Danfoss cyberattack: supermarket refrigeration controllers hijacked

A night of forced defrost

During the night of Sunday October 11 to Monday October 12, 2026, the refrigerated cases of several hundred French supermarkets started to heat up. The attackers never had to set foot in a store. They went through the system manager, the small server that runs a store's entire refrigeration plant, and triggered defrost cycles over and over, with absurd setpoints. By morning, fresh and frozen food was going in the bin.

The equipment involved is made by Danfoss: ADAP-KOOL system managers from the AK-SM and AK-SC ranges, whose web interface was reachable from the Internet. On October 13, CERT-FR (the French government CERT) extended its alert to Copeland and Dixell XWEB controllers. No encryption and no data theft have been reported. The cold chain itself was the target, and AFP called the attack unprecedented.

What happened

The method is the same wherever it has been described. The attackers did not switch the cold off, they turned it around. Defrost is a normal function that briefly warms the evaporator to melt the ice. Triggered continuously, with the setpoint pushed up, it turns a refrigerated case into an oven.

According to Les Mousquetaires (the Intermarché group), quoted by Reuters, temperatures rose to as much as 50 °C for about six hours during the night. A Carrefour Market manager in Rennes told AFP he saw his freezers set to 95 °C in his app. Le Monde, as relayed by TIME, reports that the defrost duration of some cold rooms went from one hour to eight, which delayed the alarms.

That last point deserves a moment. A refrigeration controller knows that defrost raises the temperature, so it usually holds off its temperature alarms during the cycle rather than waking the on-call technician every time. Stretch the defrost, and you stretch the window in which nobody gets warned. We do not know yet whether the attackers did this on purpose. The outcome is the same either way.

Affected retailers, based on their own statements and wire reports:

Losses carry the same uncertainty. Thierry Cotillard, CEO of Intermarché, speaks of "tens of millions of euros" nationwide in a single day. Locally, published figures give the order of magnitude: about €270,000 for two Intermarché stores in Haguenau, €60,000 in Étréchy, €55,000 in Issy-les-Moulineaux. And insurance may not follow: Intermarché calls it "one of the sticking points".

The Paris prosecutor opened an investigation, handed to the national anti-cybercrime office (OFAC), which is tasked with identifying victims and linking damage to the attack, food losses and "the outbreak of fires" included. The Prime Minister asked ANSSI, the French national cybersecurity agency, to take up the case. According to a source close to the Prime Minister's office quoted by Reuters and AFP, the agency identified a vulnerability in software from the Danish vendor and contacted it. No CVE has been named.

Outside France, the picture is unclear. Félix Aimé of Sekoia, quoted by Reuters, mentions cases in Spain, Portugal, Poland, Germany and Belgium. The Belgian retail federation Comeos, for its part, said it had seen no problems in Belgium.

What a refrigeration system manager controls

In a supermarket, every refrigerated case and every cold room has its own controller. The system manager ties them together: it sets temperature setpoints, schedules defrosts, collects alarms and forwards them by email or to the on-call technician. At Danfoss, that is the job of the AK-SM System Managers, accessed through a web interface called StoreView. Claroty puts it in one sentence: the system effectively becomes "the operational control center" of the refrigeration infrastructure.

It also keeps the HACCP log, the temperature records that prove to food safety inspectors that the cold chain was not broken. EU Regulation 852/2004 is clear on the principle: the cold chain must not be interrupted. An attacker who controls the system manager therefore controls both the cold and the proof of the cold. We have seen nothing suggesting records were falsified that night, but this double grip is what makes the device so sensitive.

Why is it on the Internet at all? Because the store does not run it alone. The refrigeration contractor monitors it remotely, responds to a night alarm, adjusts a defrost without driving over. The shortest way to give them that access has often been to open the interface on the store's public address. CERT-FR's alert hints at it in its own way: before cutting the data link to the contractor, check your insurance policy. It is easy to guess why: a policy can make coverage conditional on that remote monitoring.

That is also why these devices so often slip through inventories. The contractor buys them, installs them and administers them. They appear neither in IT's CMDB nor in the scope of the last audit.

The products involved

Danfoss told Reuters it is "aware of incidents in France affecting a limited number of refrigeration management systems". To AFP and Cooling Post, the vendor added that most of the affected devices are legacy products that are no longer maintained, and that the rest are current products running outdated firmware.

One detail matters for what follows: in October 2025, Danfoss announced a "hard End of Service" policy for its legacy products, AK-SM 800 and AK-SC 355 included. In other words, a large part of the attacked fleet will never receive another fix.

