The French Freezer Hack Was Not the First: What Supermarket Freezers Teach Us About OT Security

On Monday morning 12th of October 2026, staff in hundreds of French supermarkets opened their stores and found warm freezers, spoiled food and in some cases even fire damage. This was not a technical failure or a heat wave. It was a cyberattack on the refrigeration systems.

But this story is not only about France. Belgium may also be affected, and more than a hundred similar refrigeration controllers are visible on the internet here today. Most controllers hit in France were so old that they cannot even be patched anymore. And this summer, freezers in American military supermarkets also went into defrost mode overnight. Keep reading to learn what happened, what it could mean for Belgium, and what you can do to protect your own connected systems.

Get in touch with our Cybersecurity Team!

Quick facts

/
About 700 of France's 10,000 supermarkets were hit, according to the French Finance Minister
/
Most hit controllers were end-of-life Danfoss products that no longer get security updates
/
Other European countries, including Belgium, may also be affected
/
A quick Shodan check found 111 Danfoss refrigeration interfaces open on the internet in Belgium

From Arizona to France: A Pattern in the Freezer Aisle

What happened in France? In the night from Sunday 11 to Monday 12 October 2026, attackers took remote control of the refrigeration systems in hundreds of French supermarkets. They forced fridges and freezers into a nonstop defrost cycle, and the temperature went up to 50°C for about six hours (source: Reuters). On Tuesday, the French Finance Minister told Parliament that about 700 of France's 10,000 supermarkets were affected. These are the numbers reported per chain:

Intermarché and Netto (Les Mousquetaires): about 300 stores, double the first estimate of 150
Carrefour: 80 supermarkets
Coopérative U (Super U, Hyper U): 80 of its 2,000 stores
Monoprix: about 5% of its stores, around 30
E.Leclerc: several stores

Meat, dairy, frozen products and vegetables had to be thrown away, and several stores reported fires. The head of Les Mousquetaires expects losses of tens of millions of euros (source: Facilities Dive). The Paris prosecutor opened a criminal investigation, and CERT-FR, part of the French cybersecurity agency ANSSI, published an alert on 12 October about "numerous compromises" of Danfoss AK-SM and AK-SC controllers. ANSSI also saw compromises of Copeland controllers (source: Associated Press). According to a Sekoia analyst quoted by Reuters, Belgium, Germany, the Netherlands, Poland, Portugal and Spain were also affected, but most of the damage is in France.

You probably know that weekends and vacation periods are the preferred time for hackers to strike: less personnel, less attention, bigger chance that alerts go unnoticed, potentially more damage...

In one of his latest LinkedIn updates, Patrick Coomans also reports that wholesale distributor Metro France and at least two meat-processing companies were affected, and that the attackers made defrost cycles longer, from one to eight hours, which delayed the alarms and increased the damage. These points are not yet confirmed by the main news sources.

The real problem: controllers that cannot be patched. Danfoss says most affected systems were older products that no longer receive software or security updates, mainly the AK-SM 800 (end of life since 2021) and the AK-SC 355 (phased out in 2016). Some current AK-SM 800A units on outdated firmware were also hit. Danfoss adds that it has long advised customers to update their firmware and to use a firewall (source: The Hacker News). In other words: thousands of supermarkets ran machines that were five to ten years past their security "best before" date, directly connected to the internet. Unfortunately, this is what we see on many factory floors when we start our ethical hacking attempt.

Look at the timeline. When you put the events next to each other, a pattern appears:

9 August 2026: Claroty Team82 publishes serious weaknesses in Danfoss refrigeration controllers.
From 26 August 2026: freezers fail at up to 14 US military commissaries in 10 states.
11 to 12 October 2026: freezers in about 700 French supermarkets are forced into defrost at 50°C.

The American case. Commissaries are the supermarkets on US military bases. At Fort Huachuca in Arizona, all commissary freezers went into defrost mode overnight and the frozen food was lost, while the power had not gone out. Military investigators (Army CID, Air Force OSI and DCIS) confirmed they are investigating. But be careful: the cause is still unknown. It could be a cyberattack, but also a software bug, a bad update or a configuration error (source: RedSeal). Two incidents with the same symptom is a reason to pay attention. It is not proof that they are linked.Also, there have been many sightings of potential hybrid warfare attacks, and these are only the ones that get into the news.

What about the Claroty research from August? Claroty's research looked at the current Danfoss AK-SM 800A, the central system manager that controls all refrigeration in a supermarket. The researchers found 2,765 of these controllers directly reachable on the internet, and three vulnerabilities. But be careful: this research is not officially linked to the attack, and it did not cover the older models that were hit the most. It is still a good example of the kind of weaknesses you find in these systems:

CVE-2025-41450 (CVSS 8.2), the "code of the day": a hidden login, probably meant for vendor support. The daily password is calculated only from the date. Yes it is unique and changes every day, but it is so easy to guess. Anyone who knows the formula can log in as administrator.
CVE-2025-41451 (CVSS 7.6), remote code execution: a field in the email alarm settings is not checked, so a logged-in attacker can run his own commands on the device.
CVE-2025-41452 (CVSS 5.4), web server configuration injection: a logged-in user can change how web traffic is handled and crash the web interface again and again.

