Attackers manipulate Danfoss controllers to raise temps to 122F, forcing food disposal at major French chains

Attackers manipulated industrial refrigeration controllers at hundreds of French supermarkets early Monday, causing severe food spoilage and fires. The incident targeted Danfoss systems running outdated firmware, highlighting risks in connected operational technology.

What happened

Hackers executed a coordinated attack against hundreds of supermarkets in France early Monday morning. According to CNET, the intruders exploited a software vulnerability to force connected fridges and freezers into defrost mode. This action raised internal temperatures to 50 degrees Celsius (122 degrees Fahrenheit) for several hours.

The attack impacted three major grocery chains: E. Leclerc, Intermarche, and Cooperative U. Paris authorities told the news agency AFP that other grocery chains were also hit by the intrusion. The extreme heat caused significant food spoilage and triggered fires in some locations.

Danfoss told the industry publication Cooling Post that the hackers targeted software on two specific system controllers. The affected devices were the AK-SM800 and AK-SC355 models. Danfoss stated these systems were running outdated firmware at the time of the breach.

Why it matters

Dominique Schelcher, CEO of Cooperative U, posted on X that an investigation into the attack is underway. He described targeting equipment essential to preserving fresh products as being of extreme gravity. Schelcher noted that such an attack on the French food supply is unprecedented in its nature.

The incident underscores the growing risk to operational technology and cold-chain infrastructure. Although these were not consumer smart fridges with touch screens, the controllers were connected to the internet. This connectivity allowed remote management of defrost cycles, temperatures, and alarms across many stores.

Danfoss told Cooling Post that the company is working with affected customers to implement mitigation measures. These steps include applying firmware updates where available and strengthening network protections. The company also advised removing direct internet exposure from these controllers where applicable.

A representative for Danfoss did not immediately return a request for comment regarding the specific breach details. On its web page for AK-SM800 controllers, Danfoss stated that new measures are being implemented to improve security. The company emphasized that it takes security seriously.

What to watch

• Monitor for official advisories from Danfoss regarding the AK-SM800 and AK-SC355 controllers.
• Track updates from French authorities on the scope of affected grocery chains.
• Watch for details on the specific exploit chain used in this coordinated attack.

What to do and how to stay safe: Danfoss

• Audit your network to identify any industrial control systems or refrigeration units with direct internet exposure.
• Verify that all OT devices are running the latest firmware versions provided by the manufacturer.
• Segment operational technology networks from corporate IT networks to limit lateral movement for attackers.
• Review access logs for connected appliances to detect unauthorized configuration changes or remote commands.

Step-by-step guide: Software Updates Best Practices: Secure Patching Without Downtime

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific Danfoss controllers were compromised in this attack?

The attack targeted the AK-SM800 and AK-SC355 system controllers, which were running outdated firmware.

What immediate steps is Danfoss recommending to affected customers?

Danfoss advised implementing firmware updates, strengthening network protections, and removing direct internet exposure.

Were any specific threat actors identified as responsible for the breach?

It is currently unclear who is responsible for the attacks or the exact exploit chain used.