"aware of incidents in France affecting a limited number of refrigeration management systems," Danfoss told Reuters — a short sentence that, on the night of October 11, described a wave of remote manipulations that forced hundreds of French supermarkets to warm fridges and freezers and discard food.
Scope and immediate damage
Retailers reported the incident to French and international press on October 12. Les Mousquetaires, owner of the Intermarché chain, said attackers put store fridges and freezers into defrost and warmed them “to as much as 50°C,” forcing affected stores to throw away the products concerned. Thierry Cotillard, who heads Les Mousquetaires, told broadcaster BFMTV he expected losses of “tens of millions of euros” across France.
Other chains reported a mix of outcomes. Schelcher, speaking for refrigeration contractors serving Coopérative U, said the cold chain held in most of the roughly 80 Coopérative U stores listed as hit and that only a minority lost goods; he praised quick reactions from store staff and contractors. E.Leclerc told AFP that a cyberattack affected one of its refrigeration equipment suppliers and had consequences for cold equipment in several stores; the supplier was not named. Reuters reported that Félix Aimé of Sekoia said Spain, Portugal, Poland, Germany and Belgium had also been affected, though Reuters gave no further details.
Which Danfoss controllers were involved and the patch situation
CERT-FR (the French national computer emergency response team within ANSSI) said it was aware of compromises affecting two Danfoss controller series, the AK-SM and the AK-SC. Danfoss identified the older models most hit as the AK-SM 800 and the AK-SC 355. The company declared the AK-SM 800 end-of-life in May 2021 and phased out the AK-SC 355 in 2016; an October 2025 Danfoss newsletter recorded that it had urged customers to plan replacements and that it would end services for such older products.
Some units of the current model, the AK-SM 800A, were also affected; Danfoss told trade publication Cooling Post those units were running outdated firmware. For the AK-SM 800A, the latest software package listed by Danfoss on October 13 was 5.3.x. The package readme instructs systems on version 3.x to move to 4.x first and warns that a controller cannot be downgraded once it runs 5.3.x. Beginning with version 4.0 a setting called Strict Session Control is enabled by default and makes HTTPS mandatory.
Danfoss issued fixes in 2025 for three flaws in the AK-SM 800A: CVE-2025-41450 (authentication bypass in versions before 4.2), CVE-2025-41451 (command injection that could lead to remote code execution), and CVE-2025-41452 (denial-of-service). Those two post-login flaws were fixed in version 4.3.1. Claroty researchers described the three flaws in August 2025, said they could be combined into attack chains, and reported finding thousands of AK-SM 800A management interfaces reachable from the internet; Claroty’s tests were laboratory work on the newer model and did not describe attacks or the older models.
As of October 13, Danfoss's security advisories page listed no advisory about the October 11 incidents, and CERT-FR had published no indicators of compromise for operators to check.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCERT-FR and ANSSI instructions to operators
CERT-FR’s alert — published in French on October 12 — advised operators aware of AK-SM and AK-SC controllers to disconnect them or filter access. It noted that exposing a management interface to the internet runs counter to good practice. ANSSI’s head, Vincent Strubel, stressed the urgency of taking the two series off the internet or filtering access very tightly, AFP reported.
Where remote administration cannot be avoided, CERT-FR suggested as a first temporary step limiting access to trusted IP addresses, and it pointed operators to hardening recommendations originally written for the energy and water sector.
For controllers that may have been compromised, CERT-FR listed six remedial steps in this order:
- Limit network access to the controllers to service providers only.
- Do a factory reset.
- Apply all available security fixes (noting that Danfoss no longer issues fixes for the AK-SM 800 and AK-SC 355).
- Change the device's secrets, such as passwords.
- Check the existing accounts.
- Reconfigure the device completely.
Retail chains, refrigeration contractors, and the judicial inquiry
The Paris prosecutor’s office opened an inquiry on its own initiative; its cybercrime section leads the inquiry, which is assigned to the anti-cybercrime office known as OFAC. The inquiry aims to count victims and establish the link between the attack and reported damage, which the prosecutor’s statement said includes lost food and equipment that began to catch fire.
Coopérative U stores are customers of refrigeration contractors rather than buying directly from Danfoss; Schelcher noted that contractors supplied the Danfoss systems to those stores. Danfoss said it was “aware of incidents in France affecting a limited number of refrigeration management systems” and told Cooling Post it was working with customers on “firmware updates where available, stronger network protections and removing direct internet exposure where applicable.”
How refrigeration contractors, supermarket operators, and national authorities are responding
Refrigeration contractors: Contractors supplying Danfoss systems are both a distribution point and a first responder — Schelcher credited them with preserving the cold chain in many Coopérative U stores. Contractors will be under pressure to inventory deployed controller models and firmware versions and to assist customers in implementing CERT-FR’s six-step recovery process where compromise is suspected.
Supermarket operators: Chains are assessing losses and reacting locally; Intermarché said affected stores had to discard all concerned products, while Coopérative U reported most of its listed stores kept their cold chain intact. Operators using older AK-SM 800 or AK-SC 355 models face hard choices because Danfoss no longer issues fixes for those units.
National authorities: ANSSI and CERT-FR have issued immediate containment guidance and are coordinating with other European cybersecurity agencies, according to a person close to Prime Minister Sébastien Lecornu, who told AFP ANSSI had identified a vulnerability in software supplied by a Danish company and had contacted the vendor; no CVE was named and the statement did not say the vulnerability was used in the attack.
The facts on October 13 are concrete and limited: controllers tied to critical retail refrigeration were manipulated, older and unsupported devices bore much of the impact, CERT-FR has published specific containment and recovery steps, and France’s judiciary has opened a formal inquiry while Danfoss and public agencies work with customers and counterparts abroad. Who executed the attacks and the precise technical route used remain to be established.
