Danfoss Refrigeration Controllers Hit in Cyberattack on Hundreds of French Supermarkets

Attackers who could reach Danfoss refrigeration controllers over the network raised temperature setpoints in supermarkets across France overnight on October 11 to 12, 2026 (reports put the largest rise at 50 °C), and affected stores are throwing out stock. No data was stolen, according to Agence France-Presse (AFP), and no attacker has been named.

Danfoss, the Danish maker of the controllers, told AFP that "la majorité des unités touchées sont des produits anciens", the majority of affected units being old products. The company named the AK-SM800 and AK-SC355 as the main models, both of which have reached end of life and no longer receive software or security updates, according to the AFP report republished by 20 Minutes. Some AK-SM800A units reportedly ran obsolete firmware.

Which chains, and how many stores

The counts differ by outlet, and only some chains have confirmed anything.

Chain	Stores reported	Confirmed by the chain?
Intermarché and Netto	At least 300 (AFP); 150 to 200 (Euronews)	Yes, told AFP
Coopérative U	Fewer than 100 (AFP); nearly 100 (Euronews)	Yes, CEO posted on X
Monoprix	About 30 (AFP)	Yes, told AFP
E.Leclerc	"Several" stores (AFP)	Yes, said a supplier was hit
Carrefour Market	Field reports only	No

AFP said four distributors confirmed to it, and Euronews said Intermarché and Coopérative U confirmed. Euronews also reported that BFMTV said E.Leclerc was targeted, which E.Leclerc had not confirmed to AFP when Euronews published. Carrefour Market was reported hit by BFMTV and the trade site Je bosse en grande distribution, with no confirmation from the company.

What the controllers did on October 12

According to BFMTV, as relayed by AFP, the attackers remotely triggered a forced defrost on refrigerators, freezers and cold rooms. Je bosse en grande distribution described setpoints raised by up to 50 °C, with a -20 °C freezer set to +30 °C overnight. That outlet quoted the Grand-Couronne store near Rouen as saying the attack began at 4:44 a.m.

The same trade site reported that the hack disabled the alert system at some sites, so on-call teams were never notified. At another store an alarm sounded around 5 a.m., after the temperature had already climbed. Those details come from employees quoted by one outlet and are unconfirmed.

Intermarché told AFP that affected stores will have to "throw away all their products", fresh and frozen, and that its insurance policies do not cover this kind of in-store incident. It has not put a figure on the loss. Dominique Schelcher, chief executive of Coopérative U, called the attack unprecedented on X and said engineers were working to restore operations.

Is this the known Danfoss flaw, CVE-2025-41450?

Nobody has said so. The Danfoss AK-SM 8xxA series has a published authentication bypass, CVE-2025-41450 (CWE-305), which affects versions before 4.2. The CVE record, published on May 8, 2025, carries a CVSS 3.1 base score of 8.2 and the vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H. The CISA coordinator entry in the record lists exploitation as "none" as of May 8, 2025.

The score overstates the ease of attack: it assumes high complexity and user interaction. That does not rule out a different flaw or stolen credentials on exposed controllers, and the reporting does not say how the attackers got in. The AK-SM800 and AK-SC355 named by Danfoss are not the same line as the 8xxA series in the CVE record, so the link is unproven.

Investigation and next steps

The Paris prosecutor's office opened an investigation on its own initiative into what it called a large-scale cyberattack on connected refrigerators at several major food retailers. Euronews reported that the inquiry aims to identify victims and link them to reported food losses and triggered fire alarms.

Operators with Danfoss controllers reachable from the internet should take them off it, check whether the units are on the end-of-life list, and review setpoint history from the night of October 11. Danfoss has not said whether it will ship a fix for the end-of-life models. For the same pattern of unpatched industrial gear, see the site's report on seven CVEs in Red Lion N-Tron switches and on CISA's October 8 additions.