French Supermarket Fridges Were Defrosted Remotely. Danfoss Says Most of the Hit Gear No Longer Gets Security Updates.

Hundreds of French supermarkets had their refrigeration sent into defrost remotely overnight on Sunday, October 11, 2026, and the controllers involved came from Danfoss. The Danish company says most of the units hit are legacy products that no longer get security updates. The firmware fix most coverage points to is for a differently named series, and the advisory behind it dates to May 2025.

What the retailers say happened

A spokesman for Groupement Mousquetaires, which owns Intermarché and Netto, said fridges and freezers heated to 50 degrees Celsius, or 122 degrees Fahrenheit, for around six hours. That account comes via The Next Web. The spokesman put the Intermarché count at about 150 stores. The retailers told AFP something larger: at least 300 Intermarché or Netto shops, more than 100 Coopérative U outlets, and several E. Leclerc stores. Carrefour said 80 of its 6,000 supermarkets were hit.

Intermarché told AFP the affected branches would have to throw away all fresh and frozen products. Paris prosecutors opened an investigation and indicated the attack had also set off fires. Dominique Schelcher, chief executive of Coopérative U, called it "unprecedented" and "unacceptable" in statements reported by The Record. The retailer counts do not agree with each other, and no outlet has reconciled them.

The flaw everyone cites is older than the headlines suggest

Several reports say researchers flagged weaknesses in Danfoss controllers in August. That is the date of a write-up, not of the discovery. Claroty's Team82 published its research on August 9, 2026, but the U.S. cybersecurity agency CISA had already posted an advisory on the same family of flaws on May 20, 2025, updated August 26, 2025. It covers three CVEs in the Danfoss AK-SM 8xxA series, including a hidden "code-of-the-day" login derived from the device's date. Claroty reverse engineered the routine and wrote that anyone who could reproduce it could generate valid credentials without knowing the administrator's password.

The same advisory lists Danfoss's fixes. Release R4.2 addresses the login bypass, and R4.3.1 addresses the other two. The advisory predates this attack by about seventeen months. Claroty also counted 2,765 AK-SM 800A controllers exposed to the internet through Censys, a scan figure from the researchers, not a count of vulnerable stores.

Danfoss names different models

“no longer receive software or security updates”

Danfoss told AFP the AK-SM800 and AK-SC355 regulator systems were notably affected, with one version of the AK-SM800 running "outdated firmware." It said it had long advised supermarkets to update from those models. It gave no figure for how many systems were hit.

Read the two records side by side. CISA and Claroty describe the AK-SM 8xxA series. Danfoss names the AK-SM800 and AK-SC355. None of the sources reviewed for this story say whether those lines share code, and none says the attackers used any of the published CVEs. The Record put it flatly: it is not known whether those flaws were used.

The blame is also unsettled. Mousquetaires said Danfoss manages the affected systems and that filing a criminal complaint was the supplier's job. Danfoss says the supermarkets were told to upgrade. Both can be true, which is the problem. A person close to the French prime minister said the national cybersecurity agency ANSSI had identified "a vulnerability in software supplied by a Danish company." The source did not say which one.

Not the first time a fridge was told to defrost

In February 2019, TechCrunch reported that thousands of internet-connected industrial refrigerators from a U.K. firm, Resource Data Management, could be defrosted from a browser using default passwords found in the company's documentation. The 2019 trick needed a documented password. This one reportedly hit hundreds of stores at once.

Antoine Hautin of the consultancy Almond told AFP that refrigeration equipment long isolated from the internet is now reachable through sensors and remote monitoring. Hitting hundreds of units at once, he said, showed "a certain level of sophistication." He did not say how the attackers got in. Nobody has. As of Tuesday morning the reports reviewed for this story name no attacker, no entry method, and no list of firmware versions.

What a patch is worth here

Dutch grocer Ahold Delhaize said separately that it was dealing with a "security issue" in its network. The reports reviewed do not connect that to the French attack. The European Union's food commissioner, Christophe Hansen, said food security needs more attention at all levels.

A fix is an answer only for equipment still on a fix list. For units Danfoss calls legacy, the advice it says it gave was to move off those models, and the timing belongs to each store owner. Until someone publishes the entry point, the question is not whether a patch exists. It is whether the box on the wall can still receive one.