Danfoss fridge controllers hijacked at 500 French stores
legacy AK-SM800 and AK-SC355 forced into continuous defrost

Danfoss fridge controllers hijacked at 500 French stores

French investigators are hunting the attackers who seized refrigeration controllers at more than 500 supermarkets on the night of 11 October 2026. No group has claimed the attack. Stores discarded spoiled stock after units were forced into continuous defrost and, in some cases, warmed to 50 C.

What happened

Chains named in reporting include Intermarche and Netto (at least 300 stores), Cooperative U (more than 100), Carrefour (80), and Monoprix (about 5 percent of stores). The controllers are Danish-made Danfoss units. Danfoss told AFP and Reuters that most affected systems were legacy products, specifically AK-SM800 and AK-SC355, running outdated firmware or already past end of life.

ANSSI is investigating. A source close to the prime minister said the agency had identified a vulnerability in Danfoss software. The exact intrusion path has not been published. Experts told Reuters the attack looked simple, enabled by unpatched or unsupported controllers and interfaces reachable from the internet. In August, Claroty had already described authentication-bypass and code-execution issues in the AK-SM 800A that were later patched.

Who is affected

Retailers and cold-chain operators still running internet-reachable Danfoss AK-SM800, AK-SC355, or other end-of-life refrigeration controllers. The lesson is not limited to France. Any site that leaves building or process controllers on a routable network inherits the same failure mode.

What to do now

  • Find every internet-facing OT controller and take it off the public internet.
  • Inventory Danfoss and similar refrigeration or BMS controllers. Replace end-of-life units. Apply current firmware where the vendor still supports the model.
  • Segment OT from corporate and guest networks, and require a jump host for vendor remote access.

Source: Reuters, 13 October 2026.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

GitLab CVE-2026-97229: CVSS 10 unauthenticated RCE
self-managed GitLab CI/CD regex compiler integer overflow