Danfoss Refrigeration Controller Hijacking Campaign

In October 2026, a significant cyberattack targeted the refrigeration infrastructure of multiple French supermarket chains, including Intermarché, Carrefour, and Coopérative U. Attackers gained remote access to Danfoss AK-SM and AK-SC series controllers, forcing units into defrost cycles that raised temperatures to 50°C. This resulted in millions of euros in food losses and reports of equipment catching fire across hundreds of locations.

The attack primarily leveraged older, end-of-life Danfoss models (AK-SM 800 and AK-SC 355) that no longer receive security updates, though some current AK-SM 800A models running outdated firmware were also affected. While specific vulnerabilities used in this campaign have not been officially confirmed by CERT-FR, recent advisories for the AK-SM 800A (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452) highlight critical risks in these systems when exposed to the internet.

This incident underscores the high physical and financial risk of exposing Industrial Control Systems (ICS) and Operational Technology (OT) management interfaces to the public internet. Organizations in the retail and food logistics sectors should immediately audit their refrigeration controllers and implement strict network segmentation.