Danfoss Flaw Exploited in Cyberattack on 150 French Stores
Attackers forced defrost mode and raised freezer temperatures to 50°C in more than 150 French supermarket stores, causing millions of euros in damage.
Between the night of October 11 and the early hours of October 12, 2026, refrigeration and freezer systems at more than 150 stores of French supermarket chains were hit by a cyberattack, according to datanet.co.kr. Temperatures in the affected equipment rose as high as 50°C, and fires broke out in some stores. Damages from the incident amounted to millions of euros.
Attackers exploited a vulnerability in a Danfoss platform to force the defrost heater mode on and override the temperature upper limit, heating equipment to between 50°C and 80°C overnight, according to the report.
Security company Claroty found authentication bypass and command injection vulnerabilities in the built-in web management interface of the AK-SM 800A platform. The vulnerabilities were assigned CVE-2025-41221 and CVE-2025-41222.
Claroty published a research report on the vulnerabilities in August and presented it at DEF CON in Las Vegas. Danfoss distributed a new firmware version fixing the vulnerabilities in August of last year.
Nozomi Networks, which analyzed the incident, stated that its analysis could not confirm a link between the attack and Claroty's published research. The firm also said most of the affected equipment appeared to be old and unpatched.
In August, Claroty published separate research on Copeland's XWEB platform disclosing 23 vulnerabilities, 21 of them high severity. Those vulnerabilities were shared with Copeland last year, and Copeland fixed the issue via a firmware update in February.
Quick answers
When did the cyberattack on French supermarket refrigeration systems occur?
The attack took place between the night of October 11 and the early hours of October 12, 2026, affecting more than 150 stores.
What vulnerabilities were involved in the attack?
The attack exploited authentication bypass and command injection vulnerabilities in the AK-SM 800A platform, tracked as CVE-2025-41221 and CVE-2025-41222.
Did Nozomi Networks confirm a link between the attack and Claroty's research?
Nozomi Networks stated that its analysis could not confirm a link between the attack and Claroty's published research.