--- title: "Supermarket Fridges Hacked: How Freezers Were Set to 50C" url: https://syntaxradar.com/radar/supermarket-fridges-hacked-danfoss-defrost author: "Abdul Rehman, Lead Systems Architect and Technical Director" publishedAt: 2026-11-08T12:00:00.000Z dateModified: 2026-11-08T12:00:00.000Z category: "#SYSTEMS-ARCH" topic: "supermarket fridges hacked" primarySource: https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/ summary: "Supermarket fridges hacked in France and six more countries: how attackers apparently forced a 50C defrost, what CERT-FR confirms and what is unverified." --- # Supermarket Fridges Hacked: How Freezers Were Set to 50C **Short answer:** On October 11 to 12, 2026, attackers reached internet-exposed refrigeration controllers in about 700 French supermarkets and, per reports, apparently forced a 50C defrost. In November, 115+ stores in six more countries were hit and three French blood-plasma sites were targeted. **Takeaway:** Store refrigeration controllers left on the open internet were driven into hours-long 50C defrosts, and as of November 8, 2026, neither the exploited flaw nor the attacker has been officially named. **Key figures (as reported by the source):** - French supermarkets affected: About 700 of 10,000 - Defrost setting reported: 50C (122F) for hours - Exposed French StoreView panels: Over 1,800 to 537 in 3 days The supermarket fridges hacked in France were a real attack: overnight on October 11 to 12, 2026, attackers reached internet-facing refrigeration controllers in French stores and, according to Security Affairs, apparently forced fridges and freezers into a continuous defrost set to 50 degrees (122F). Finance Minister Roland Lescure put the toll at about 700 of France's roughly 10,000 supermarkets, [SecurityWeek reports](https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/). CERT-FR gives no store counts, so that figure is a single secondary report. A second wave followed in early November across six more countries, and on November 2 the same style of attack targeted the cold storage serving three French blood-plasma sites. France's national cyber response team, CERT-FR, confirmed the core of it in alert [CERTFR-2026-ALE-012](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/), published October 12 and last updated October 16: the remote controllers of refrigeration installations were targeted, and campaigns were "probably still ongoing". As of November 8, 2026, no official source has said who did it or which software flaw they used. For any store still running one of these boxes, that unknown is the risk. ### Supermarket fridges hacked: what happened in France and beyond The first wave of the supermarket fridge hack in France came overnight on October 11 to 12. [Security Affairs reported](https://securityaffairs.com/200863/hacking/hackers-cranked-french-supermarkets-freezers-up-to-50-degrees-causing-hundreds-of-stores-to-lose-their-stock.html) that Intermarché and Netto (the Mousquetaires group) counted about 300 affected stores, Coopérative U fewer than 100, and E.Leclerc several. Store counts moved as the days passed: SecurityWeek later cited about 150 Intermarché stores with units held at 50C for six hours, Carrefour 80 and Coopérative U 80, while earlier reports had put the national total at 300 to 350. The losses were concrete. The Intermarché in Haguenau lost its entire frozen stock, about €50,000, and the Leclerc in Wasselonne threw away about €220,000 of fresh and frozen goods. The Paris prosecutor opened an inquiry and said the attacks also caused fires. The attacks did not stop in France. [BleepingComputer reports](https://www.bleepingcomputer.com/news/security/cyberattack-disrupts-blood-storage-refrigeration-systems-in-france) that more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia were affected in early November. In one Swedish store the system began generating heat; in another the temperature was set to 50C (122F). Then came the blood supply. On November 2, attackers tried to raise temperature and defrost thresholds at three plasma cold-storage sites run by the French Blood Establishment (EFS), [AP reported](https://www.wlox.com/2026/11/05/cyberattack-blood-bank-freezers-thwarted-follows-supermarket-fridge-hacks/). EFS says monitoring caught it in time, no blood products or samples were compromised, and collection and distribution continued. EFS also says it was not the direct target: its refrigeration supplier was. ### What is a refrigeration controller? A refrigeration controller is the small computer that runs a store's cooling plant: it holds the temperature settings and the defrost schedule (defrost is a short heating cycle that melts ice off the cooling coils). Many have a web management page so they can be operated remotely, and that page is what the attackers reached. CERT-FR's list of affected equipment names four product lines: Copeland xweb, Dixell xweb, Danfoss AK-SC series and Danfoss AK-SM series. Security Affairs narrowed the October models to the Danfoss AK-SM800 and AK-SC355, both end of life, and the Danfoss AK-SM 800A running outdated firmware. Per SecurityWeek, AK-SM 800 support ended in May 2021 and the AK-SC 355 was discontinued in 2016. The login page is the weak point. CERT-FR states plainly that exposing a management interface to the internet goes against good practice. Yet on October 11, the internet-scanning service Censys counted nearly 