French supermarket attack exposes refrigeration kit outside IT’s reach

On the night of 11–12 October, attackers took remote control of refrigeration controllers made by Danfoss, the Danish engineering group, at supermarkets across France and set cabinets defrosting instead of cooling. BFMTV, as reported by Help Net Security, named stores belonging to Groupement Mousquetaires (Intermarché, Netto), Coopérative U and Leclerc. BleepingComputer added Carrefour Market and Monoprix to the list. Estimates of scale vary: BleepingComputer, citing BFMTV, put the count at 250 to 350 stores, while trade title Cooling Post said reported incidents suggest around 500.

According to SecurityWeek, temperatures were reportedly pushed to 50°C, some equipment reportedly ran warm for six hours before staff noticed, and retailers in Belgium, Germany, the Netherlands, Poland, Portugal and Spain were also affected, though it gave no detail for any of them. Cooling Post put the loss of fresh and frozen food in the millions of euros. Workers at some affected shops reported salvaging stock because the attacks landed near opening time or managers were alerted in time, according to Help Net Security. Dominique Schelcher, chief executive of Coopérative U, said on X that targeting the equipment “is of extreme gravity and is unprecedented”, according to an automated translation reported by SecurityWeek.

Danfoss’s explanation, given to Cooling Post on 12 October, puts the weight on the age of the installed base. The company said most affected units were legacy products: the AK-SM800, declared end-of-life in 2021, and the AK-SC355, phased out in 2016. Neither receives updates. Current AK-SM800A systems were also affected where they ran outdated firmware. Danfoss said it has long urged customers to keep supported systems updated and to migrate legacy systems, and that it is working with affected customers on mitigation, including firmware updates where available, stronger network protections and removing direct internet exposure where applicable.

That account moves the problem away from a single vendor’s code and toward the way businesses buy and run plant. A refrigeration controller arrives as part of a capital project, is serviced by a refrigeration contractor and is connected to the internet so that someone can watch alarms remotely. It rarely appears on the IT team’s asset register or in its patch cycle. The French attack has turned that equipment from a maintenance line into a business continuity risk with a direct cost in stock, and one that sits largely outside the governance applied to laptops and servers.

Kit that outlives its support

A controller phased out in 2016 was still running stores a decade later, because the cabinets and compressors it manages were bought to last far longer than any software support window. Replacing a controller that still works is a capital decision with no visible return until a night like this one.

The weaknesses in current models were public. In August, Claroty’s Team82 disclosed flaws in the AK-SM 800A, including an authentication bypass and remote code execution, fixed in firmware R4.3.1. It counted 2,765 exposed devices in a Censys scan. BleepingComputer reported that Predicta Lab’s chief executive found 2,752 Danfoss systems online, 1,590 of them in France. Help Net Security noted that Team82 also disclosed flaws in Copeland’s XWEB Pro controllers at the same time, so the issue is not confined to one brand. Nobody has confirmed that any of these flaws were used on 11–12 October, and how the attackers got in has not been made public.

Who owns the controller

In a typical mid-market operator, three parties touch a refrigeration controller and none owns all of it. Facilities managers specify and budget for the plant. The refrigeration contractor installs it, configures remote monitoring and logs in when an alarm fires. The IT team may never have been told the device is on the network, let alone which firmware it runs. Each party can reasonably assume another is watching.

Claroty’s own guidance shows how much of the fix falls into that gap. It recommends upgrading to R4.3.1 or later, keeping management interfaces off the open internet and restricting administrative access to trusted networks, VPNs and segmented connections. Every one of those steps assumes someone on the customer side knows the controller exists, where it is connected and whose credentials reach it. Danfoss’s mitigation list makes the same assumption.

What changes for cold-chain operators

The French attack is a supermarket story, but Claroty says the same controllers run in cold-storage facilities, warehouses and other commercial environments. None of the reports describes data theft or encryption. The cost was a night’s worth of stock and the labor to clear cabinets, all triggered by machines carrying out a defrost cycle they were designed to run.

Spoiled inventory caused by remote commands to mostly unsupported controllers is a different kind of cyber loss from stolen data or encrypted servers. Coopérative U, Leclerc, Intermarché and Carrefour Market were among the chains reported hit, and Schelcher said on X that Coopérative U teams were working with refrigeration specialists to restore the systems.

For the AK-SM800 and AK-SC355 units that made up most of those affected, Danfoss has no firmware to offer. What remains on its list is network protection, removing internet exposure and the migration it says it has long urged, and each depends on someone at the operator knowing the controller is there.