Danfoss Refrigeration Controllers Targeted in French Supermarket Cyberattacks

Cyberattacks manipulated temperature controls in refrigeration systems at hundreds of French supermarkets, forcing retailers to discard perishable stock. The incidents disrupted operations for major chains including Carrefour, Intermarché, Coopérative U, Monoprix, and E.Leclerc. Attackers raised temperatures in cold rooms and freezers to as high as 50 degrees Celsius, and in one reported instance to 80 degrees Celsius. These actions spoiled food and, in some cases, caused fires, according to reports from Industrial Cyber.

Root cause

The affected equipment included refrigeration controllers produced by Danish manufacturer Danfoss. The company stated that the stores impacted by the attacks were running outdated firmware. Danfoss has consistently advocated for keeping such systems updated. Security researchers from Claroty had previously disclosed vulnerabilities in the AK-SM 800A platform that allowed bypassing administrator passwords. These flaws relied on a predictable authentication mechanism generating codes from the device's current date.

Attack path

Authorities have not confirmed whether the attackers exploited the vulnerabilities disclosed by Claroty in August 2025. However, experts noted that the previously identified flaws were easily scriptable. The hidden authentication mechanism accepted a code generated from the device’s date, bypassing configured passwords. Anyone reproducing the algorithm could generate a valid daily code to gain administrative access. The research demonstrated how compromised controllers could expose systems to physical disruption.

Affected versions

• Danfoss AK-SC series controllers
• Danfoss AK-SM series controllers
• Copeland xweb systems
• Dixell xweb systems
• Obsolete units that no longer receive security updates

Mitigation

• Remove internet exposure for affected units and any devices with public IP addresses.
• Check contractual insurance conditions before cutting off data transmission to service providers.
• Restore access only through a secure VPN or protected network after remediation.
• Verify defrost ranges and configurations to ensure system integrity.

Why it matters

Teams should recognise that industrial control systems often lack robust network segmentation. Remote access capabilities intended for maintenance can create attack surfaces if left unsecured. Operators must verify that legacy equipment receives timely security patches. When systems are disconnected from corporate networks, incident response becomes more difficult. Regular audits of firmware versions and access controls help prevent unauthorised manipulation of critical infrastructure components.

What to do and how to stay safe: Danfoss

• Audit all remote-enabled industrial controllers for outdated firmware versions.
• Restrict network access to refrigeration systems using strict firewall rules.
• Monitor for anomalous temperature changes or extended defrost cycles.
• Verify that administrative authentication methods are not based on predictable algorithms.

Step-by-step guide: Password Policies Examples That Reduce Password Fatigue

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did attackers definitely exploit the Claroty-disclosed vulnerabilities?

Authorities have not confirmed whether the vulnerabilities disclosed by Claroty were exploited in this specific incident.

How many stores were affected by the attacks?

Approximately 300 Intermarché and Netto stores, 100 Coopérative U outlets, 80 Carrefour stores, and 30 Monoprix locations were impacted.

What financial impact did the attacks have?

Losses at one Intermarché store reached €21,000, with nationwide losses expected to total several million euros or potentially tens of millions.