Danfoss Supermarket Fridges Hacked

Fridges in hundreds of French supermarkets heated up to 50°C in one night. The food went in the bin. The attackers never set foot inside. The cooling controls were online, with holes public since 2023.

The heating started on Sunday night, October 11. In some stores it began before midnight. Across France, the systems that keep supermarket fridges cold switched on their defrost function and left it running.

Defrosting is a normal part of how a commercial fridge works. Ice builds up inside, so from time to time the unit warms up to melt it and then goes back to cooling. In these stores that normally adds up to about two hours a day. That night it did not stop. The defrost kept running, and the temperature in display cases and cold rooms kept climbing. One of the chains says the attackers pushed the temperature controls to 50°C, which is 122°F.

Some units ran hot for six hours before staff noticed. In the stores where it started before midnight, the fresh and frozen food had been sitting in that heat for hours by the time the first employees came in. It all had to be thrown out. The Paris prosecutor’s office spoke of a large-scale attack on connected fridges at several big chains, and said it caused food losses and fires.

The chains gave their own numbers. Intermarché counted about 150 of its stores. Thierry Cotillard, head of the group behind it, estimated the losses at tens of millions of euros across the country after a single morning of crisis management. Carrefour said 80 of its supermarkets were hit. Monoprix put it at about 5 percent of its roughly 490 stores. Around 100 stores of Coopérative U, the group behind Super U, Hyper U and U Express, were affected, and its head called the attack “of extreme gravity” and “unprecedented”. Leclerc stores were hit as well.

One store in Alsace lost more than 200,000 euros in food.

Prime Minister Sébastien Lecornu ordered ANSSI, the French national cybersecurity agency, to investigate. France is coordinating with other European countries, because they could be affected too. A threat analyst at the security company Sekoia named Spain, Portugal, Poland, Germany and Belgium as possibly affected, and other reports add the Netherlands to that list.

That same Sunday, Ahold Delhaize, the company behind Albert Heijn, took systems offline after a separate security issue. Its shelves kept showing last week’s prices and online orders stopped. The reports about it do not mention fridges, and so far nothing ties it to the attack in France.

A supermarket has many cooling units, from display cases to cold rooms. Each one has its own small controller. Above those controllers sits one box that ties them together, the system manager. From that box a technician can see the temperature of each unit and change what it is set to. The technician can set up alarms that send an email when something goes wrong, and plan the defrost cycles.

The box has its own web page. A technician opens a browser, types in the address, logs in, and has the store’s cooling on the screen. That way the company that maintains the cooling can check on a store without driving there.

Danfoss, a Danish company, made the boxes in this attack. The models are called the AK-SM and AK-SC series. On October 12, CERT-FR, the French government’s computer emergency team, published an alert saying it knew of many break-ins into boxes from exactly those two series.

The alert also says this: “Exposing a management interface to the internet goes against good practice.”

To make remote work possible, the web page of the system manager sat straight on the internet, open from outside the store. The login screen answered whoever found it.

Finding it is not hard. Search engines like Shodan and Censys scan the internet day and night. They keep a list of what they see on each address: which ports are open and which software answers on them. In August, security researchers counted 2,765 boxes of the current Danfoss model reachable from the internet.

Danfoss said it was “aware of incidents in France affecting a limited number of refrigeration management systems.” According to the company, most of the units that were hit are old models. The AK-SC355 was phased out in 2016. The AK-SM800 reached its end of life in 2021. The company says these products “no longer receive software or security updates.” The rest were AK-SM 800A units, the current model, running outdated firmware, the software inside the box. It says it has long advised its customers to keep their systems updated. The French retail federation has asked the company for “full transparency”.

For a store, end of life means the box keeps running and keeps controlling the fridges, and no fix will come for it again. The company’s parts are also built into cooling equipment from other manufacturers, and installers can buy them through wholesalers.

The holes in these boxes had been published three times before that Sunday.

The first time was in 2023. On January 18 of that year, researchers reported three flaws in the AK-SM 800A. Danfoss published them on August 21, 2023. The worst one, CVE-2023-25915, let a logged-in user run commands on the box. It scored 9.8 out of 10. Another, CVE-2023-25913, let an outsider pull a report with usernames and store names without logging in. The fix was software version 3.3. That same August the researchers started scanning the internet for vulnerable boxes, and from September 27 they warned the owners they could find.

