DANFOSS CYBER ATTACK:When hackers turned supermarket freezers into heaters
On the night of 11–12 October 2026, attackers remotely took over the controllers that run refrigeration in hundreds of French supermarkets. Here is what happened, what is still unknown, and what it means for OIL.
Some units reportedly reached up to 50 °C during the attack.
What happened
Overnight on Sunday 11 October, refrigeration at several large French chains was forced into non-stop defrost.
Defrost is a normal feature that briefly warms the cooling coils to clear ice. Here it was kept running with food still inside. Staff arriving on Monday morning found spoiled meat, frozen goods and vegetables. Some stores also reported equipment catching fire, which French prosecutors are examining. One retail chief expects losses of tens of millions of euros across France.
- Danfoss fixes flaws in its newer AK-SM 800A controller, including a login bypass (CVE-2025-41450) and a command injection flaw (CVE-2025-41451). It also warns that older end-of-life models no longer meet current security needs.
- Researchers at Claroty (Team82) publish findings on these controllers and report thousands of management interfaces reachable from the internet. They describe no real attacks.
- Attackers change controller settings and force continuous defrost across several chains.
- France's CERT-FR issues alert CERTFR-2026-ALE-012: disconnect the affected controllers or tightly filter access. Danfoss says most hit units were older products with no updates.
- The Paris prosecutor opens an inquiry. CERT-FR updates its alert, and later reporting says it now also lists Copeland XWEB and Dixell XWEB equipment.
How it worked
A store's cooling is run by one supervisory controller. Contractors manage it remotely through a web interface.
- Reachable controllerManagement interface open to the internet
- Attackers take controlEntry method not officially confirmed
- Settings changedDefrost limits overridden
- Physical damageHeat, spoiled food, some equipment fires
This was not data theft. A few changed settings had a direct physical effect. That is why OIL treats IT and operational technology (OT) security together.
Known vs unknown
Early reports mix fact and guesswork. Please do not repeat the right-hand card as fact.
Confirmed
- Timing, and the physical effect: forced defrost and food loss
- Affected families: Danfoss AK-SM and AK-SC
- Most hit units were unsupported older models, plus some current units on outdated firmware
- Official advice: disconnect or filter access
- An investigation is under way
Not yet established
- The exact way in
- Whether any specific known vulnerability was used
- Who is responsible. Nobody has claimed it
- Total systems affected and final cost
- Details of reported cases in other countries
The 2025 flaws and the August 2026 research are relevant background. Neither Danfoss nor French authorities have linked them to this attack, and the oldest hit models are not covered by that research.
Who was hit
Store counts are the chains' own statements on 12–13 October. They count stores reached, not stores that lost stock.
- Intermarché, Netto
- At least 300 per AFP; about 150 per Reuters
- Coopérative U
- 80 of about 2,000. The cold chain held in most
- Carrefour
- 80
- Monoprix
- About 30
- E.Leclerc
- Several stores, via a refrigeration supplier
Controllers, per Danfoss
- AK-SM 800
- End of life since May 2021. No security updates. Replace, or disconnect and filter access
- AK-SC 355
- Phased out in 2016. No security updates. Replace, or disconnect and filter access
- AK-SM 800A
- Current model. Some hit units ran outdated firmware. Keep firmware current and filter access
Many chains do not run these controllers themselves. Contractors install and manage them, so the weak point sat with a third party. Danfoss's October 2025 newsletter had already recorded 2022 attacks on the AK-SM 800 at 16 Russian and 40 Israeli supermarkets. The Israeli stores all lacked proper firewall or VPN protection.
Why it matters to OIL
An available security update protects us only after it is installed.
Patch today. Protect tomorrow.
This page does not say OIL has the same weaknesses. It shows how ordinary weaknesses combine into physical harm, and the same questions apply to our servers, networks, applications and field systems.
Out of date means exposed
Attackers look for software that has not been updated. Most hit units were unsupported or not updated.
Unsupported cannot be fixed
Once a vendor stops issuing updates, the safe answer is replacement or strong isolation.
Remote access is a doorway
Contractor convenience became an attack path. Management interfaces should not be open to the internet.
Fast response limits harm
Where staff and contractors reacted quickly, most stores kept their stock. Practised response plans matter.
What to do
- Do not keep postponing updates on your official computer or approved applications. Restart when asked so the update can finish.
- Never disable or interfere with organisation-managed security and update tools.
- Do not install unauthorised or unsupported software.
- If something looks badly out of date, tell the concerned IT or support team. Do not upgrade it yourself.
- If you notice anything unusual, report it through the IT Helpdesk to the CISO's Office.
- Keep an inventory that includes vendor support status and end-of-life dates.
- Confirm no management or remote-maintenance interface is reachable directly from the internet. Allow trusted addresses and one controlled entry point only.
- Change default passwords, review accounts and keep firmware on supported devices current.
- Plan replacement or isolation for unsupported equipment, and segment OT from the business network.
- Review contractor remote access, and be able to detect abnormal changes to device settings.
Common questions
Does OIL use Danfoss AK-SM or AK-SC controllers?
This page cannot answer that. Asset owners should check their inventories and contact the CISO's Office if they find one.
Was this caused by an unpatched vulnerability?
Not confirmed. Danfoss says many hit units were unsupported or outdated, which supports the patching message. The entry method has not been established, so no specific flaw should be stated as the cause.
Why would attackers target refrigeration?
No one has claimed the attack or stated a motive. The effect is clear: spoiled stock, damaged equipment and disruption to a food supply chain.
Was it ransomware?
No ransom demand appears in the sources reviewed. The damage came from changed equipment settings.