3,000 internet-exposed Danfoss StoreView panels (StoreView is the web interface on these controllers), over 1,800 of them in France. Anyone running the same kind of scan can find those open doors, the same pattern our explainer on [what botnets are](/radar/what-are-botnets-android-tv-boxes) traces through 1.3 million hijacked TV boxes. ![Chart of the French supermarket fridge hack: about 700 of 10,000 stores hit, 7 percent](/uploads/blog/supermarket-fridges-hacked-danfoss-defrost/img1.webp) ### How did hackers heat supermarket fridges? The attackers heated the fridges by turning the defrost function against the cooling units. According to Security Affairs, the attackers apparently triggered forced defrost in continuous mode with a 50-degree setting, so the heaters that normally run briefly kept running for hours. Le Monde reported, via SecurityWeek, that defrost cycles were stretched from one hour to as many as eight, which delayed alarms. How they got in is the open question. CERT-FR does not name the exploited vulnerability. There is a documented candidate, though. In May 2025, [CISA advisory ICSA-25-140-03](https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03) listed three CVEs in the Danfoss AK-SM 800A series: - CVE-2025-41450, improper authentication (the login check can be bypassed), severity 8.2 out of 10, fixed in firmware (the software built into the device) version R4.2. - CVE-2025-41451, command injection (an attacker makes the device run commands it should not), 7.6, fixed in R4.3.1. - CVE-2025-41452, a configuration injection that can cause denial of service (knocking the service offline), 5.4, fixed in R4.3.1. If those labels are new to you, our guide to [reading a Linux kernel vulnerability CVE](/radar/linux-kernel-vulnerability-cve-2026-98432) explains what a CVE number and its score do and do not tell you. At the time, CISA noted high attack complexity and no known public exploitation. On August 9, 2026, [Claroty's Team82](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers) described the login flaw in plain terms: a hidden "code-of-the-day" path whose password is derived only from the device's current date. Anyone who reproduces the algorithm gets admin access for any day. Claroty did not publish the algorithm and its write-up describes no defrost or temperature effect. It found 2,765 exposed Danfoss AK-SM 800A devices. Belgian company Sabcobel said the attackers used the same vulnerability in November as in October. BleepingComputer says it is unconfirmed whether CVE-2025-41450 or 41451 are being exploited. The date-based password is the best-documented way in, and it remains unconfirmed. A remote login left facing the internet is the same lesson our post on the [OpenSSH vulnerability 2026](/radar/openssh-vulnerability-2026-alpine-fix) draws for servers. ### What we checked: the timeline from warning to attack This is a SyntaxRadar calculation built from the dates and counts in the sources above. Our arithmetic, not a source claim, is in the right-hand column.
What we measuredInputsResult
CISA advisory first published to attack nightMay 20, 2025 (CISA) to October 12, 2026 (CERT-FR)510 days
Fixed firmware R4.3.1 documented to attack nightAugust 26, 2025 (CISA Update A) to October 12, 2026412 days
Claroty public write-up to attack nightAugust 9, 2026 to October 12, 202664 days
CERT-FR alert to blood-site attemptOctober 12 to November 2, 202621 days
Share of French supermarkets hit700 of about 10,000 (Lescure, via SecurityWeek)7%
Exposed French StoreView panelsOver 1,800 on October 11 to 537 on October 14 (Censys, via SecurityWeek)At least 70% fewer in three days (1,800 is a floor)
Exposed AK-SM 800A, ShadowserverMore than 550 to about 350 within one week (Cybersecurity Dive)About 36% fewer
Two caveats. First, no official source links the attack to the 2025 CVEs, so the 510 and 412 day gaps show how long a documented fix existed. They do not prove it would have stopped this attack. Second, the older AK-SM 800 and AK-SC 355 are end of life: at attack night the AK-SM 800 had been out of support for about five years and five months, so for those boxes there may be no firmware fix to install at all. Exposure fell in the days after the alert, but not to zero. [Cybersecurity Dive](https://www.cybersecuritydive.com/news/thousands-refrigerator-devices-exposed-french-cyberattack/833117/) also cites Shadowserver counting 1,173 exposed Copeland XWEB Pro and Evo instances, and SecurityScorecard counting more than 5,200 StoreView instances across more than 4,600 public IP addresses. These are different scans on different dates, so they are not directly comparable. The cost figures are scattered. The two Alsace stores above lost €270,000 between them (€50,000 plus €220,000, which matches SecurityWeek's combined figure). That is two hand-picked examples, not an average for 700 stores. Separately, Ahold Delhaize expects fourth-quarter sales to be cut by up to €250 million ($281 million) and operating income by up to €100 million; AP links that to the fridge attacks, while the company itself blamed "malicious actions by others". ![Supermarket refrigerators hacked in France: a frosted freezer aisle with a wall-mounted refrigeration controller](/uploads/blog/supermarket-fridges-hacked-danfoss-defrost/img2.webp) ### Is my smart fridge safe from hackers? No source we opened reports a home smart fridge being hit. Every device CERT-FR