OVERNIGHT from 11 to 12 October 2026, hundreds of French supermarkets were hit when attackers remotely forced refrigeration controllers to switch into defrost mode, heating fridges and freezers to as high as 50°C. The resulting spoilage and at least two fires prompted a Paris prosecutor’s inquiry and warnings from CERT-FR.
Retailers including Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E[.]Leclerc reported significant stock losses, with Les Mousquetaires estimating tens of millions of euros across the country. The incident is described as a supplier-based compromise, with the affected systems largely managed by Danfoss and linked to end-of-life models.
Danfoss identified the AK-SM 800 and AK-SC 355 as end-of-life products, with some AK-SM 800A units running outdated firmware also implicated. Neither the vendor nor authorities have publicly named a vulnerability, CVE or intrusion path, though four ties to the AK-SM 800A were previously disclosed by Claroty (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452), which relate to authentication, command injection and configuration issues.
CERT-FR issued an alert advising operators to disconnect or tightly filter access to Danfoss AK-SM and AK-SC interfaces. SOCRadar’s Internet exposure analysis showed thousands of Danfoss StoreView interfaces in France still reachable online (2,898 results, ~65% of global total). No group has claimed responsibility, though NoName057(16) remains active and has linked recent hacktivist campaigns to France.