Full Report
Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. [...]
Analysis Summary
# Incident Report: Remote Defrosting Attack on French Supermarket Chains
## Executive Summary
In October 2026, a large-scale cyberattack targeted the refrigeration control systems of several major French supermarket chains, including Intermarché and Carrefour. Threat actors manipulated Danfoss refrigeration controllers to trigger automatic defrosting cycles overnight, leading to temperatures rising as high as 50°C. The incident resulted in massive food waste across 250 to 350 stores and forced several retailers to take systems offline.
## Incident Details
- **Discovery Date:** October 12, 2026
- **Incident Date:** October 11, 2026 (Overnight)
- **Affected Organizations:** Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U
- **Sector:** Food Retail / Critical Infrastructure
- **Geography:** France (National scale)
## Timeline of Events
### Initial Access
- **Date/Time:** Sunday night, October 11, 2026.
- **Vector:** Exploitation of refrigeration controllers running legacy software.
- **Details:** Attackers targeted Danfoss refrigeration controllers, potentially leveraging a known authentication bypass vulnerability.
### Lateral Movement
- **Details:** Not explicitly detailed in the report, though the scale suggests automated scanning or a centralized management compromise to affect 250-350 stores simultaneously.
### Data Exfiltration/Impact
- **Details:** No data theft reported. The primary impact was the remote manipulation of Industrial Control System (ICS) settings to trigger "automatic defrosting," raising temperatures and destroying fresh produce.
### Detection & Response
- **How it was discovered:** Store staff discovered cooling failures and "cold chain breakage" alerts on Monday morning; some reports indicated the outbreak of fires.
- **Response actions taken:** Retailers took affected systems offline; refrigeration specialists were deployed to stores to manually reset and repair units.
## Attack Methodology
- **Initial Access:** Likely exploitation of CVE-2025-41450 (Authentication Bypass) in Danfoss AK-SM 8xxA Series hardware.
- **Persistence:** Not specified; likely achieved via persistent access to the controller management interface.
- **Privilege Escalation:** Likely bypassed authentication to gain administrative control over cooling parameters.
- **Defense Evasion:** Use of built-in "automatic defrosting" functions to mask malicious activity as legitimate system operations.
- **Credential Access:** Not required if authentication bypass was utilized.
- **Discovery:** Scanning for internet-facing refrigeration management interfaces.
- **Lateral Movement:** Propagation across networked controllers within supermarket infrastructure.
- **Collection:** N/A.
- **Exfiltration:** N/A.
- **Impact:** Intentional destruction of physical inventory and potential fire hazards via thermal manipulation.
## Impact Assessment
- **Financial:** Significant losses due to the destruction of fresh and frozen inventory across hundreds of locations.
- **Data Breach:** None reported.
- **Operational:** Severe disruption; hundreds of stores unable to sell fresh goods; systems taken offline for remediation.
- **Reputational:** High public visibility; concerns regarding food security and infrastructure stability in France.
## Indicators of Compromise
- **Network indicators:** Unrecognized traffic to/from Danfoss controller management ports (e.g., HTTP/HTTPS interfaces).
- **File indicators:** N/A (Firmware/software level attack).
- **Behavioral indicators:** Unscheduled "Defrost" cycles triggered simultaneously across multiple geographic locations; temperatures rising to 50°C.
## Response Actions
- **Containment:** Disconnection of refrigeration controllers from the public internet.
- **Eradication:** Implementation of patches for Danfoss AK-SM 8xxA Series hardware.
- **Recovery:** Manual inspection of cooling units by specialists; disposal of contaminated food; restoration of normal cooling parameters.
## Lessons Learned
- **IoT/ICS Vulnerability:** Critical infrastructure (food supply) is highly vulnerable to legacy ICS software flaws.
- **Exposure:** Controllers managing physical environments should never be directly accessible from the public internet without robust VPN/MFA.
- **Alerting:** While "defrost" is a normal function, a "simultaneous defrost" across an entire chain should trigger an automated security alert.
## Recommendations
- **Patch Management:** Immediately update Danfoss refrigeration controllers to versions that mitigate CVE-2025-41450.
- **Network Segmentation:** Place all Building Management Systems (BMS) and refrigeration controllers on isolated VLANs.
- **Access Control:** Disable public-facing management interfaces and require multi-factor authentication (MFA) via a secure gateway to access cooling controls.