The Freezer Hack: Anatomy of an Unprecedented Cyberattack on the French Cold Chain

Summary

On the night of 11–12 October 2026, unidentified individuals remotely took control of the refrigeration systems of several hundred French supermarkets, targeting the connected cold controllers of the Danish manufacturer Danfoss. The attackers triggered continuous forced defrost cycles, driving the temperature of refrigerated display cases and freezers up to 50 °C. The consequences were immediate and tangible: entire stocks of fresh and frozen goods destroyed, supply disruptions, fires breaking out in several stores, and losses estimated at several million euros. This attack is regarded as the first cyberattack to have a direct physical impact on a country’s food supply chain. (franceinfo, CNBC, Wikipedia)

1. What Happened

The attack took place on the night of Sunday 11 to Monday 12 October 2026, a deliberately chosen time window: the stores were closed or thinly staffed, and the nighttime defrost cycle, a normal part of how such installations operate, concealed the anomaly from the alarm systems. The attackers sent repeated defrost commands to the cold controllers, with absurd temperature setpoints of up to 50 °C — and even higher values displayed on the supervision apps (the manager of a Carrefour Market store in Rennes reported freezers “programmed to 95 °C”). (franceinfo, shattered.io)

The scale of the damage was only discovered when the stores opened: thawed frozen food, softened ice cream, fresh-food aisles emptied and cordoned off. The affected stores include at least 300 Intermarché/Netto locations, around one hundred Coopérative U stores, roughly 80 Carrefour supermarkets, some thirty Monoprix stores and several E.Leclerc stores — by some estimates between 800 and 1,000 stores in total, although several sources suggest a figure closer to 400 to 600 establishments. (20 Minutes, RMC/BFM, Futura)

According to the Paris public prosecutor’s office, fires also broke out in some equipment, a direct consequence of the abnormal and prolonged stress placed on compressors and defrost heaters. (franceinfo, CNBC)

2. The Method: How Do You Hack a Freezer?

2.1 The Target Architecture: Connected Refrigeration Supervision

A modern store does not have a standalone freezer but a complete refrigeration plant: every refrigerated case and every cold room has its own controller (electronic thermostat), and the whole is supervised by a “system manager”, a small server that centralises temperature setpoints, schedules defrost cycles, collects alarms, and allows refrigeration technicians to intervene remotely via an embedded web server. (France Inter, Claroty, flawfence)

It is precisely this remote administration capability that served as the entry point: “every time you connect something to the Internet or a system can be controlled remotely, you create a new attack surface”, as the ethical hacker SaxX put it. (Huffington Post)

2.2 The Targeted Equipment

The targeted controllers are Danfoss equipment, mainly the AK-SM 800 and AK-SC 355 series, running old firmware versions predating version 4. Danfoss confirmed that the compromised systems were mostly legacy equipment that no longer received security updates. (Journal du Geek, Gate News, RMC/BFM)

2.3 The Exploited Vulnerabilities

The strongest technical lead points to the research published by Claroty’s Team82 in August 2026, roughly two months before the attack. That research identified three critical vulnerabilities in the Danfoss AK-SM 800A controller (Claroty, hard2bit):

  • CVE-2025-41450: an authentication bypass based on a daily access code derived from the device’s current date; anyone who reproduces the algorithm can generate a valid administrator code for any device, on any day;
  • CVE-2025-41451: a command injection allowing code execution after authentication;
  • CVE-2025-41452: a denial of service.

All three flaws were fixed by Danfoss in firmware R4.3.1. Equipment still running earlier versions remained exposed. (Gate News, Claroty)

The probable modus operandi, widely relayed by experts during the incident, was summarised by researcher Kevin Beaumont in one sentence: “the username is admin and the password automatically changes every day to… today’s date”. The compromised controllers exposed their web administration interface directly on the Internet. (International Cyber Digest, intsignal)

An important nuance deserves emphasis: no official source has confirmed to date which specific flaw was exploited, and investigators have not publicly established the intrusion vector. Moreover, a legitimate administrator holding the credentials would have needed no vulnerability at all to change a defrost setting: manipulating that parameter is routine administration. (intsignal, hard2bit, Futura)

2.4 How the Attack Unfolded

The attack probably required no exceptional skills. The reconstructed scenario is as follows (shattered.io, Ars Technica):

  1. Reconnaissance of Internet-exposed Danfoss controllers using connected-device search engines (Shodan); post-attack research identified about 4,980 Danfoss hosts reachable online, 2,911 of them in France;
  2. Authentication on the web administration interfaces using the predictable date-derived password;
  3. Triggering of forced defrost mode, repeatedly and for extended periods, in the middle of the night;
  4. Modification of temperature setpoints (values around 50 °C), without triggering the alarms designed to detect abnormal temperatures in normal operation.

Physically, defrosting exploits the hot discharge gas from the compressor, whose temperature is around 50 °C: leaving a unit in continuous defrost naturally brings it to that temperature, without any sophisticated heating element being required. (Ars Technica)

The simultaneous coordination of hundreds of units demonstrates, according to some experts, a degree of operational sophistication; others, such as Clément “SaxX” Domingo, argue on the contrary that this hack was “not that sophisticated”, the flaw being known, documented, and trivial to exploit. (franceinfo, Futura)

3. The Causes: Why Was This Possible?

3.1 Industrial Systems Designed Without Cybersecurity

Industrial refrigeration equipment long remained isolated systems (OT — operational technology), with no Internet connection. They were designed to prioritise “reliability and cost control, rather than protection against cyberattacks”, because attackers could not access them remotely. Connectivity was added after the fact, without a fundamental rethink of the security architecture. (Le Temps, 20 Minutes)

