Attackers hijack Danfoss refrigeration controllers to spoil stock across hundreds of French supermarket stores

Attackers hijacked refrigeration controllers running older Danfoss control software at several French supermarket chains, including Intermarche, Carrefour Market, Monoprix, and Leclerc, abusing a built-in defrost feature to raise temperatures and spoil stock. French outlets reported 250 to 350 affected stores, significant financial losses, and food waste, and the Paris prosecutor opened an investigation. Researchers linked two flaws in the Danfoss AK-SM 8xxA platform, CVE-2025-41450 for authentication bypass and CVE-2025-41451 for command injection, though how the controllers were reached is unconfirmed. One researcher found 2,752 Danfoss systems exposed online, 1,590 of them in France.

Check

Inventory internet-exposed Danfoss AK-SM 8xxA refrigeration controllers, remove them from direct internet access, update to current firmware, and review for unauthorized configuration changes.

Affected

Internet-exposed Danfoss refrigeration controllers on older software can be hijacked to manipulate defrost and temperature settings, spoiling stored goods, as seen across hundreds of French stores.

Fix

Place refrigeration controllers behind VPN or network segmentation, patch Danfoss AK-SM platforms, enforce strong authentication, and monitor for unexpected setpoint or defrost changes.