Defrost the Food: Hacked Refrigeration Controllers Spoiled Hundreds of French Supermarkets

2026-10-22 Agent & Supply Chain Security by al-ice.ai Editorial

Overnight on Sunday 11 October 2026, unknown attackers remotely forced refrigeration systems into defrost cycles at hundreds of French supermarkets — and then left. Fridges and freezers built to hold food near 2°C climbed to 50°C (122°F); at one Intermarché in Normandy, temperatures reportedly reached 80°C, hot enough to melt equipment. Staff arrived Monday morning to dumpsters of ruined stock, and investigators told reporters the attack may have sparked equipment fires at some sites. France’s national cyber agency confirmed numerous compromises of Danfoss refrigeration controllers the same day, and the Paris prosecutor opened an investigation.

The scale is still settling — French media put it at 250 to 350 stores across chains including Intermarché, Carrefour Market, Monoprix, Leclerc and Super U, while wider reporting describes nearly 700 supermarkets affected — but the mechanism is not in doubt, and neither is the warning that preceded it. In August, researchers had published exactly this attack: hackers could, in their words, “freeze the controller” and “defrost the food.” Two months later, somebody did.

Confirmed compromises, unpatchable hardware

On Monday 12 October, ANSSI’s CERT-FR published an alert confirming numerous compromises affecting Danfoss AK-SM and AK-SC series remote refrigeration controllers. A day later, affected systems from Copeland and its Dixell brand (XWEB) were added to the picture. The compromised devices were reachable over the internet — scans counted more than 4,500 internet-exposed Danfoss controllers as of 12 October, nearly 60% of them in France.

Then came the sentence that reframes the whole incident from breach to structural failure. Danfoss told reporters that most of the affected units were legacy products: the AK-SM 800, end of life since May 2021, and the AK-SC 355, phased out in 2016. Neither receives software or security updates of any kind. The vendor’s own defensive checklist — change the default password, keep it off the internet, keep it patched — is a checklist where two of the three items are impossible on the installed base. There is no patch coming because there is no supported product to patch.

Copeland, for its part, acknowledged “the vulnerability identified in a discontinued, end-of-life generation of controllers,” said protecting customer operations remains its top priority, and pointed customers toward supported products and current software. Danfoss did not immediately respond to press inquiries at the time.

The warnings were specific and public

This was not a zero-day out of nowhere. OT security firm Claroty’s Team82 sounded the alarm in August, publishing details of dozens of vulnerabilities in these devices and demonstrating the “freeze the controller / defrost the food” impact explicitly. French offensive-security firm Synacktiv has published advisories on Danfoss controllers since 2023. And Danfoss itself issued advisory DSA-2025-08-01 with fixes for two flaws on the platform — CVE-2025-41450 and CVE-2025-41451, reported at 8.7 (post-authenticated remote code execution) and 6.8 (post-authenticated denial of service) — patched in August 2025 for the units still supported.

The pattern will be familiar to readers of our Claroty Team82 coverage: the research community maps the vulnerability, the vendor fixes what is still supported, and the long tail of end-of-life devices — internet-exposed, default-credentialed, unpatchable — sits waiting for whoever industrialises the attack first. The only known tradecraft detail so far underlines the point: the defrost cycle was reportedly stretched from one hour to eight hours, delaying the alarms that would otherwise have paged staff while the food cooked.

No confirmed entry point — and that is the point

As of this writing, nobody has confirmed how the attackers got in. That absence matters more than any single CVE, because on this installed base the entry hardly matters: internet-facing controllers, many past end of life, some on outdated firmware, with no monitoring and no update path. Any one weakness suffices, and the vulnerable population numbers in the thousands.

For defenders outside retail food, substitute your own unpatchable gear: building-management controllers, legacy VPN concentrators, out-of-support cameras and printers, the lab instrument with Windows XP embedded. The French response is instructive — national agency alert within a day, criminal investigation the same day, vendor engagement, press naming the EOL models so other operators can check their own estates. But the structural lesson is the inventory one: every organisation has its own version of that fridge, and the audit that finds it has to happen before the Sunday night it gets used.

What to do

Inventory operational technology the way you inventory servers. Classify every controller as patched, end-of-life-but-isolated, or end-of-life-and-exposed. The third column is the emergency.
Pull end-of-life controllers off the internet. Remote vendor access that traverses the public internet is the exposure that made this incident possible at scale; move it behind VPN or remove it.
Change default credentials and segment OT networks so a compromised controller cannot reach IT systems and vice versa.
Monitor for physical-impossible states. A defrost cycle stretched 8× past normal is an anomaly any telemetry pipeline could have flagged — if the telemetry existed. Controller setpoints and cycle durations belong in your monitoring, not just temperatures.
Track the EOL dates, not just the CVEs. No scanner will alert on a device whose vendor has stopped publishing advisories. The AK-SM 800’s May 2021 end-of-life date was the real vulnerability disclosure.

Verification note. The attack timing (overnight Sunday 11 October), the defrost-cycle mechanism, the 50°C figure and the 80°C Normandy report, the affected chains, the CERT-FR 12 October confirmation of Danfoss AK-SM/AK-SC compromises and the next-day Copeland/Dixell addition, the internet exposure and EOL/outdated-firmware status, the AK-SM 800 (EOL May 2021) and AK-SC 355 (phased out 2016) models, the 4,500+ exposed controllers with ~60% in France, the 1-hour-to-8-hour defrost stretch, the Paris prosecutor’s investigation, and the absence of a confirmed entry point were read first-hand from The Register’s 15 October report and the 17 October Secure-in-Seconds analysis. The 250–350 store count is carried as attributed to French media (BFM TV) and the ~700 figure as wider press reporting; the two disagree and we do not reconcile them. The Claroty Team82 August warning and its “freeze/defrost” wording, the Copeland quoted statement, and Danfoss’s lack of immediate response come from The Register. The Synacktiv-since-2023 history, the DSA-2025-08-01 advisory identifier, and the CVE-2025-41450/41451 scores are carried as secondary reporting, not first-hand reads. No controller was probed and no vendor system was contacted.

Sources: