Attackers Heated French Supermarket Fridges to 50 C Using a Login Bypass Based on the Date

Overnight between October 11 and 12, attackers remotely took over refrigeration controllers at several hundred French supermarkets and pushed temperatures as high as 50°C, forcing stores to throw away fresh and frozen stock and, in at least one location, triggering a fire. Les Mousquetaires (Intermarché, Netto) reported roughly 300 stores affected; Coopérative U, Carrefour, Monoprix, and E.Leclerc each reported dozens more. France's national cybersecurity agency, ANSSI, confirmed hackers exploited controllers made by Danish manufacturer Danfoss, and a later report from CNN named two additional affected vendors, US-based Copeland and its Dixell brand. Estimated losses across the affected chains run into the tens of millions of euros. The specific technical detail worth sitting with isn't the damage. It's how little the attackers actually needed to get in.

The "password" wasn't a password

Danfoss's affected controllers (the AK-SM800 and AK-SC355, both officially end-of-life with no further security updates, plus some current-generation AK-SM800A units running outdated firmware) had a login bypass that Claroty's Team82 lab had already documented earlier in 2025. Rather than needing an attacker to steal or guess a real administrator credential, the flaw let someone generate a valid daily access code purely from the device's own date and time. No phishing, no credential stuffing, no brute force. Just a login mechanism whose "secret" was a predictable function of the clock, reachable by anyone who could reach the controller's web interface at all.

And a lot of people could reach it. A scan run during the response found roughly 2,900 Danfoss systems exposed directly to the internet in France alone, about 65% of the roughly 4,500 found exposed worldwide. These are devices meant to let a maintenance contractor adjust a store's refrigeration remotely without driving there, and somewhere between the vendor's defaults and each store's own network setup, "reachable by our contractor" became "reachable by anyone who finds it on Shodan."

What the attack actually did once inside

The attackers didn't need to write custom destructive code. Danfoss controllers have a built-in automatic defrost cycle, a normal maintenance function that periodically warms the unit to clear ice buildup, then returns it to its set temperature. The attack simply triggered that legitimate function and never let it reset: some stores held at 50°C for roughly six hours overnight before anyone noticed. One detail from on-the-ground reporting is worth calling out specifically: at least one store's staff only found out at 4am, when the heat had already triggered the room's sprinkler system, not because a refrigeration alarm had fired. The alarm that was supposed to catch this ran through the same controller the attackers had already taken over.

Why this spread past one vendor

A separate incident at an E.Leclerc store near Albi, using Dixell (Copeland) rather than Danfoss equipment, suffered a refrigeration failure the same week, and Copeland has since confirmed a vulnerability in a "discontinued, end-of-life generation of controllers." Whether that's the same attackers or copycats probing a newly spotlighted device category isn't established. Either way, the underlying pattern isn't Danfoss-specific: these are internet-connected OT controllers, running legacy firmware, chosen for operational convenience, that nobody treated as an attack surface worth the same scrutiny as a public-facing web server, until a few hundred supermarkets found out what that costs in spoiled inventory.

What I'd actually check

Assume an internet-reachable management interface on an OT device will eventually be found, regardless of how obscure the hostname or how unlikely you think it is to turn up in a scan. Shodan found thousands of these without anyone leaking credentials; obscurity isn't a control.

Put a hard boundary between "vendor says end-of-life" and "still running in production." Danfoss had already told customers the AK-SM800 and AK-SC355 don't receive security updates. An EOL notice on a device that still controls physical infrastructure isn't a documentation footnote. It's a device with a permanently open door that can only be closed by replacing it, not patching it.

Never let the system being monitored also own the alarm that's supposed to catch it failing. A refrigeration controller that an attacker has already compromised will not reliably alert you that it's been compromised. An independent temperature sensor, on its own network path, reporting to a system the attacker doesn't control, is the only version of this alarm that still works on the night it matters.

This is the same shape of gap as an internet-exposed service nobody had actually mapped until a severity-9.3 bug forced the inventory: the device wasn't attacked because it was important, it was attacked because it was reachable, and reachability turns out to be a much larger set than anyone's asset list usually accounts for.

The rule

Connecting a physical control system to the internet for maintenance convenience puts it in the same threat model as a public web server, with none of the same scrutiny and a worse failure mode: a compromised API returns bad data, a compromised refrigeration controller burns down a cold room. A device whose "password" can be computed from its own clock instead of stolen from its owner was never protected by a password in the first place, just by the assumption that nobody would bother to look.

I'm Rohit, founder of Krova Cloud. Our VMs are disposable on purpose: compute should be easy to throw away and rebuild. A refrigeration controller running a supermarket's cold chain is the opposite kind of system, one you can't treat that casually, and it shouldn't be reachable from the open internet in the first place. More debugging stories at debugly.dev.