A cyberattack triggered the defrost cycle in 250 to 350 French supermarkets

Overnight, 11–12 October 2026. Attackers remotely triggered the automatic defrost on refrigerators across several French retail chains, driving temperatures up to 50 °C in fresh and frozen aisles. 250 to 350 stores. Per BFMTV, the attack hit 250 to 350 stores — Intermarché, Super U, Leclerc, Monoprix, Carrefour Market, Coopérative U — with massive food losses. Danfoss. The target was precise: Danfoss AK-SM 800A refrigeration controllers running older versions of the supervision software. Why it matters: this is the first time a cyberattack against industrial control systems has caused physical food destruction at this scale in France.

A defrost that was no accident

A refrigeration controller manages a store’s cold chain by driving compressors, valves and heaters. Defrost is a legitimate function: periodically the controller cuts cooling and melts the frost off the evaporators. The attackers did not “break” the cold by disabling the compressor — they simply triggered the built-in defrost function on controllers they controlled, pushing display-case temperatures well past the food-safety zone.

An Intermarché spokesperson confirmed the angle: “following a cyberattack reportedly affecting a service provider that manages refrigeration systems in stores, some fresh and frozen food display units are out of service.” Intermarché and Netto pulled products from the cases “as quickly as possible.” Coopérative U president Dominique Schelcher called it “a cyberattack” on “the refrigeration systems in several stores” of his network and described the operation as “unacceptable.” The Paris prosecutor’s office has opened an investigation into the “large-scale cyberattack.”

Known-vulnerable controllers, exposed at scale

The most striking part is not the attack’s sophistication but its predictability. CISA had warned in May 2025 about an authentication-bypass flaw (CVE-2025-41450), then in August 2025 about a command-injection flaw (CVE-2025-41451), in the Danfoss AK-SM 8xxA line — the exact hardware that drives refrigeration and HVAC in food retail. Claroty Team82, the research team that found both flaws, published a detailed write-up in August 2025 showing how to chain them for remote code execution on publicly exposed AK-SM 800A management interfaces.

The exposure was never closed. Baptiste Robert, founder of Predicta Lab, counted 2,752 Danfoss systems exposed online on Monday, 1,590 of them in France alone. Shodan tracks more than 4,500 reachable Danfoss devices. In other words: controllers that physically manage food-storage temperatures are reachable from anywhere, months after flaws allowing remote takeover were published.

Finding your own exposure is a single search away: query Shodan or Censys for the controller’s vendor and product, then cross-reference the results against your refrigeration asset inventory. The 2,752 systems counted by Baptiste Robert give the order of magnitude — the question is not whether your estate contains exposed controllers, but how many. Any controller that answers on the public internet should be treated as already targeted, because automated scanners index them continuously and this attack has now demonstrated a working, weaponized use.

Detection needs rethinking too. A defrost cycle triggered at the wrong time looks like a maintenance event, not an intrusion: the compressor keeps running, the alarms stay silent, and only a slow temperature curve reveals the sabotage. Operators who monitor only uptime and connectivity will miss it entirely. The signal to watch is the process variable itself — case temperature against the setpoint — trended and alerted on, so that a deliberate, out-of-hours defrost is flagged as an anomaly rather than logged as a routine cycle.

The link between these flaws and the attack is not yet officially confirmed — neither Danfoss nor the retailers have named the intrusion vector. But the convergence of targeted hardware, documented flaws and massive exposure makes the likely path obvious: an unpatched AK-SM 800A reachable on the internet was turned against its own defrost function.

What it says about operational technology

The episode exposes a blind spot in OT (operational technology): refrigeration, HVAC and building equipment are still treated as “non-IT” objects, when they are full Linux or RTOS computers with web interfaces and network stacks, plugged into the same internet as everything else. IT security optimizes for confidentiality and integrity; OT security must optimize for safety and availability first, because its failure mode is not a leaked database but a destroyed product line or a public-health event. A refrigeration controller is no less critical than a production PLC: it guards the cold chain, a regulated sanitary issue. Its compromise does not steal data — it destroys stock and, if an undetected temperature drift occurs, can expose consumers.

The chain of responsibility is also at fault. Stores buy cooling as a service, through providers who install controllers and often leave them reachable for remote maintenance. The Intermarché spokesperson implicitly conceded it: the attack runs through “a service provider that manages refrigeration systems.” When the provider exposes the controller for its own operational convenience, the store absorbs the loss — and no one had mapped the exposure.

The cold chain is a sanitary issue, not just a commercial one

Food refrigeration is a regulated constraint, not a mere storage convenience. Fresh products are kept between 0 and 4 °C, frozen goods at -18 °C; beyond that, bacterial growth resumes and the product becomes unsellable. A temperature driven to 50 °C — the figure cited by BFMTV — does not merely “defrost”: it cooks meat and fish inside their packaging, turns dairy into a dead loss, and forces the removal of entire aisles as a sanitary precaution. The cold chain also carries traceability obligations (HACCP) that retailers cannot improvise after the fact: when a controller is compromised, the store does not know, for each case, how long the temperature sat outside the safe zone.

The episode joins a lengthening list. In May 2021, Colonial Pipeline shut a U.S. East Coast pipeline after ransomware; in February 2022, the compromise of Viasat’s KA-SAT satellite modems cut thousands of wind turbines at the start of the invasion of Ukraine. The common thread: industrial equipment treated as “non-critical” until the day its failure produces an immediate physical effect. French supermarket refrigeration fits exactly this line — except the vector here is not ransomware, but the direct exploitation of a legitimate function on an exposed controller.

Verdict

If you run industrial refrigeration or HVAC — a store, warehouse, lab or central kitchen — inventory your Danfoss AK-SM 8xxA controllers and their equivalents now, check their versions, and apply the CVE-2025-41450 and CVE-2025-41451 patches: it is the only fix against the most likely vector. Whatever your industry, question any OT device reachable from the internet: pulling it behind a VPN or a dedicated remote-maintenance gateway, and segmenting it from the management network, costs less than a stock loss. If you are a refrigeration provider, the exposure you leave on your customers’ display cases is your responsibility: map it, close it, and treat every controller as a first-class attack surface. The lesson in one line: a remotely triggered defrost destroys faster than ransomware encrypts.

References

• BleepingComputer — Cyberattack shuts down refrigerators at French supermarkets (12 October 2026)
• The Record — Cyberattack disrupts refrigeration at hundreds of French supermarkets (11 October 2026)
• CISA — ICS Advisory ICSA-25-132 (May 2025), CVE-2025-41450
• CISA — ICS Advisory ICSA-25-237 (August 2025), CVE-2025-41451
• Claroty Team82 — Freeze the Controller, Defrost the Food: Danfoss Refrigeration Controller Vulnerabilities (August 2025)