Attackers remotely triggered the built-in defrost function on Danfoss refrigeration controllers overnight on Sunday, October 11, 2026, warming chilled cases at French supermarkets while the stores were closed and unwatched. French outlets reported that between 250 and 350 stores were affected, with Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc and Super U among the chains named.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The Paris prosecutor’s office has opened an investigation. Nobody has publicly said who is behind the intrusion, and the first accounts concentrated on the practical damage: food that had to be pulled from shelves and thrown away.
A defrost cycle turned against the cold chain
According to BleepingComputer’s reporting by Sergiu Gatlan, the attackers hijacked refrigeration controllers running older versions of Danfoss control software and used the equipment’s automatic defrosting system to push temperatures up. A defrost cycle is a normal maintenance routine, in which a case briefly stops chilling so frost can melt off the evaporator coils. It becomes a weapon only when somebody can start it at will and keep it going through the night, long after a technician would have ended it.
The effect is slow and quiet. Nothing alarms on the shop floor, no door is open, and the cases look normal until staff arrive and find warm yoghurt, meat and ready meals. The store count itself is a media tally rather than an audited figure: BleepingComputer attributes the 250 to 350 range to French outlets and says it could not verify it, and an Intermarché spokesperson said the company had no specific list of affected stores. A BFM TV report was among those carrying the larger picture of hundreds of Intermarché and Super U stores destroying fresh produce.
The AK-SM 8xxA flaws that were already on record
The reporting does not say how the controllers were compromised, and neither Danfoss nor Leclerc had answered requests for comment when it was published. What it does point to is a pair of known weaknesses in the Danfoss AK-SM 8xxA series, the platform used to manage refrigeration and heating, ventilation and air conditioning in food retail. The first, CVE-2025-41450, is an authentication bypass that the U.S. cybersecurity agency CISA flagged in a May 2025 bulletin. The second, CVE-2025-41451, is a command injection flaw covered in an August 2025 bulletin. No source has tied either flaw to the French incident, so the link remains a question for investigators rather than a finding.
The research behind both came from Team82, the research arm of industrial security firm Claroty. Its write-up, Freeze the Controller, Defrost the Food, describes a hidden “code-of-the-day” login path that checks a password derived from the device’s date instead of the real administrator password. Because the researchers reconstructed the algorithm, anyone who knew it could generate a valid credential for the day and gain administrative access to the web management page.
Exposure counts and the manufacturer’s fix
Baptiste Robert, chief executive of Predicta Lab, found 2,752 Danfoss systems reachable from the internet on Monday, October 12, 1,590 of them in France, according to BleepingComputer. The Shodan search engine tracks more than 4,500 Danfoss devices exposed online. A controller that sits on the open internet is a controller that anyone can try to log into, which is why exposure counts matter even when the exact method of entry is still unknown.
Danfoss published fixes for both flaws in advisories DSA-2025-03-01 and DSA-2025-08-01. Claroty’s guidance is to move affected controllers to firmware R4.3.1 or later, keep management interfaces off the public internet, and confine administrative access to trusted networks through VPNs and segmentation. The Claroty page also notes that the authentication bypass listing cites patch 4.2, so operators are told to confirm against the manufacturer’s advisory which release applies to their hardware.
Stores, prosecutors and the question of fires
Dominique Schelcher, president of Coopérative U, confirmed that the attack hit several stores in the chain, said teams were working with refrigeration specialists, and called the targeting “unprecedented.” He added that “it is unacceptable.” Christophe Hansen, the European Union’s agriculture and food commissioner, also condemned the attack and named Leclerc, France’s largest supermarket chain, as a victim.
An Intermarché spokesperson said the company and its Netto banner had taken all necessary precautions to remove products from the affected units as quickly as possible. The Paris prosecutor, speaking to AFP, said the inquiry into “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France” would try to identify the victims and connect the attack to reported food losses and an outbreak of fires, as set out in the AFP dispatch.
Separately, Ahold Delhaize said on Monday that it had taken some systems offline after a cybersecurity incident. BleepingComputer says there is no evidence the two events are connected.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
