Executive Summary
A large-scale cyberattack targeting refrigeration systems at French supermarkets has highlighted the risks of internet-exposed operational technology (OT), with attackers remotely forcing refrigeration units into defrost mode and causing spoiled food, equipment damage, and significant financial losses. Beginning on 11 October, per a newly released report from Computer Emergency Response Team France (CERT-FR), attackers, who have not been named, reportedly altered settings on Danfoss AK-SM and AK-SC controllers, raising setpoints and extending defrost cycles to delay alarms, impacting at least 350 supermarkets across multiple retail chains. Subsequent investigations found thousands of exposed refrigeration management interfaces; many running outdated firmware or end-of-life products that no longer receive security updates.
Key Takeaways
Overnight on 11 October, attackers took remote control of refrigeration systems and forced fridges and freezers into defrost mode, reportedly raising setpoints to 50°C (122°F) and extending some defrost cycles from one hour to eight hours. By October 12, CERT-FR confirmed numerous compromises of Danfoss AK-SM and AK-SC controllers, while retailers reported widespread spoilage and operational disruption.
Investigations determined that many affected systems were legacy AK-SM 800 and AK-SC 355 controllers or current-generation AK-SM 800A units running outdated firmware. Researchers subsequently identified thousands of internet-exposed Danfoss management interfaces, with only a small minority appearing to run the latest software.
Prior research had identified multiple security weaknesses in refrigeration controller web interfaces, including a “code-of-the-day” authentication mechanism, command injection vulnerabilities, and login bypass issues affecting both current and end-of-life products.