The second time was in 2025. On March 24, Danfoss warned about a hidden way to log in, CVE-2025-41450. Next to the administrator’s password, the AK-SM 800A accepted a second password, a “code of the day”, calculated from the device’s own date and time. Whoever knows how that calculation works can work out the code and log in without the administrator’s password. The fix was version 4.2.

On August 1, 2025, two more followed. The next hole, CVE-2025-41451, sat in the settings for alarm emails. The box asks for the password of the mail account it uses to send alarms, and that password went into a system command without being checked first. Log in, type the right text into that field, and the box runs it as a command. The other, CVE-2025-41452, let a logged-in user change how the web server inside the box is set up and knock it offline. The fix for both was version 4.3.1. CISA, the US cybersecurity agency, listed these flaws in an advisory.

The third time was on August 9, 2026. Claroty’s Team82, the researchers behind the 2025 flaws, published the full details. They had rebuilt the code-of-the-day calculation. They did not publish it.

That August, the team also published 23 flaws in refrigeration controllers from another maker, Copeland, 21 of them rated high. Some let an attacker take full control of the device without logging in. That maker had fixed them in February.

Two months later, the fridges in France went warm.

French reports say the attackers went after boxes running software older than version 4. That is older than both fixes from 2025. And the two old models get no fixes at all.

The August count covered only the current model, the AK-SM 800A. After the attack, a French tech publication counted nearly 3,000 Danfoss management pages reachable from the internet in France alone. Some of them showed files that were last changed between 2021 and 2024.

How the attackers got in is not known yet. Vincent Strubel, the director of ANSSI, said several vulnerabilities are possible ways in, and that nothing is really established at this stage. So far, the attack is unclaimed.

The attackers may not have needed a known flaw at all. Changing a temperature or a defrost schedule is an ordinary function of the system manager. It is what the web page is for. With a working login, an attacker can change it the same way the technician does, without breaking anything. It is not public whether that login came from a flaw or from a leaked or unchanged password.

That is why the French alert starts with the network. It tells operators to disconnect the AK-SM and AK-SC boxes or filter access to them. Where remote access is essential, it says to limit it to trusted IP addresses for now. If a box may have been broken into, the alert lists six steps:

• → Restrict network access to the service providers only
• → Do a factory reset
• → Apply all available security patches
• → Change all passwords and keys
• → Check the existing user accounts
• → Set the device up again from scratch

Six weeks before France, something with the same pattern happened in the United States.

In the last week of August, refrigeration failed at US military commissaries, the supermarkets on military bases. At least six of them confirmed outages that week, from California to Rhode Island. The agency that runs the commissaries has 235 stores and did not say how many were affected. One of them, Fort Huachuca in Arizona, posted on Facebook that “ALL freezers went into defrost mode” and “ALL frozen food has spoiled.”

The Pentagon said it was aware of “a possible refrigeration disruption at some Defense Commissary Agency commissaries.” It did not name a cause, and it did not say which company made the control systems in those stores. A link between the outages in the US and the attack in France has not been proven. What they share is the pattern: freezers that went into defrost overnight, at that base and in France, and food that was lost by morning.

On September 1, the Army’s cyber investigators and the Air Force Office of Special Investigations confirmed they had opened investigations.

Homes have boxes like this too: a router with remote management switched on, or a camera you can watch from your phone. If one of them answers on the internet, the same search engines find it too.

You can look at your own address the way they do. First find the public IP address of your home connection:

1

curl -4 ifconfig.me

Then open this page, with your own IP address at the end:

1

https://www.shodan.io/host/YOUR-IP-ADDRESS

The -4 makes sure you get your IPv4 address. Shodan shows the ports and services it has seen on that address. If it lists a login page for something in your house, that page can be reached from outside. If your provider shares one address between many customers, which is common with 4G and 5G routers, what Shodan shows is not your house. Do this only for your own address.

What you can do:

• → Running AK-SM or AK-SC boxes: take them off the internet, or limit access to the address of your maintenance company
• → AK-SM 800A: update to firmware R4.3.1 or later
• → AK-SM800 or AK-SC355: these get no updates anymore, and Danfoss advises replacing them
• → Suspect a compromise: follow the six steps above, starting with a factory reset and new passwords
• → At home: switch off remote management on your router if you do not use it
• → Change the default password on anything in your house that has a login page

Want to see what your network shows the internet? Look up your own IP on Shodan, the kind of search that found these controllers. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

CERT-FR | Claroty Team82 | Danfoss