A large-scale cyberattack targeting refrigeration and freezer equipment hit French supermarkets from the night of October 11, 2026, into October 12, leading to the disposal of large quantities of food. On October 12, France's computer emergency response team, CERT-FR, also warned that it had confirmed numerous compromises of refrigeration management devices made by Denmark's Danfoss. The attack exploited the ability to remotely control temperature settings and defrost cycles, and stores ended up losing food. The affected devices include both current products whose software can be updated and older products that are no longer supported. What is needed now is not just restoring refrigeration, but making sure the equipment cannot be attacked again.
Refrigeration temperatures raised to 50°C, leading to mass food disposal
According to Reuters on October 12, Les Mousquetaires, the retail group that owns the Intermarché supermarket chain, said the refrigeration equipment at about 150 stores was affected by the cyberattack.
The company explained that refrigeration temperatures were raised to 50°C and that the effect lasted about six hours. A spokesperson said the affected products were discarded to ensure food safety.
Another major retailer, Carrefour, also said about 80 of its stores were affected, and Paris prosecutors are investigating the incident.
However, the figure of about 150 Intermarché stores reflects the scale of damage the company had identified at the time of Reuters' report, and is not a final count of affected stores across France.
Nor has any measurement data been published showing that the 50°C temperature occurred in the refrigerators and freezers of every store. The extent of the damage and the temperature trajectory may differ by store and by equipment.
In alert CERTFR-2026-ALE-012, dated October 12, CERT-FR, which operates under France's national cybersecurity agency ANSSI, said it was aware of numerous compromises of Danfoss "AK-SM" and "AK-SC" series devices.
CERT-FR pointed out that exposing the management interfaces of such devices directly to the internet is not proper security practice. It urged operators to disconnect the affected devices from the internet or restrict access to them.
This incident differs from attacks in which data on computers is stolen or systems are shut down. Its defining feature is that a cyberattack changed the actual operation of refrigeration equipment, causing physical and economic losses in the form of mass food disposal.
The target: devices that centrally manage store refrigeration equipment
Danfoss's AK-SM series, at the center of this incident, consists of management devices that monitor and control multiple refrigeration and freezer units installed in supermarkets and similar facilities.
According to research published on August 9, 2026 by Team82, the research group at cybersecurity company Claroty, the "AK-SM 800A" allows refrigeration temperature settings and operating schedules to be changed from a browser.
Administrators can also review past alarm history and set permissions for each user. The system is designed so that technicians can check equipment status and carry out necessary maintenance without visiting the store in person.
This mechanism offers major advantages to retail chains operating many stores. On the other hand, if an attacker takes over access rights to a management device, multiple refrigeration units could be operated at once.
Cooling Post, a trade outlet covering the refrigeration industry, reported that in this attack the defrost function of the refrigeration equipment was put into continuous operation, causing internal temperatures to rise and leading to mass food disposal.
Defrosting is a normal maintenance function for removing frost from cooling equipment. But if defrost operation continues beyond its normal range, it interferes with the equipment's core function of cooling food.
In other words, the attackers did not necessarily add new functions to the devices. Even a legitimate function built into the equipment can cause serious damage if its timing and duration are changed illegitimately.
A distinction is needed here between being able to perform remote maintenance and having a management interface that anyone on the internet can try to access.
In its August research, Team82 examined AK-SM 800A management interfaces exposed on the internet. Results from Censys, a search service for internet-connected devices, showed that 2,765 units were accessible from outside.
However, this figure of 2,765 is the number of exposed devices confirmed at the time of the research. It does not indicate the number of devices compromised in this attack or the number of affected stores in France.
Still, if a management interface that can change refrigeration operation is accessible from outside, it gives attackers an opportunity to try to break in.
It is important to keep the convenience of remote maintenance while limiting connections to the management interface to trusted users and networks.
Were previously known vulnerabilities used in this attack?
Security problems with Danfoss management devices had been reported before this incident.
In security advisory DSA-2025-08-01, dated August 1, 2025, Danfoss disclosed two vulnerabilities in AK-SM 8xxA series versions earlier than 4.3.1.
The first, CVE-2025-41451, is a problem in which an authenticated user could abuse the email notification settings function to execute arbitrary OS commands on the device.
The second, CVE-2025-41452, is described as a problem in which, after authentication, web server settings could be illegitimately changed to stop the management interface service.
Claroty's Team82 carried out detailed technical research on these vulnerabilities and revealed the danger that management functions could be abused.
The team also discovered a separate authentication process that could bypass normal password authentication. This is handled as CVE-2025-41450, and it meant there was a path to pass authentication without knowing the regular administrator password.
In this way, the research team examined the devices' security problems from two angles: unauthorized access to the management interface, and abuse of functions available after authentication.
However, the fact that vulnerabilities were found in the past is a separate matter from whether they were actually exploited in this attack.
