Key points
- Hackers raised temperatures in refrigeration units to 50 degrees Celsius overnight.
- Over 300 locations in France were hit, with damage spreading to six other countries.
- The incident follows Claroty’s disclosure of authentication bypass flaws in Danfoss systems.
Cybercriminals exploited vulnerabilities in Danfoss refrigeration controllers to disable cooling systems across hundreds of European supermarkets. The attack caused freezers and refrigerators to defrost overnight, resulting in significant food spoilage and monetary losses for affected retail chains.
According to Reuters, major European chains including Auchan, Carrefour, E.Leclerc, Intermarché and Monoprix were targeted. Most damage occurred in France, but retailers in Belgium, Germany, the Netherlands, Poland, Portugal and Spain also reported issues. Cooperative U confirmed its Hyper U, Super U and U Express stores were affected.
Technical Context and Timeline
Security researcher Lukasz Olejnik noted that attackers remotely controlled the devices, setting target temperatures to 50 degrees Celsius. Staff discovered the issue after six hours, opening freezers to hot air. This breach occurred roughly two months after Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A platform.
Claroty had warned that the flaws allowed attackers to bypass authentication and execute arbitrary code. The firm identified thousands of publicly accessible management interfaces for this hardware. They urged customers to upgrade to firmware version R4.3.1, which contains patches for these specific authentication and configuration injection flaws.
Operational Impact on Retailers
French news outlet BFM TV estimated that more than 300 supermarket locations in France suffered impacts. Losses are projected to reach millions of euros due to spoiled perishable goods. Dominique Schelcher, CEO of Cooperative U, described the attack on essential food preservation equipment as unprecedented and of extreme gravity.
Schelcher stated on X that teams are coordinating with refrigeration specialists to restore operations. He emphasised that an investigation is necessary to fully understand the scope of the incident. The disruption highlights the physical risks posed by compromised industrial control systems in retail supply chains.
What happens next
Organisations should verify if their Danfoss AK-SM 800A systems are patched to firmware version R4.3.1. Security teams must audit publicly accessible management interfaces for similar industrial hardware. Monitoring for unusual temperature fluctuations or remote configuration changes can provide early warning of similar intrusions.
What to do and how to stay safe: Danfoss
- Audit all Danfoss AK-SM 800A devices to ensure firmware version R4.3.1 is installed, as advised by Claroty.
- Block external access to refrigeration controller management interfaces unless strictly required for remote maintenance.
- Implement network segmentation to isolate industrial control systems from corporate IT networks and the internet.
- Monitor system logs for unauthorised configuration changes or unexpected temperature setting adjustments.
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Danfoss product was vulnerable in this attack?
The vulnerability affected the Danfoss AK-SM 800A management platform, which controls refrigeration settings.
Did the attackers use a known CVE in this breach?
The source material does not list specific CVE IDs, but references flaws disclosed by Claroty allowing authentication bypass.
How much did this attack cost the affected retailers?
Losses are estimated to reach millions of euros, primarily due to spoiled food products across hundreds of stores.