Known flaws, and what we still don't know

These system managers are not a discovery of this week. Several research teams have documented them since 2023, and the vendor has shipped fixes for its current range.

The three 2025 CVEs were found by Claroty Team82 and picked up by CISA in advisory ICSA-25-140-03. Claroty published its detailed analysis on August 9, 2026, counting 2,765 AK-SM 800A devices exposed to the Internet according to Censys.

Which leaves the question everyone is asking: how did they get in? No authority has tied the attack to a CVE. Claroty wrote on October 12 that no details are available yet on how the attackers gained access. Several researchers, including Kevin Beaumont and Clément Domingo, point to a password that can be worked out from the current date.

The hypothesis fits what we know. The "code of the day" mechanism Synacktiv documented on the AK-SM 800 was never fixed, since the product is end of life. The same class of flaw existed on the AK-SM 800A before version 4.2. And Danfoss itself says the affected devices are mainly AK-SM 800, AK-SC 355 and AK-SM 800A units with old firmware. Consistent does not mean established: we treat it as the most likely lead, not as a fact.

Timeline of the Danfoss attack

Put back in order, the story is mostly one of a fleet that aged in plain sight. The warning signs had been public for three years.

Timeline

From end of life to attack

Before the attack

1. May 2021

   the AK-SM 800 reaches end of life, no more security updates.

2. May 2023

   Synacktiv publishes an authentication bypass on the AK-SM 800, never fixed.

3. March 2025

   Danfoss fixes a flaw of the same kind on the AK-SM 800A (CVE-2025-41450, version 4.2).

4. August 2025

   two more AK-SM 800A flaws are fixed in version 4.3.1.

5. August 2026

   Claroty counts 2,765 AK-SM 800A units exposed to the Internet.

The attack

1. Night of October 11 to 12, 2026

   forced defrost in hundreds of supermarkets, up to 50 °C.

2. October 12, 2026

   Paris prosecutor investigation, ANSSI called in, CERT-FR alert.

3. October 13, 2026

   the alert widens to Copeland and Dixell XWEB controllers.

The hardest finding lies in the gaps. More than three years passed between the first public advisory on the AK-SM 800 and the attack. More than a year passed between the AK-SM 800A fix and the attack. The problem was not a lack of information, but the lack of anyone to receive it: when a device appears in no inventory, the advisory that concerns it reaches nobody.

Are you affected?

Grocery retail is on the front line, but it is not alone. Any site that keeps food cold under centralized supervision may run the same equipment: logistics warehouses, distribution centers, central kitchens and contract catering, food manufacturing.

The right questions are few, and most of them go to the refrigeration contractor:

• Which system manager runs each of our sites, and what firmware version is it on?
• Is its interface reachable from the Internet, directly or through a port forward on the store's router?
• How does the contractor reach it: VPN, managed remote access, or an open public address?
• Have the commissioning passwords been changed, and by whom?

What to do now

CERT-FR's recommendations are clear, and we list them in the order to apply them.

1. Remove Internet exposure from every system manager, including those that carry a public IP address nobody knew about. Check your insurance policy before cutting the data link to the contractor, not after.
2. Review the entire configuration, starting with defrost schedules. A setpoint changed that night may well lie dormant until the next cycle.
3. Restore remote access only through a VPN or a protected network. Filtering the contractor's addresses on a firewall is an emergency stopgap, not a lasting fix.
4. Apply the vendor's good practices: update the firmware (4.3.1 at least on the AK-SM 800A, which fixes all three 2025 CVEs), set the security level to "Strict", change default passwords.

If the device was compromised, CERT-FR says to isolate it, restore it to factory settings, then reconfigure it before putting it back into service, with VPN-only access. But it adds a warning to take literally.

Use the downtime to review the HACCP logs of the past few days. If the readings for the night of October 11 to 12 look normal while the goods clearly suffered, that is worth reporting to investigators.

What the incident says about attack surface

How many system managers are exposed? It depends on who counts and how. Claroty counted 2,765 (AK-SM 800A only, via Censys) in August. On October 12, researcher Baptiste Robert of Predicta Lab counted 2,752 of all generations, 1,590 of them in France. Shodan tracks more than 4,500. These figures do not measure the same thing, and none of them is a complete census. But the only per-country count published so far puts more than half of the exposed fleet in France.

This is not a technical inevitability. It is the result of an installation habit: a device set up by a third party, opened to the Internet for the convenience of maintenance, then forgotten by everyone who keeps an inventory. IT does not see it, the auditor does not have it in scope, the contractor does not consider its security their job. We made the point in our article on external attack surface inventory: you can only fix what you know is exposed.

