, physical damage and fires reported.

On October 12, 2026, the Paris prosecutor confirmed a large-scale attack on connected refrigeration controllers across several French food retail chains. Attackers forced temperatures up to 50°C in refrigerators and freezers, causing food losses and fires in hundreds of supermarkets. The French cybersecurity agency ANSSI identified software from Danfoss, a Danish specialist in industrial refrigeration components, as the entry point for the compromise.

Danfoss confirmed that the affected units were running outdated firmware. The company had previously released software updates to address documented vulnerabilities, but the compromised systems had not been patched. The case reignites the debate over the patch-management gap in industrial IoT, where the convenience of remote maintenance translates into an Internet-exposed attack surface.

Key Takeaways

ANSSI identified a vulnerability in Danfoss software as the cause of the attack on refrigeration systems at hundreds of French supermarkets.
Danfoss confirmed the compromised units ran outdated firmware; the company had previously released software updates.
Intermarché reported roughly 150 stores hit with forced heating to 50°C for six hours overnight; Carrefour confirmed 80 supermarkets.
Claroty Team82 research from August 9, 2026 documented vulnerabilities in the Danfoss AK-SM 800A controller, including authentication bypass and code execution.

ANSSI Pins Blame on Danfoss, Vendor Confirms Unpatched Firmware

The Paris prosecutor qualified the incident as a "large-scale" attack that struck "connected refrigerators in several major food distribution chains across France." Prime Minister Sébastien Lecornu tasked ANSSI with leading the technical investigation. According to sources close to the executive, the agency traced the exploited vulnerability to software supplied by Danfoss.

Danfoss issued a statement confirming that the compromised units "were running outdated firmware" and that the company "had long advised customers to keep supported systems updated." The wording suggests updates were available before the attack, but does not specify whether they were released in response to a prior advisory or as part of the regular maintenance cycle. The dossier does not clarify whether the AK-SM800 and AK-SC355 models cited by Danfoss in connection with the incident correspond to the AK-SM 800A model analyzed by Claroty.

150 Intermarché Stores, 80 Carrefour: The Numbers Behind the Chains Hit

The retail chains provided partial but converging data on the attack's scope. Les Mousquetaires, parent group of Intermarché, reported roughly 150 stores affected, with refrigerators heated to 50°C for six hours overnight. Carrefour confirmed 80 compromised supermarkets. Monoprix stated that 5% of its network was targeted. Coopérative U, through CEO Dominique Schelcher, confirmed it suffered the attack, calling it "of extreme gravity and unprecedented."

Félix Aimé of Sekoia Threat Detection and Research reported the attack extended beyond France, hitting Spain, Portugal, Poland, Germany, and Belgium. No infrastructure overlaps link the actor to a currently attributed state-sponsored group. The attackers' identity remains unconfirmed, as does the motive: the dossier documents no extortion demands, nor does it rule out pure sabotage.

Precisely documented economic damages center on two stores in Haguenau, Alsace. According to Hackread, an Intermarché store in the area estimated losses of roughly €50,000, while a Super U outlet quantified damages at roughly €220,000. The sum of the two documented cases alone reaches roughly €270,000. The dossier provides no estimates for total national or international losses.

Since August, Claroty Work on AK-SM 800A: Bypass and Code Execution

On August 9, 2026, two months before the attack, Claroty Team82 published research on the Danfoss AK-SM 800A controller. The study documents vulnerabilities allowing authentication bypass and code execution on compromised devices. Danfoss released software updates to address the vulnerabilities identified by Claroty. The temporal correlation between the research publication and the attack's onset is documented; it is not, however, proven that attackers exploited the same vulnerabilities described by Claroty.

Industrial refrigeration controllers are typically accessible via the Internet for remote maintenance. This interconnectivity, functional for distributed management of thousands of retail locations, exposes devices to attack surfaces reachable by remote actors. The mechanism documented in the attack — manipulation of defrost cycles into continuous heating — demonstrates that logical compromise translates into immediate physical impact on the cold chain.

"Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented" — Dominique Schelcher, CEO Coopérative U

Ahold Delhaize Separate, Fires Confirmed: Defining the Incident's Boundaries

The Paris prosecutor explicitly cited "food losses and fires" among the attack's consequences. CBS News reported that refrigerators "generated fires." The physical nature of the damage — forced heating of equipment designed to operate at refrigeration temperatures — crossed the threshold from mere digital disruption.

Ahold Delhaize, operator in the Netherlands and Belgium, confirmed a separate "security issue" but explicitly denied links to the French attack. The distinction, reiterated by The Guardian, serves to delimit the main incident's scope: the dossier documents no coordinated European campaign, but rather an attack focused on France with documented extension into at least five additional countries.

Why It Matters

The dossier documents no specific remedial measures imposed or recommended to victims. It does not specify the initial access vector: exposed remote access, compromised credentials, or other mechanisms are not detailed. It is unconfirmed whether the attack represents ransomware extortion or sabotage without financial demand. The exact total number of stores hit remains uncertain: estimates range from the hundreds cited by the prosecutor to the specific figures provided by individual chains, with discrepancies among editorial sources.

The source does not specify the nature of any data potentially exposed, nor whether compromised systems contained sensitive information beyond thermal control parameters. The dossier also does not clarify whether Danfoss software updates were applicable to the models actually hit, nor how many customers had implemented the fixes before the attack.

The incident constitutes a documented precedent of an OT attack with direct physical impact in the food retail sector, a domain traditionally classified as non-critical relative to national infrastructure. The functional dependence on connected controllers for the cold chain, combined with failure to manage patches, exposes a risk vector intersecting food safety, operational continuity, and EU regulation of IoT devices.

Information is based on cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter