How a cyberattack heated up fridges at French supermarkets
Danfoss blames most cases on older controllers that no longer get security updates and were still reachable from the internet.
Hackers took remote control of the systems that run the refrigeration in French supermarkets overnight on Oct. 11-12. They triggered defrost cycles, and the cold rooms reached 50 °C (122 °F), said Thierry Cotillard of the Mousquetaires group, which owns Intermarché. Stores had to throw out their stock.
Press reports in France put the list of affected chains at no fewer than 300 outlets of Intermarché and Netto, 80 of Carrefour, fewer than a hundred of Système U and about 30 of Monoprix. Paris prosecutors opened an investigation led by their cybercrime office. No one has claimed responsibility, and no stolen data has surfaced.
Equipment that nobody updates
Danfoss, the Danish manufacturer, traces most cases to two older models, the AK-SM 800 and the AK-SC 355, which no longer get security updates. France's CERT-FR, the national computer emergency team, later extended its alert to Dixell equipment and Copeland's XWEB supervisors.
An internet scan on Oct. 6 and 7, five days before the attack, counted 2,528 Danfoss StoreView panels reachable from the web worldwide. France had 1,331 of them.
| Measure | Panels |
|---|---|
| Reachable from the internet (Oct. 6 and 7) | 1,331 |
| Running software with known flaws | 1,136 |
| Controllers no longer supported | 527 |
| With all fixes installed | 195 |
| Still online on Oct. 14 | 316 |
Eighty-five percent of French panels ran software with known flaws.
Since March 30, the share with all fixes installed rose from 14% to 24%, while unsupported controllers went from 519 to 527. After the attack, the number of panels online fell 76% in that count. Censys, an internet intelligence firm, measured a separate drop of 71% between Oct. 11 and 14, using its own method.
What is patched and what is not
Three 2025 flaws have fixes: CVE-2025-41450, patched in March for the AK-SM 800A, and CVE-2025-41451 and CVE-2025-41452, patched in August. Firmware 4.3.1 or later carries all three fixes, and the latest release is 5.3.2. The AK-SM 800 and AK-SC 355 have no patch.
Danfoss has not confirmed how the attackers got in, and a panel visible from the internet is not necessarily one that anyone can open. An ethical hacker cited by French media says an unpatched update and a simple password were enough, but that is his account and the investigation has not confirmed it.
For people who run these devices, Danfoss urges updating the firmware, hardening the network and, where possible, removing direct internet access. Censys puts it more bluntly: there is "no reason" for them to be connected straight to the web.
Losses total "several million euros," about 270,000 euros at two Intermarché stores in Haguenau, and Intermarché has warned that its insurance policies do not cover this kind of incident. The published counts rank Poland, the United States, Portugal and Belgium as the countries with the most exposed panels after France. None includes figures for Mexico.