On the regulatory side, the NIS 2 directive covers, in the food sector, wholesale distribution and industrial production and processing. A supermarket is not covered as such, while a logistics platform or a food manufacturer may be. We cover what the French transposition changes in our article on the Resilience law. But it would be a shame to wait for a law before taking a device that runs the cold off the Internet.

Where Flawfence comes in

Let us be precise about what our tool does, and what it does not. Flawfence starts from your domains to rebuild your external surface: subdomains, IP ranges tied to your organization, exposed services and technologies. An admin interface open within that perimeter shows up in the inventory of exposed services, with the technology when it can be read, and continuous monitoring flags the day a new service appears.

The limit is real: a system manager plugged into a store's Internet line, with no domain name and on an address assigned by the ISP, is tied to nothing that points back to you. For those devices, the starting point is still an inventory of each site's Internet connections, and the question put to the refrigeration contractor.

Frequently asked questions

Which Danfoss devices are targeted by the attack?

Refrigeration system managers from the AK-SM and AK-SC series, according to alert CERTFR-2026-ALE-012. Danfoss says most affected devices are AK-SM 800 units (end of life since 2021) and AK-SC 355 units (phased out in 2016), the rest being AK-SM 800A units with outdated firmware. On October 13, CERT-FR added Copeland and Dixell XWEB controllers.

Does the attack exploit a known CVE?

This has not been officially established as of October 13, 2026. Neither the authorities nor the vendor have named a CVE. Several researchers point to an authentication mechanism based on a date-derived password, documented on the AK-SM 800 by Synacktiv in 2023 and on the AK-SM 800A before version 4.2 (CVE-2025-41450). It is the hypothesis that best fits the affected products, not an investigative finding.

Is changing the admin password enough?

No. If access goes through a code computed from the date, it does not depend on the password you choose. On an AK-SM 800A, updating (4.3.1 at least) removes the known flaws. On an AK-SM 800 or an AK-SC, no fix exists: take the device off the Internet and plan its replacement.

How can I tell whether my system manager is exposed to the Internet?

List your sites' public IP addresses and check, from an outside connection, whether any of them shows a StoreView page or a Danfoss interface. Also ask your refrigeration contractor how they reach the installations. Access without a VPN almost always means direct exposure.

Is a factory reset enough after a compromise?

Not on an end-of-life device. CERT-FR states that a plain factory reset leaves the device vulnerable and that it will almost certainly be compromised again if it stays exposed. Restore it, reconfigure it, make it reachable only through a VPN, and replace models that no longer receive updates.

Are countries other than France affected?

Possibly, but it is not confirmed. Sekoia, quoted by Reuters, mentions Spain, Portugal, Poland, Germany and Belgium, while the Belgian federation Comeos says it has seen no problems in Belgium. On October 12, researcher Baptiste Robert placed 1,590 of the 2,752 Danfoss systems he saw exposed to the Internet in France, more than half.

Key takeaways

This attack required no novel exploit and no sophisticated malware. It required devices that run the cold, reachable from the Internet, and authentication that no longer protected much. Fixes existed for the current range, warnings were public for the old one. What was missing was an owner: someone who knew these interfaces existed, that they were open, and who would receive the alert the day it came out.

Check your exposure at flawfence.com

Sources

• CERT-FR, CERTFR-2026-ALE-012, Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, October 12, 2026, updated October 13, 2026
• Danfoss, Tech Insider October 2025, October 31, 2025
• Danfoss, security advisory DSA-2025-03-01 and DSA-2025-08-01
• CISA, ICSA-25-140-03, Danfoss AK-SM 8xxA Series, May 20, 2025, updated August 26, 2025
• Claroty Team82, Freeze the Controller, Defrost the Food, August 9, 2026, and October 12, 2026 post
• Synacktiv, Authentication bypass in Danfoss System-Managers models SM800 & SC255, May 2023, updated October 31, 2023
• DIVD, case DIVD-2023-00025
• Reuters, via Insurance Journal, October 13, 2026
• franceinfo and AFP, What we know about the cyberattack that heated up supermarket fridges (in French), October 13, 2026
• Cooling Post, Danfoss moves to mitigate cyberattack, October 12, 2026
• BleepingComputer, Cyberattack shuts down refrigerators at French supermarkets, October 12, 2026
• LeMagIT, Cyberattaque Danfoss : quand la distribution alimentaire découvre l'hygiène numérique (in French), October 12, 2026