lists is commercial refrigeration equipment: controllers that run the cooling plant of a store or a cold-storage site. So can hackers hack a fridge? Yes, if the fridge has a reachable login and an unpatched flaw, because at that point it is a computer with a cooling system attached. The supermarket case shows the conditions that made it possible: a management page facing the open internet, and old or end-of-life firmware. As general good practice rather than anything these sources say, the same checks apply at home: keep connected devices updated, change default passwords and do not open them to the internet. None of the sources we opened ties AI tooling to these attacks. For background on how attackers use AI to scale up elsewhere, see our report on [AI for hacking](/radar/ai-for-hacking-artex-crowdstrike), which is separate from the fridge facts above. ### What should operators do when supermarket refrigerators are hacked? CERT-FR's checklist for operators is short and specific: - Remove the controller from the internet entirely. - Review the whole configuration, including defrost schedules, not just passwords. - Restore remote access only through a secure VPN or protected network. IP filtering is only an emergency step. - Update the firmware, set the Danfoss security level to Strict and change default passwords. - If a unit was compromised, restart or factory-reset it, then reconfigure it. A factory reset alone is not enough, because the device stays vulnerable. Claroty's advice for the Danfoss AK-SM 800A matches: upgrade to R4.3.1 or later and keep the device on a trusted network only. Google Threat Intelligence's John Hultquist, quoted by Cybersecurity Dive, argued this supply chain should be treated as critical infrastructure. The supplier side is still murky. Press reports name Coolworld as the blood service's refrigeration provider; EFS itself has not named it. Coolworld told BleepingComputer it is aware of an incident involving remote monitoring software, that only a limited number of units were affected, and that the cause was a vulnerability in a third-party component outside its direct control. Copeland said it is working with affected customers. ### Supermarket fridges hacked: what to watch next Three things will settle the open questions. First, whether CERT-FR, Danfoss or the Paris prosecutor names the exploited flaw: as of November 8, 2026, none has. Second, attribution: no group has claimed the attacks in any source we opened. Third, the exposure counts: if the Shadowserver and Censys numbers keep falling, the pool of reachable controllers shrinks, and if they stall, CERT-FR's warning that campaigns are probably ongoing still stands. The contested 110C setpoint (the target temperature, not a reading) at the blood-plasma sites (Le Canard Enchaîné's figure, which a French outlet says was a value sent to the machine, not a temperature reached) is the other detail to watch for an official account. ## Frequently asked questions ### How did hackers heat supermarket fridges? According to Security Affairs, attackers reached the web management pages of Danfoss refrigeration controllers and apparently switched on forced defrost in continuous mode with a 50-degree setting. Defrost heaters that normally run briefly kept running for hours. Le Monde reported cycles stretched from one hour to as many as eight, which delayed alarms. CERT-FR has not said which flaw was used. ### Can hackers hack a fridge? Yes. In these attacks hackers heated fridges and freezers remotely because the controller had a reachable login and an unpatched flaw. The October 2026 attacks hit commercial controllers made by Danfoss, Copeland and Dixell that were exposed to the internet, according to CERT-FR. None of the sources reports home appliances being affected, but the same rules apply: update, change default passwords, keep it off the open internet. ### Which French supermarkets were hacked? Several chains had supermarket fridges hacked in France. Security Affairs reported about 300 affected Intermarché and Netto stores, fewer than 100 Coopérative U and several E.Leclerc. SecurityWeek later cited about 150 Intermarché, 80 Carrefour and 80 Coopérative U. Finance Minister Roland Lescure put the total at about 700 of roughly 10,000. CERT-FR gives no store counts, so the figures remain press reports. ### Was the French blood supply at risk? On November 2, 2026, attackers tried to raise temperature and defrost thresholds at three plasma cold-storage sites of the French Blood Establishment (EFS), AP reported. EFS says monitoring caught it in time, no blood products or samples were compromised, and collection and distribution continued. EFS says its refrigeration supplier, not EFS itself, was the target. ### Who hacked the supermarket fridges? As of November 8, 2026, no group has claimed the attacks in any source we opened, and no official body has named an attacker. The Paris prosecutor opened an inquiry. CERT-FR also does not name the exploited vulnerability, and BleepingComputer says it is unconfirmed whether the 2025 Danfoss flaws listed by CISA were used. ## Source Based on CERT-FR alert CERTFR-2026-ALE-012 and CISA ICSA-25-140-03. https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/ --- Published on SyntaxRadar (https://syntaxradar.com). Canonical URL: https://syntaxradar.com/radar/supermarket-fridges-hacked-danfoss-defrost. Last modified 2026-11-08T12:00:00.000Z.