The French Freezer Hack: When Hackers Heat Up the Supermarket
The French Freezer Hack: When Hackers Heat Up the Supermarket
On Monday morning 12 October 2026, staff in hundreds of French supermarkets opened their stores and found warm freezers, spoiled food and in some cases even fire damage. This was not a technical failure or a heat wave. It was a cyberattack on the refrigeration systems.
For years, we talked about OT security as something for power plants, factories and ports. This attack shows that OT is everywhere, also in the supermarket around the corner. Keep reading to learn what happened, how the attackers could get in, and what you can do to protect your own connected systems.
Read the Claroty Team82 research
Main section
Quick facts
/
Hackers forced fridges and freezers in hundreds of French supermarkets to 50°C for about six hours
/
Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc stores were affected
/
In August 2026, Claroty found 2,765 Danfoss AK-SM 800A controllers reachable on the internet
/
Danfoss firmware R4.3.1 fixes three known vulnerabilities in these controllers
What Happened in the French Supermarkets?
In the night from Sunday 11 to Monday 12 October 2026, attackers took remote control of the refrigeration systems in hundreds of French supermarkets. They forced fridges and freezers into a nonstop defrost cycle, and the temperature went up to 50°C for about six hours (source: Reuters). These were the reported numbers on Monday:
- Intermarché and Netto (Les Mousquetaires): around 150 stores
- Carrefour: 80 supermarkets
- Coopérative U (Super U, Hyper U): fewer than 100 stores
- Monoprix: about 5% of its stores
- E.Leclerc: some stores
Meat, frozen products and vegetables had to be thrown away, frozen food aisles were closed, and several stores reported fires. The Paris prosecutor opened a criminal investigation, and Prime Minister Sébastien Lecornu asked ANSSI, the French national cybersecurity agency, to investigate. France is also working with other European countries, because they could be affected too. Danfoss, the maker of the cooling controllers, confirmed it is aware of incidents in France with a limited number of its refrigeration management systems (source: CNN).
The warning came in August. On 9 August 2026, Claroty's Team82 published research on the Danfoss AK-SM 800A. This is the central system manager that controls all refrigeration in a supermarket, cold store or warehouse. Technicians use its web interface to manage the installation from a distance. Using the Censys search engine, the researchers found 2,765 of these controllers directly reachable on the internet. They also found three vulnerabilities:
- CVE-2025-41450 (CVSS 8.2), the "code of the day": a hidden login, probably meant for vendor support. The daily password is calculated only from the date. Anyone who knows the formula can log in as administrator without the real password.
- CVE-2025-41451 (CVSS 7.6), remote code execution: a field in the email alarm settings is not checked, so a logged-in attacker can run his own commands on the device.
- CVE-2025-41452 (CVSS 5.4), web server configuration injection: a logged-in user can upload a new web server configuration, change how traffic is handled, and crash the web interface again and again.
Danfoss fixed these issues in firmware version R4.3.1. Important: at the time of writing, the authorities have not confirmed how the attackers got in. Several news sites link the attack to this research (for example Quartz), but we have to wait for the official investigation.
Let me explain the "code of the day" with a simple picture. Imagine a shop where the back door has a code lock. The code changes every day, which sounds safe. But the code is calculated from the date with a fixed formula, and the formula is the same in every shop. Once someone figures out the formula, he can open the back door of every shop, every day. That is why hidden vendor logins are so dangerous.
Why does this matter so much? This was not a data breach. It caused physical, immediate damage that you cannot undo: lost food, closed aisles and fires. It is a clear example of an attack on OT (Operational Technology), the systems that control temperature, energy and machines in our daily life.
Bottom section
Lessons for Every Company with Connected Machines
Refrigeration controllers are just one example. The same risks exist for building management, HVAC, solar inverters, machines on the factory floor and systems on ships. These are the lessons I share with my students and with companies:
- Never put a management interface directly on the internet. Use a VPN or a secure remote access solution, also for maintenance companies.
- Know what you have. Make a list of all connected OT devices, including the ones your suppliers installed and manage.
- Patch. If you use a Danfoss AK-SM 800A, update to firmware R4.3.1 or later as soon as possible.
- Segment your network. OT systems belong in a separate zone, away from office IT and the internet.
- Monitor. A freezer that goes to 50°C in the middle of the night should trigger an alarm that reaches a real person.
- Check your suppliers. Remote access by maintenance companies is a supply chain risk. Ask who has access, how, and with which controls.
- Practice the worst case. Who decides, who calls whom, and how do you go back to manual control when OT systems stop working?
European regulation points in the same direction. The Cyber Resilience Act (CRA) asks manufacturers to deliver connected products that are secure by design and to handle vulnerabilities for many years. A hidden login with a predictable password is exactly what the CRA wants to stop. NIS2 asks organisations in critical sectors to manage the cyber risks of their suppliers and their supply chain.
At Howest Cyber3Lab, we work on OT and industrial security every day, in education, research and projects with companies. Our Industrial Security Masterclass starts again in February 2027. This intensive and unique 8-day training is one of the best ways to learn all about industrial control systems, protocols, regulations, security assessment and defense of your critical IT/OT infrastructure.
We also organise tabletop exercises where companies and governments practice their response to incidents like this one, with a focus on NIS2 and the CRA. Contact us if you want to know more.
Sources and further reading
- Claroty Team82: Freeze the Controller, Defrost the Food (technical research on the Danfoss AK-SM 800A)
- Danfoss security advisory DSA-2025-08-01
- Reuters: Hackers heat French supermarket fridges
- CNN: French supermarket cyberattack on fridges
- Quartz: Hackers knocked out refrigeration at hundreds of French supermarkets
Contributors
Authors
/
Patrick Van Renterghem, Community Builder @Cyber3Lab (AI + CyberSecurity + Web3 + Immersive Tech)
Want to know more about our team?
Visit the team page
Last updated on: 10/13/2026
/
