On the night of 11–12 October 2026, attackers remotely took control of Danfoss refrigeration management systems at an estimated 250 to 350 French supermarket stores. They triggered continuous defrost cycles that drove case temperatures as high as 50 °C for several hours and spoiled fresh and frozen stock on a large scale. The same weekend, Dutch retailer Albert Heijn, part of Ahold Delhaize, experienced a separate cybersecurity incident that forced systems offline and disrupted online services, distribution, and in-store operations. Dutch authorities see no connection between the two events.
Incident at a Glance
| Dates | 11–12 October 2026 (refrigeration); from 12 October (Albert Heijn) |
| Refrigeration targets | Danfoss AK-SM and AK-SC series, Copeland and Dixell xweb controllers |
| Stores affected | ~250–350 French stores across several chains |
| Physical impact | Case temperatures near 50 °C for ~6 hours; spoilage and some equipment damage |
| Advisory | CERT-FR CERTFR-2026-ALE-012 (12 October 2026) |
| Related CVEs | CVE-2025-41450, CVE-2025-41451, CVE-2025-41452 |
| Separate event | Albert Heijn / Ahold Delhaize systems taken offline as a precaution |
| Attribution | None confirmed publicly |
What Happened in France
Attackers gained access to Danfoss controllers, primarily the AK-SM series including AK-SM 800A units and older models such as the AK-SM 800 (end of life in 2021) and the AK-SC 355. They invoked the built-in defrost function without normal limits. Reports describe temperatures held near 50 °C for roughly six hours in affected cases.
Stores belonging to Intermarché and Netto (Les Mousquetaires confirmed about 150 stores), Coopérative U (roughly 80 to 100 or more), Carrefour (about 80), Monoprix (around 5 percent of its roughly 490 stores), E.Leclerc, and others discarded product rather than sell it. Losses for individual stores reached hundreds of thousands of euros, and broader estimates run into the tens of millions across France. Some reports mentioned equipment damage or fires. Spillover appeared at retailers in other European countries.
CERT-FR issued alert CERTFR-2026-ALE-012 on 12 October and updated it the next day. The alert confirmed numerous compromises of Danfoss AK-SM and AK-SC series devices as well as Copeland and Dixell xweb controllers. CERT-FR noted that exposing management interfaces to the internet is poor practice and directed operators to:
- Remove public exposure and restrict access through VPN or source-IP filtering as a temporary measure.
- Verify configurations including defrost schedules.
- Apply available firmware updates.
- If compromise is suspected, follow recovery steps that go beyond a simple factory reset.
French prosecutors opened an investigation, and ANSSI is coordinating the response.
Danfoss stated that most affected equipment consisted of legacy products that no longer receive security updates and that the units were running outdated firmware. The company has long recommended updates or replacement. The precise entry point and exploit have not been publicly confirmed.
Known Vulnerabilities and Exposure
Claroty's Team82 previously examined the AK-SM 800A web management interface and disclosed multiple issues later addressed in firmware R4.2 and R4.3.1:
- CVE-2025-41450 (Improper Authentication, CVSS 8.2) involves a hidden "code-of-the-day" mechanism that generates and accepts an administrative password derived from the device's current date, bypassing the configured credentials.
- CVE-2025-41451 (Command Injection, CVSS 7.6) allows unsanitized input in SMTP or alarm email configuration to achieve post-authentication remote code execution.
- CVE-2025-41452 (External Control of Configuration, CVSS 5.4) lets authenticated users inject Nginx directives, enabling traffic manipulation or denial of service.
CISA issued advisories covering the first two issues in 2025. Claroty scanning identified roughly 2,765 exposed AK-SM 800A management interfaces. On 12 October, researcher Baptiste Robert of Predicta Lab reported approximately 2,752 Danfoss systems online, of which 1,590 were in France. Later Shodan observations put total matching hosts higher still, in the range of several thousand, with France accounting for more than half in some counts.
Researchers have described the French activity as opportunistic: scanning for exposed devices and then leveraging known weaknesses or weak authentication rather than conducting a sophisticated multi-retailer intrusion.
Older models such as the AK-SM 800 and AK-SC 355 no longer receive patches, so replacement or strict isolation is the practical option. For current AK-SM 800A units, operators should verify firmware and move to the latest available release where compatible.
