An overnight attack on French supermarket refrigeration. Unexplained outages on US military bases. A Danfoss backdoor disclosed in August. Here’s what connects them, and what still doesn’t.
Around midnight on Oct. 11, refrigerated cases in hundreds of French supermarkets stopped cooling food and started heating it. Nobody pulled a plug. Someone told the controllers to defrost, kept them there, and pushed the target temperature to 50°C. By morning, staff were opening freezer doors into a wave of heat. Stock was gone. A few stores were dealing with fires.
If you work around industrial control systems, that’s the detail that jumps out. This wasn’t ransomware freezing a point-of-sale system. It was someone reaching the box that runs a store’s refrigeration and using a legitimate command at the worst possible time. That makes it an OT attack, carried out on equipment many retailers still treat as facilities maintenance.
It also wasn’t the first time this year that grocery freezers slipped into defrost overnight. In late August, commissaries on US military bases in at least six states lost refrigeration within about 48 hours of each other. At one site, every freezer entered defrost mode while power stayed on. That incident is still officially unexplained.
The Store Is Only The Last Link
The cold chain is the unbroken run of temperature control that a product needs from the moment it’s made to the moment someone uses it. For food, that usually means a processing plant with blast freezers, then a cold-storage warehouse or distribution center, then refrigerated trucks, and finally the store’s display cases. Every one of those links runs on refrigeration controls, and more and more of them are managed remotely for the same reasons supermarkets are: fewer truck rolls, centralized alarms, and one console for many sites.
The attacks in France and on US bases hit the very end of that chain, the grocery store. Nothing about the technique is specific to retail. The Danfoss system manager at the center of this story is also sold into cold-storage facilities and warehouses (Claroty Team82). A forced defrost at a distribution center doesn’t spoil one store’s freezer aisle. It spoils the inventory for every store that warehouse feeds, and it does it before anything reaches a shelf.
Food isn’t the only thing moving through that chain. Pharmaceuticals depend on it too. Many vaccines, biologics, and insulin products must stay within narrow temperature ranges, often 2 to 8°C, and some products require ultra-cold storage far below a normal freezer. In regulated pharmaceutical distribution, a temperature excursion usually means the product gets quarantined and frequently destroyed, even if it might have been fine, because nobody can prove it was. An attacker who can move a setpoint in a pharma warehouse, a hospital pharmacy or a vaccine depot causes the same kind of loss as a spoiled freezer case, with real consequences for patients who are waiting on that supply.
Hundreds Of Stores, One Setting
The reported scale keeps growing. BFMTV put the count near 400 stores across Intermarché, Netto and Coopérative U, and E.Leclerc, and about 30 Monoprix locations have since confirmed they were hit (Cybernews, The Hacker News). Two stores in Alsace reportedly lost about €270,000 in stock between them. The head of Les Mousquetaires expects losses in the tens of millions of euros.
CERT-FR, the incident response arm of France’s national cybersecurity agency ANSSI, issued an alert on Oct 12 citing numerous compromises of Danfoss AK-SM and AK-SC series devices (Pillitteri). Two days later, ANSSI widened the picture, saying refrigeration systems from Copeland and Dixell were hit in the same campaign (Technology.org). That matters. This isn’t a single vendor’s bad week. It’s a whole category of equipment that was put on the internet for convenience and left there.
Danfoss says most of its affected units were legacy products that no longer receive security updates, and the rest were running old firmware (BetaNews). ANSSI’s director has urged operators to take these controllers off the internet or filter access very tightly. Even so, a Shodan scan on Oct 13 still turned up at least 4,500 Danfoss interfaces exposed online.
What we don’t know yet is who did it or how they got in. No group has claimed it, and officials haven’t said whether the attackers used a known vulnerability, stolen credentials, or a compromised service contractor. In the Netherlands, Ahold Delhaize also took systems offline over a “security issue,” though nobody has tied that to France.
A Backdoor With A Daily Password
Two months before the French attack, researchers published a teardown of the Danfoss AK-SM 800A, the system manager that coordinates every refrigeration controller in a store (Claroty Team82). From its browser console, an operator can change temperature thresholds, adjust schedules, manage alarms, and add users. Service contractors rely on that web interface because it saves a truck roll every time something needs adjusting. An attacker values it for exactly the same reason.
The headline finding, CVE-2025-41450, is a hidden “code of the day” login, most likely a vendor maintenance feature. The daily password is generated from nothing but the device’s current date. Rebuild the algorithm once, and you can log in as an administrator on any unpatched unit, on any day, without knowing a single real credential.
From there, CVE-2025-41451 turns admin access into remote code execution through an unsanitized SMTP password field in the alarm email settings. A third bug, CVE-2025-41452, lets an authenticated user upload a modified Nginx configuration to reroute traffic or crash the web service. Danfoss fixed all three in firmware R4.3.1. Before Team82 ever opened the firmware, they counted 2,765 of these management interfaces sitting on the public internet.
Two cautions before anyone draws a straight line from August to October. No one has publicly confirmed these CVEs were used in France. And if Danfoss is right that most victims were legacy units, a patch wouldn’t have reached them anyway. The uncomfortable truth is that an attacker doesn’t need code execution to do this kind of damage. Admin access to the defrost schedule and the setpoints is enough, and on an exposed, unpatched controller, that backdoor login hands it over.
Meanwhile, On US Bases
Between Aug 26 and 28, commissaries run by the Defense Commissary Agency started posting the same kind of notice: dry goods only until further notice. Fort Irwin and Travis AFB in California, F.E. Warren AFB in Wyoming, Fort Huachuca in Arizona, Naval Station Newport in Rhode Island, and Columbus AFB in Mississippi all confirmed outages publicly (Schneier on Security). DysruptionHub, which tracks these incidents, found public reports at 14 or more commissaries across 10 states (DysruptionHub).
Fort Huachuca’s account is the one worth rereading. The base described an overnight equipment failure that put every freezer into defrost mode, with power never lost, and all frozen food spoiled. A dead compressor makes a case warm. A defrost cycle across every freezer in a building is a controller doing what it was told.
The Pentagon has acknowledged only a “possible refrigeration disruption” (Military Times). Army CID’s Cyber Field Office, the Air Force Office of Special Investigations and the Defense Criminal Investigative Service all confirmed investigations, with DCIS reportedly leading (Stars and Stripes). As of publication, no cause has been announced.
DeCA runs centralized refrigeration monitoring and control that manages defrost cycles, compressor staging, and condenser fans across its stores. A central management layer like that is efficient, and it’s also a single place where one command can reach many sites at once. That could be an intruder. It could just as easily be a bad update or a scheduling mistake, a point RedSeal made fairly in its own analysis (RedSeal). Later outages at four European commissaries in September were attributed to equipment failures and ongoing repairs, and DeCA has said they’re unrelated (Stars and Stripes).
Coincidence, Or A Pattern?
It’s fair to be skeptical. Once you’ve read about one refrigeration attack, every empty freezer case starts to look suspicious, and grocery refrigeration breaks all the time. In May, a heatwave in southern England took out chilled cases at Tesco, Sainsbury’s, Waitrose and others in the same week, and nobody hacked anything (Asian Trader).
The useful question isn’t whether refrigeration failed. It’s how it failed. Mechanical problems tend to look like a loss of cooling: a tripped compressor, a refrigerant leak, a condenser that can’t keep up on a hot afternoon. They hit one site, or a cluster of sites under the same weather. A remote, deliberate event tends to leave a different fingerprint:
- Many sites failing within hours of each other, across geography that shares no weather or utility
- A controlled state change, like defrost forced on or setpoints moved far out of range, while power and compressors are fine
- Timing that lands overnight, when nobody is standing in the store
- A shared management layer that could reach all of the affected sites
France checks every box, and it’s confirmed. The commissaries check most of them: multiple states in about 48 hours, overnight timing, central management, and at least one site where every freezer went into defrost with the power on. On that basis, we think a deliberate or remotely triggered cause is more likely than coincidence. That’s a judgment, not a finding. Nothing official links the two events, and they may involve different equipment and different actors.
What To Do This Week
Refrigeration controllers are industrial control systems. Most grocers, cold-storage operators, and food distributors don’t manage them that way, and the fixes aren’t exotic.
- Take the management interface off the internet. Search Shodan or Censys for your own public IP space. If a contractor needs remote access, give them a VPN or brokered remote access with MFA, not a port forward.
- Inventory every system manager. Danfoss AK-SM and AK-SC, Copeland, Dixell XWEB, and whatever else is in the back room, with firmware versions and vendor support status. Units that will never get another patch need compensating controls and a replacement date.
- Patch what can be patched. Danfoss AK-SM 8xxA to R4.3.1 or later, and Dixell XWEB Pro to firmware 1.13.
- Rotate every credential, especially shared contractor logins. A former refrigeration contractor in the Netherlands went to prison for using old passwords to change a supermarket’s temperature settings (Cooling Post).
- Alarm on the commands an attacker would use. Defrost forced on, setpoints far outside normal, schedule changes at 2 a.m., new remote sessions from unfamiliar sources. Then make sure someone actually gets that alarm overnight.
- Practice the manual fallback. Know how to put cases into local control, and who on site can do it at midnight.
Visibility is the thread running through most of that list. Valkyrie monitors the OT network passively, so teams can see which controllers are talking to the internet, when a new remote session appears, and when something on the network changes that shouldn’t. A lot of individual stores and government facilities can’t send data to a cloud service, or don’t have dependable connectivity to begin with. Cygnet brings Valkyrie on site as a flyaway kit for exactly those places. Our services team can also run an exposure review across a store fleet, or a tabletop built around a simple scenario: every freezer in the region goes into defrost at midnight.
What We’re Still Watching
As of Oct 14, these questions are open, and the answers will shape how seriously the rest of the industry takes this.
- How did the attackers get in? A known CVE, a different flaw, default or reused credentials, or a compromised service contractor?
- Which vulnerability did ANSSI flag to Danfoss, and does it affect currently supported firmware?
- Who is behind it? There’s no claim or attribution yet.
- Is Ahold Delhaize’s “security issue” connected, and does it reach its US grocery banners?
- Which refrigeration controllers does DeCA run, and will DCIS release findings on the August outages?
- Will CISA or other national CERTs issue guidance for US retailers and cold-chain operators?