Although CERT-FR confirmed numerous compromises in its October 12 alert, it has not identified the specific vulnerabilities or CVE numbers used in the attack.
Therefore, the 2025 vulnerability disclosure, Claroty's research release in August 2026, and the attack that occurred this October cannot at present be linked as a single intrusion path.
Determining which vulnerability was exploited, or whether credentials were stolen by other means, will require examining the logs and firmware state of the affected devices.
Also, the fixed version "4.3.1" that Danfoss released in 2025 addressed the problems of that time, and does not mean it is the current latest version.
The official Danfoss AK-SM 800A software download page as of October 2026 lists version "5.3.x," released in October.
For that reason, it is necessary not only to install the fixed version named in the past vulnerability information, but also to check the latest update contents currently provided by the manufacturer and their compatibility with existing equipment.
End-of-support devices need replacing, and updates alone are not enough for current ones
What makes this incident serious is that the affected devices include products for which manufacturer support has already ended.
According to Cooling Post's October 12 article based on an interview with Danfoss, most of the affected units were older products, or current products running old firmware.
The older products Danfoss cited include the "AK-SM 800" and "AK-SC 355."
The AK-SM 800 reached the end of its product life in 2021, and the AK-SC 355 was phased out in 2016. Neither currently receives software or security updates.
Meanwhile, damage was also confirmed on the current AK-SM 800A, but according to Danfoss, the affected units were running old firmware.
The company explained that it had previously recommended that customers apply the latest firmware to supported devices and migrate older devices to current-generation products.
The necessary measures therefore differ depending on the type and condition of the device.
Organizing Danfoss's October 2025 support materials, the software download page for current devices, and CERT-FR's alert, the main responses are as follows.
| Target / status | Confirmed situation | Required response |
|---|---|---|
| Older devices such as AK-SM 800 and AK-SC 355 | Product support has ended; no security updates available | Consider replacing with current-generation devices |
| Current AK-SM 800A | Version 5.3.x is available as of October 2026 | Check the latest update contents and compatibility, then update the firmware |
| AK-SM and AK-SC series devices suspected of compromise | CERT-FR has presented recovery steps including factory reset and changing credentials | Restrict connections, then reset and reconfigure the device, and check credentials and accounts |
Note: This table summarizes measures by device generation and recovery measures when compromise is suspected. Responses for devices suspected of compromise are needed for both current and older products.
It is especially important to note that for a device that may already have been compromised, updating the firmware or restoring temperature settings does not mean it has been returned to a safe state.
For AK-SM and AK-SC series devices suspected of compromise, CERT-FR calls for limiting network access to necessary sources such as maintenance providers, then resetting the device to factory state and applying all available security fixes.
It further says that credentials such as passwords must be changed, existing accounts checked for anything suspicious, and the entire device reconfigured.
Even if refrigeration temperatures return to normal, the equipment could be manipulated again if the credentials or illegitimate settings the attacker used remain.
For that reason, restoring the equipment to normal operation and eliminating the security problems must be considered separately.
There are also points of caution for updating current devices.
Danfoss's official download page explains that the new AK-SM 800A firmware introduces stricter authentication management features.
For example, settings that enforce stricter session management require HTTPS connections, and the authentication method for connecting from external systems also changes.
As a result, if only the device itself is updated, maintenance software and external systems that connected in the conventional way may no longer work as they are.
Danfoss also asks customers to check their network configuration and the way external systems connect before updating, and in some cases recommends on-site update work.
In other words, it is not as simple as replacing old devices and updating current ones. To keep operating safely after updating, it is necessary to review even the connection methods of maintenance providers and user permission management.
Restoring refrigeration alone does not prevent a recurrence
This incident highlighted that the systems managing store refrigeration and freezer equipment bear directly on food safety and retail business continuity.
Remote maintenance itself is an essential mechanism for efficiently managing many stores. Being able to detect equipment abnormalities early and change settings without visiting the site offers major benefits.
However, if the security of externally accessible management interfaces is inadequate, or if equipment that is no longer supported continues to be used, the risk rises that this convenience will be exploited by attackers.
When control of refrigeration equipment is seized as in this case, the problem goes beyond a simple system failure and extends to product disposal, effects on business operations, and equipment safety.
Going forward, it will be important to clarify the route attackers actually used to break into the management devices and whether known vulnerabilities were exploited.
At the same time, retailers are expected to know the model numbers and firmware versions of the refrigeration equipment used in their stores, as well as the manufacturer's support deadlines.
They also need to check whether management interfaces are directly exposed to the internet, whether users who can connect remotely are appropriately restricted, and who is responsible for device updates and recovery in the event of a compromise.
Returning equipment to a state where it can chill food, and returning it to a state where attackers cannot operate it again, are both indispensable.
This attack shows that refrigeration cybersecurity is not an issue for IT departments alone, but a challenge for protecting food safety and store operations themselves.