ATTACKERS gained remote control of Danfoss refrigeration controllers at hundreds of French supermarkets on the night of 11 October 2026, warming fridges and freezers to as high as 50°C and forcing stores to discard affected goods. The intrusion targeted Danfoss AK-SM and AK-SC controller series used to manage entire store cold chains. CERT-FR issued an alert on 12 October 2026 warning of numerous compromises affecting those two series and advising operators to disconnect the controllers or tightly filter access.
ANSSI said the response should prioritise removing internet exposure or restricting access to trusted networks, with six recommended steps for compromised devices.
The incident affected multiple chains, including Intermarché/Les Mousquetaires (at least 300 stores across Intermarché and Netto), Coopérative U (80 of about 2,000), Carrefour (around 80), Monoprix (about 30), and E[.]Leclerc in several stores. In some locations, stock wasn’t lost due to effective cold-chain management, while Intermarché indicated those stores that were hit had to discard products.
Danfoss stated most impacted units were older models no longer receiving updates; the AK-SM 800 and AK-SC 355 are end-of-life (AK-SM 800 since May 2021; AK-SC 355 since 2016), with the AK-SM 800A also affected in places. CVEs cited include CVE-2025-41450 (authentication bypass), CVE-2025-41451 (command injection), and CVE-2025-41452 (DoS), fixed in 4.3.1; newer firmware packages and hardening guidance are discussed, though Danfoss notes no universal fix for the two older models. CERT-FR’s guidance emphasises limiting network access, applying fixes where available, and following six-step remediation. SOURCE_UNAVAILABLE