Attackers Turned 700 French Grocery Freezers Into Heaters. The Patch Was More Than a Year Old.

Late on Sunday night, the phone rang at the home of a supermarket manager outside Dijon. A monitoring company was calling to say the temperatures inside his store were climbing. Cyril Scheubel got in his car and drove in. "When I opened the freezers, there was no more cold," he told NPR. "Just hot air coming out."

By Monday morning that scene had played out across hundreds of French supermarkets. Attackers had reached into the refrigeration controls that manage a store's cold aisles and driven the setpoints up, in some cases to 50C (122F). Freezers are meant to run a short defrost cycle overnight. These were told to heat up and stay hot. Managers arriving at work were hit by a wave of warm air. In some stores there were small fires. In others, staff hauled cartloads of melting ice cream and spoiling meat out to bins on the pavement.

Finance minister Roland Lescure told parliament on Tuesday that about 700 of France's 10,000 supermarkets had been affected. Earlier counts were lower, with Reuters putting it at no fewer than 350 stores and the BBC estimating about 400 from the chains' own figures. Lescure said the country's food supply was not at risk, then added that the attack "touches the heart of our food security" and was "a wake-up call for everyone," according to the Associated Press.

The fix shipped in 2025

Here is the part that should trouble anyone who manages hardware in the field. None of this required a novel exploit. The weaknesses were published, and patched, more than a year before the attack.

The internet scanning firm Censys traced the record. CVE-2025-41450, an authentication bypass that let an unauthenticated attacker log in as administrator using a code computed from the calendar date, was disclosed in March 2025 and fixed in firmware version 4.2. Two more, CVE-2025-41451 and CVE-2025-41452, covering command injection and web server configuration injection in the same Danfoss AK-SM 800A controller, were disclosed in August 2025 and fixed in version 4.3.1, a build dated 31 July 2025.

Danfoss published advisories for both rounds, and so did CISA. Then in August 2026, Claroty's Team82 published research titled "Freeze the Controller, Defrost the Food," showing how the authentication bypass and the command injection could be chained into remote code execution, and presented it at DEF CON. Their scan found 2,765 of the controllers sitting on the open internet. The mechanism was not exotic: the controller generated an administrative password from its own current date, and anyone who reproduced the algorithm could log in without the real password. Security researcher Kevin Beaumont put the difficulty bluntly to The Register. "It's a zero-skill thing to pull off," he said.

The number that matters is not 700

France's CERT-FR, the incident response arm of the national cybersecurity agency ANSSI, issued alert CERTFR-2026-ALE-012 on 12 October and widened it the next day to add Copeland xweb and Dixell xweb controllers alongside the Danfoss AK-SM and AK-SC series. It warned that attack campaigns against the same equipment were probably still running, and that keeping an unpatched end-of-life device on the internet invites compromise.

What Censys measured next is the most useful data point in the whole episode. On 11 October it counted 1,825 Danfoss StoreView control panels exposed in France. By 14 October that was 537, a fall of 71%. Every firmware version group shrank by roughly the same amount, patched and unpatched alike. Nobody was deploying the update. They were pulling the controllers off the internet, which is the right call, and Censys said as much.

It is also an admission that the patch never reached the field. Reuters, scanning with Shodan on Tuesday, still found at least 4,500 Danfoss interfaces visible, and the French scanning firm Onyphe said only a small minority appeared to be running current software. Coalition, a cyber insurer, counted 1,506 unique IP addresses exposing a Danfoss StoreView admin panel between 7 September and 6 October, 820 of them on French networks, and still had 618 Danfoss devices online as of Thursday, 206 of those in France and 50 in the United States. UK Cyber Defence found more than 800 refrigeration and building controllers reachable in Britain.

The closest precedent is American. About a dozen US military commissaries reported refrigeration outages in late August, with Fort Huachuca saying all its freezers went into defrost mode and all frozen food spoiled. The Pentagon would only describe a "possible refrigeration disruption." Three military investigative agencies confirmed active investigations, and no findings have been announced. Sekoia's Felix Aime told Reuters that Spain, Portugal, Poland, Germany and Belgium were also affected this week, though most of the documented damage was in France.

Where the bill lands

The damage figures are company estimates rather than audited totals, and they vary by who is counting. Thierry Cotillard, chief executive of Intermarche owner Les Mousquetaires, told BFM TV the attack would cost "tens of millions of euros nationwide in a single day." Dominique Schelcher of Cooperative U put a small store at a few tens of thousands of euros and a large hypermarket at up to 200,000. Two Intermarche stores in Alsace reported a combined 270,000 euros in lost goods. Les Mousquetaires told OCCRP that 300 of its stores were compromised, and its press office said it would take about a week to return to normal for customers but two to three weeks to restore systems fully.

Collecting any of it may be harder than counting it. Intermarche told AFP that insurance would be a sticking point because its policies do not cover this kind of incident. CERT-FR's own remedy makes that worse. For a compromised unit the agency calls for a factory reset, which removes the attacker's persistence and, as the legal technology publication ComplexDiscovery noted in reading the alert, may also wipe the configuration, logs and account changes an insurer or a prosecutor will want to see.

Two things in the alert stand out for anyone who has to run this playbook. The first instruction to operators was to check their insurance conditions before cutting the data feed to their refrigeration contractor, because the remote access line is also a maintenance contract. And Schelcher told RTL that Cooperative U is not a Danfoss customer at all, which means the vendor named in the first alerts explains only part of the affected estate.

No group has claimed the attack and no ransom demand has surfaced. Reuters reported that the silence puzzled investigators, since such groups usually move quickly to monetise or publicise a hack. Ken Munro of Pen Test Partners told the agency it looked less like a state operation than "kids messing around," and asked why a nation-state would hit only some French fridges when "there are plenty of other nations with fridges on the internet." Claroty's chief technology officer, Amir Preminger, framed the underlying trade-off. Remote management "significantly reduces maintenance costs by allowing engineers to troubleshoot issues remotely," he said, "but it also lowers the barrier to entry for attackers."

The lesson is a lifecycle lesson

Strip away the cyber framing and this is a fleet problem. A controller installed in a supermarket in 2016 is expected to keep working for a decade or more. It was designed with remote access because that access closed a real maintenance-cost business case. When it reaches end of life, replacing it means a truck, an engineer, downtime for a cold aisle and a capital line item at every one of hundreds of sites. So it stays. Jonathan Braley of the Food and Ag-ISAC noted that the Danfoss AK-SM 800 reached end of life in 2021 and the AK-SC 366 was phased out in 2016.

That arithmetic is the same one facing anyone shipping connected hardware into a long-lived install base: industrial sensors, medical devices, building controls, vehicle chargers, kiosks. The security debt accrues quietly while the product is supported and comes due all at once when it is not.

Two questions follow from that, and they belong on the roadmap rather than in the incident channel. What is the real per-site cost of retiring a controller, and what does the migration plan look like when it lands on thousands of sites at once? And if remote access is a feature, who owns the exposure it creates, and what is the design that keeps the convenience without the public IP address?

The complexity behind keeping a fielded hardware fleet supportable for a decade, and paying for the transition when it stops being supportable, is the kind of problem that never shows up on a spec sheet. At DMC we work with hardware companies on sourcing strategy, cost modelling and production ramp planning across exactly this kind of transition. If you are working out how long to support a product family, or what a fleet-wide refresh actually costs, let's talk.