Refrigeration controllers left on the open internet. The French bill for one piece of negligence

What happened

Attackers took over the Danfoss refrigeration controllers that run the cold installations in these stores - the same ones maintenance firms manage remotely. The units were locked into defrost mode for several hours, and temperatures in the cabinets and freezers rose to as much as fifty degrees.

The scale is unusual. Intermarché and Netto report at least 300 stores, Coopérative U 80 out of two thousand, Carrefour 80, Monoprix around thirty, E.Leclerc several. Outside France, sites were hit in Spain, Portugal, Poland, Germany and Belgium. The CEO of Les Mousquetaires puts his group's losses alone in the tens of millions of euros, and the Paris prosecutor's inquiry covers not only the spoiled stock but equipment that began to catch fire.

Neither CERT-FR nor Danfoss has disclosed the route in. That is worth stating plainly before going further: we do not know how the attackers got in. What we do know is the state they found this estate of devices in - and that is the part of the story that should be costing people sleep.

The first failure: a controller visible from the internet

On 12 October, researcher Baptiste Robert found 2,752 Danfoss systems reachable from the public internet, 1,590 of them in France. A day later Reuters put the figure at a minimum of 4,500 interfaces visible through Shodan.

These are not laboratory numbers. They come from a search engine for internet-connected devices that anyone can open in a browser.

No sophisticated good practice is needed here. One rule suffices, as old as remote servicing itself: automation controllers do not go on the public internet. There is no shortage of VPN solutions for industrial devices, and deploying one really is not expensive.

The second failure: hardware that has not had a patch in years

Danfoss acknowledges that most of the affected units were discontinued products or running outdated firmware. The AK-SM 800 reached end of life in May 2021, the AK-SC 355 was phased out in 2016. Neither receives security updates any longer. The current AK-SM 800A units that were hit had not been updated.

The French scanning firm Onyphe assessed that only a small minority of the exposed controllers were running the latest software.

Known vulnerabilities in this device family are nothing new. Synacktiv described a login bypass in 2023, and Claroty Team82 reported three flaws in the AK-SM 800A web interface in 2025, including a hidden authentication path using a password derived from the device's current date. None has been linked to this attack - but none of them was a secret either.

What that does not excuse

Two pieces of negligence came together here. An unsupported device inside a closed, segregated network is technical debt, to be paid off in the next budget. The same device reachable from the internet is not debt -it is an open door with the address posted next to it.

I am not claiming that nothing can happen with a firewall and a VPN in place. I am claiming that it makes the attacker's job two notches harder, and that it stops anyone breaking into thousands of stores at once.

The post-incident guidance is exactly as dull as you would expect. CERT-FR tells operators to disconnect or filter access to every AK-SM and AK-SC instance. CISA advises removing remote access where it is not needed and, where it is, routing it through a centrally managed gateway with strong authentication. None of this requires new technology.

A VPN is the first layer, not the only one

Separating the automation network from the outside world is a precondition, not the end of the subject. Inside the automation segment itself the protocol remains - and building and refrigeration automation still rests on solutions from thirty years ago that know nothing of authentication or encryption. Anyone who has closed the perimeter should turn to that next.

A layer that watches the installation continuously helps too. A freezer in defrost for several hours is an anomaly that a system supervising consumption and operating parameters catches as an event - regardless of whether the cause is an attack, a fault, or a manual override a service engineer left behind.

Spare a thought for the store managers

The manager of one of the stores told reporters that at twenty to six in the morning she saw thirty-five degrees in the chilled cabinets and fifty thousand euros of stock to be thrown away.

She is not the one who connected that controller to the internet.

I do not know who installed these systems, or who maintained them. I do know that the question "are our controllers visible from outside, and what software are they running?" can be asked this afternoon - and that the answer costs less than one night at fifty degrees in a freezer.