3.2 Direct Exposure to the Internet

The decisive factor is the direct exposure of administration interfaces to the Internet, with no filtering, VPN, or network segmentation. “Why would individual devices, in this case refrigerated display cases, be directly exposed to the wider Internet?”, wondered Bruce Schneier, for whom the attack illustrates a fundamental architectural failure. (Schneier on Security, Ars Technica)

3.3 Obsolescence and the Patch Deficit

The compromised equipment was running old firmware, predating version 4, with no possibility of security updates, which “made the task rather easy for the pirates”, according to cybersecurity expert Benoit Brunenwald. The gap between the public disclosure of the vulnerabilities (August 2026) and their exploitation (October 2026) illustrates the recurring “patch gap” problem on embedded systems, which nobody monitors with the same urgency as an enterprise VPN flaw. (RMC/BFM, shattered.io)

3.4 A Shared Supply Chain

The fact that the refrigerated cases of several competing chains (Intermarché, Carrefour, Monoprix, Système U, E.Leclerc) were all supervised by controllers from a single manufacturer created a systemic vulnerability: a single flaw at one single vendor was enough to hit the entire French retail sector. (TF1 Info, flawfence)

4. Consequences and Responses

The material consequences are considerable: destruction of food stocks (cold chain broken, hence unfit for sale), closure of aisles, fires, and losses estimated at several million euros across the retail sector. The manager of an Intermarché store in Alsace summed up the situation: “we have to throw everything away”. (RMC/BFM, franceinfo)

The public authorities’ response was swift and of an unusual level for this type of incident (Konbini, 20 Minutes, TF1 Info):

  • the Paris public prosecutor’s office opened an investigation on its own initiative, assigned to the Office for the Fight against Cybercrime (OFAC), covering the entire national territory;
  • ANSSI (the French national cybersecurity agency) was seized of the matter by the Prime Minister, Sébastien Lecornu, who is personally following the case, and CERT-FR published an alert on 12 October devoted to the AK-SM and AK-SC series Danfoss controllers;
  • ANSSI’s director general, Vincent Strubel, deemed it “urgent to disconnect these controllers from the Internet, or at the very least to adopt a highly restrictive network filtering policy”;
  • at the European level, the Commissioner for Agriculture, Christophe Hansen, firmly condemned the attack, stating that “the weaponisation of food has become a reality”; ANSSI is coordinating with its European counterparts, with cases reported in Spain, Portugal, Poland, Germany and Belgium;
  • the French Retail Federation (FCD) demanded “total transparency” from Danfoss and the refrigeration contractors.

At this stage, no group has claimed the attack and no actor has been identified; no ransom demand has appeared. The absence of any claim and the low technical sophistication point to opportunistic actors, but the hypothesis of a destabilisation operation targeting food security has not been ruled out. (franceinfo, Futura, CNBC)

5. Outlook

5.1 Towards a Hardening of OT System Security

The incident confirms a broad trend of 2026: the exploitation of known, unpatched embedded firmware, rather than the pursuit of novel zero-day flaws. The immediately applicable technical recommendations are clear (intsignal, flawfence):

  1. disconnect OT equipment administration interfaces from the Internet and allow remote access only via VPN or a trusted network;
  2. update firmware (R4.3.1 minimum on the AK-SM 800A) and migrate legacy systems to current-generation solutions;
  3. change default passwords and apply the “Strict” security level recommended by the manufacturer;
  4. review the entire configuration, starting with defrost schedules: a setpoint altered during the attack may lie dormant until the next cycle;
  5. segment refrigeration supervision networks from the rest of the information system.

The attack raises unprecedented questions of liability: does the fault lie with the manufacturer (the date-derived password), the refrigeration contractor, the retailer, or the installer? Insurers, whose cyber policies were drafted for data breaches, did not necessarily cover a scenario of “a freezer catching fire because of unpatched firmware”. Contract renewals in late 2026 and early 2027 are expected to include specific questions about OT firmware patching cadence and exposure to refrigeration equipment, mirroring the underwriting requirements that emerged after the ransomware wave. (shattered.io)

5.3 Food Chain Security as a Sovereign Issue

The deepest lesson of the affair is structural: a supermarket freezer is not classified as “critical infrastructure”, even though the consequences of its compromise — destroyed food, paralysed stores, a public-health scare, fires — are real and immediate. The 2026 attack belongs to the lineage of Stuxnet and the attack on the Ukrainian power grid, from which it differs in the nature of its target: it manipulates a physical variable (temperature) rather than stealing data or encrypting files, but strikes an ordinary economic actor, presumably poorly protected. (shattered.io, Le Temps)

In the coming months, one can anticipate an extension of European cybersecurity regulation (the NIS 2 directive, the Cyber Resilience Act) to cold-management and cold-chain systems, along with stronger security-by-design requirements for connected industrial equipment. The incident also illustrates the risk of propagation: disruptions have since been reported in the Netherlands, Belgium and, to a lesser extent, the United States. (Wikipedia)

Conclusion

The October 2026 supermarket freezer hack will probably be remembered as the moment the cyber threat walked through the door of the fresh-food aisles. It involved neither a technical tour de force nor a novel exploit: predictable passwords, obsolete equipment exposed to the Internet, and a legitimate function (defrosting) diverted from its intended use. It is precisely this mundane assembly of ordinary negligence that makes the event so instructive — and so worrying. As long as connected industrial systems retain security architectures dating from the era when they were isolated from the world, every connected device will remain a potential attack surface against the most essential infrastructure of all: the one that feeds the population. (franceinfo, shattered.io)

Main Sources

Related Posts

Leave a Reply

Your email address will not be published. Required fields are marked *