Danfoss fixed these issues in firmware version R4.3.1. Let me explain the "code of the day" with a simple picture. Imagine a shop where the back door has a code lock. The code changes every day, which sounds safe. But the code comes from the date with a fixed formula, and the formula is the same in every shop. Once someone figures out the formula, he can open the back door of every shop, every day.

This is not only a Danfoss problem. Claroty also found vulnerabilities in Copeland XWEB Pro refrigeration controllers (source: Associated Press), and Armis found ten flaws in Copeland E2 and E3 controllers, together called "Frostbyte10" (source: TechRadar). And in France, ANSSI also saw compromises of Copeland controllers. Copeland says it was an old, discontinued generation of its products. The real lesson is not "avoid one vendor". The real lesson is that the whole refrigeration industry connects these systems to the internet for easy remote maintenance, and leaves them there for many years.

Important: at the time of writing, nobody knows who the attackers are or exactly how they got in. ANSSI says it found a vulnerability in the software of "a Danish company", without naming it. There is no official link with the Claroty CVEs. We have to wait for the official investigations in France and in the US. To be continud, we'll keep you posted via our website.

What About Belgium? And What Should You Do?

Is Belgium safe? Not really. Belgium is one of the countries that may also be affected, according to the Sekoia analyst.

Patrick Coomans (Vincotte/Kiwa) did a quick check with Shodan, a search engine for devices that are connected to the internet. He looked for Danfoss refrigeration management interfaces that are publicly reachable in Belgium and shared the results on LinkedIn. He found 111 of them. 60 of these serve web files dated before 2024, and 37 have expired TLS certificates. As he says himself, this is a passive snapshot. It does not prove that these controllers are unpatched. But it does raise serious questions about maintenance and basic security hygiene.

Refrigeration controllers are just one example. The same risks exist for building management, HVAC, solar inverters, machines on the factory floor and systems on ships. These are the lessons I share with my students and with companies:

Never put a management interface directly on the internet. Use a VPN or a secure remote access solution, also for maintenance companies.
Use MFA for all remote access. A username and password alone is not enough, also not for suppliers.
Know what you have. Make a list of all connected OT devices, their firmware versions and every remote access path, including the ones your suppliers installed.
Replace or isolate end-of-life controllers. If a device no longer gets security updates, you cannot patch it. Take it off the internet today and plan to replace it. For current devices like the Danfoss AK-SM 800A, install the latest firmware and change default passwords.
Your cooling does not need the internet. Some French stores have restored their refrigeration and keep it disconnected from the internet. Remote access is a convenience, not a requirement. (and why can freezers go up to 50 degrees celcius?)
Suspect a compromise? Follow the CERT-FR steps. Limit access to your service providers, do a factory reset, apply all available fixes, change all passwords and secrets, check the user accounts and fully reconfigure the device.
Segment your network. Refrigeration and other OT systems belong in a separate zone, away from office IT, cash registers, guest Wi-Fi and the internet.
Check if you are really isolated. Do not just assume that your firewall or VLAN does the job. Test what can really be reached from the internet.
Monitor more than temperature. Set alerts on repeated or very long defrost cycles, configuration changes and strange remote logins. Use an independent temperature alarm, so attackers cannot switch it off or delay it, and make sure the alarm reaches a real person at night.
Check your suppliers. Remote access by maintenance companies is a supply chain risk. Ask who has access, how, and with which controls.
Practice the worst case. Who decides, who calls whom, and how do you go back to manual control when OT systems stop working?

Think about the food waste. Hundreds of supermarkets threw away tons of perfectly good food, with losses of tens of millions of euros, and much of this could probably have been avoided. As Patrick Coomans puts it: cybersecurity is not a checkbox compliance item. It is about ownership, maintenance and responsible business.

European regulation and standards point in the same direction. The Cyber Resilience Act (CRA) asks manufacturers to deliver connected products that are secure by design and to handle vulnerabilities for many years. A hidden login with a predictable password is exactly what the CRA wants to stop. NIS2 asks organisations in critical sectors, including food production and distribution, to manage the cyber risks of their suppliers. And the IEC 62443 standard gives a practical framework to secure industrial systems, for vendors, integrators and asset owners.

At Howest Cyber3Lab, we work on OT and industrial security every day, in education, research and projects with companies. We also organise tabletop exercises where companies and governments practice their response to incidents like this one, with a focus on NIS2 and the CRA. Contact us if you want to know more.

Sources and further reading

Become the OT Security expert that companies are looking for

Incidents like the French freezer hack show one thing very clearly: companies need people who understand both IT and OT, and who can secure the machines that keep our food cold, our buildings running and our factories producing. That is exactly what our Industrial Security Masterclass is about. It is all about OT/ICS security: from network segmentation and secure remote access to IEC 62443, NIS2 and the CRA, with a strong focus on practice.

The next edition starts on February 11th, 2027, weekly every Thursday from 15h till 20h30. Become the OT Security expert that companies are looking for.

Authors

/
Patrick Van Renterghem, Community Builder @Cyber3Lab (AI + CyberSecurity + Web3 + Immersive Tech)

Want to know more about our team?

Visit the team page

Last updated on: 10/14/2026

TIOZ Howest