Concurrent Albert Heijn / Ahold Delhaize Incident
Starting Sunday afternoon, Ahold Delhaize identified a security issue on its network and took multiple systems offline as a precaution. Albert Heijn's website, app, online ordering and delivery, customer service, electronic shelf labels, and loyalty (Bonus) cards were affected. Some distribution centers were disrupted, which produced empty shelves, particularly for fresh produce, across stores. Sister brands Etos and Gall & Gall, along with operations in other markets including Belgium and the United States, also saw impacts. Stores remained open and checkout systems generally continued to function.
As of 13 October, Ahold Delhaize reported no evidence that customer, associate, or third-party data had been stolen. Controlled restarts of certain systems had begun. The company stated it was working with internal teams, external experts, and authorities. The Dutch National Cyber Security Centre has indicated there is no reason to link this incident to the refrigeration-controller compromises or other concurrent European food-sector events. The response pattern of broad system isolation is consistent with containment of a potential intrusion, though the root cause and any threat-actor involvement remain unconfirmed publicly.
Implications for Retail and Cold-Chain Operators
These incidents point to two distinct but related risks in food retail.
Internet-exposed OT and ICS devices create a straightforward path to physical effects. Supervisory controllers for refrigeration are attractive targets because a single management interface can affect many cabinets. Public exposure combined with known authentication bypasses or unpatched command-injection issues makes temperature manipulation, food spoilage, and potential equipment damage relatively easy to achieve. Asset inventories that miss third-party or contractor-managed devices, cellular backhaul, or legacy units are incomplete.
Enterprise IT disruption can cascade quickly. Isolation of core systems affects logistics, online channels, pricing, and inventory visibility even when stores stay open.
What Cold-Chain Operators Should Do
Organizations running Danfoss or similar Copeland and Dixell refrigeration controllers should act on several fronts:
- Inventory all management interfaces and treat any publicly reachable instance as potentially compromised.
- Remove internet exposure and prefer VPN or tightly filtered access from known contractor networks. Source-IP filtering works only as a short-term measure.
- Verify firmware versions and apply R4.3.1 or later where supported, while planning replacement for end-of-life models.
- Review defrost schedules, alarm configurations, and credentials. Change defaults and rotate any secrets that may have been exposed.
- If compromise is suspected, follow CERT-FR recovery guidance that includes configuration validation, credential rotation, and deeper remediation beyond a factory reset.
- Segment OT networks, monitor for unexpected configuration changes or authentication anomalies, and ensure cold-chain monitoring has independent verification that does not rely solely on the supervisory controller.
For broader retail environments, maintain clear separation between store OT, corporate IT, and third-party maintenance paths, and rehearse containment procedures that balance operational continuity against further exposure.
The Takeaway
The French refrigeration attack shows that exposed industrial controllers can produce immediate, tangible harm to food safety and business continuity. The Ahold Delhaize incident shows that enterprise systems remain high-value targets. Neither event required novel techniques. Both exploited familiar weaknesses in exposure, patching, and isolation. Organizations that operate cold-chain or multi-site retail infrastructure should treat public-facing management interfaces and unpatched OT as immediate priorities for discovery and remediation.
Sources
- Red Eye Security: French supermarkets Danfoss refrigeration attack
- SecurityWeek: Refrigeration controller hack spoils food across European supermarkets
- The Register: Cyberattacks crank French supermarket refrigeration systems up to 50C
- CERT-FR: CERTFR-2026-ALE-012
- Claroty Team82: Freeze the controller, defrost the food
- CISA ICS advisory ICSA-25-140-03
- Cyber-Defence: Cyberattack defrosts fridges in French supermarkets
- 01net: Opportunistic cyberattack against French supermarkets
- Cybernews: Dutch retailer Albert Heijn offline in cybersecurity incident
- NL Times: Albert Heijn outage likely cyberattack, experts say
- Ahold Delhaize: Update on cybersecurity incident
- NL Times: Ahold Delhaize finds no evidence of data theft
- Reuters: Ahold has no indication client data was stolen
Track OT, retail, and food-sector incidents as they develop with the Threat Landscape Platform — structured STIX intelligence, IoC feeds, and darknet monitoring. Start with a free account, no credit card required, or go Professional from $49/month.