The Wave of Heat: Hackers Turned 400 Supermarket Fridges Into Ovens — Using a Playbook Published Two Months Ago

Published: October 13, 2026 | Reading Time: ~10 minutes | Channel: techminute

Managers arriving at French supermarkets on Monday morning didn't find a break-in. They found a wave of hot air rolling out of the freezer aisles.

Overnight, hackers had reached into the refrigeration systems of hundreds of grocery stores across France — Intermarché, Coopérative U, Carrefour, Monoprix, E.Leclerc — and reconfigured them to run a continuous, forced defrost cycle at 50°C (122°F). Not a glitch. Not a firmware crash. A deliberate setting: normal defrost runs roughly two hours a day; the attackers commanded it to run around the clock, with the target temperature cranked to something closer to a sauna than a supermarket. At an Intermarché in the west of France, the fridges sat at 50°C for six hours straight before staff caught it, per reporting by Reuters carried by the BBC. All of that food went into the dumpster. BFMTV published a photo of an ice-cream aisle freezer displaying 26.5°C — a temperature at which ice cream is, technically, soup.

By Tuesday the count stood at roughly 400 stores across the affected chains — about 2.7% of France's roughly 15,000 supermarkets — with reported damage ranging from two Alsatian stores losing a combined €270,000 to Les Mousquetaires, which owns Intermarché and Netto, projecting "several million euros" across its roughly 180 affected locations. And the story has a second act that makes it more than a very strange crime blotter entry: the platform that was apparently abused, the Danfoss AK-SM 800A refrigeration controller, had its security weaknesses documented, named, and published by researchers at Claroty's Team82 on August 9 — two months to the week before the attack. The burglars may not have used the security researcher's blueprint. But the blueprint was sitting on the doorstep, in public, describing exactly how to walk into buildings just like these.

The Context: What Led to This

The AK-SM 800A is not a smart fridge. It's the thing behind the smart fridges: a centralized system manager that coordinates every refrigeration circuit in a store — display cases, cold rooms, freezers — from one console. From that single web interface, an operator can monitor refrigeration circuits, set temperature thresholds, adjust operating schedules, review alarm history, and perform maintenance remotely. For grocery chains running thousands of stores, it's an obvious economics play: why send a refrigeration technician to every site when a specialist in a central office can troubleshoot an entire region from a browser?

That convenience is precisely what turned a national grocery network into an attack surface. When Team82 went looking — before any of this happened — they didn't have to work hard to find these consoles. A search of internet-wide scanning platforms like Shodan and Censys surfaced thousands of publicly accessible AK-SM 800A management interfaces; their Censys scan counted 2,765 exposed devices. Many announced themselves with the distinctive HTTP title of Danfoss's "StoreView" management UI. The industrial-control-system assumption — that this stuff lives safely on an isolated network — was, for thousands of stores, simply false. And when Team82's findings surfaced in August, the r/cybersecurity thread and the exposed-device counts were sitting in plain sight, a public inventory of targets.

What happened overnight on October 11–12 was the sound that inventory being cashed. French supermarket chains confirmed refrigeration production systems across their networks had been manipulated; Coopérative U chief executive Dominique Schelcher confirmed the attack on his chain's stores in a Monday-morning post, calling it "extremely serious" and "unprecedented." Intermarché's parent said another ~100 stores were urgently disconnected from the internet as a precaution while 180 were already affected. The Paris prosecutor's office has opened a cyber-crime investigation into what it calls a "large-scale cyber-attack affecting the refrigerators of several major food retail chains across France." Nobody has claimed responsibility, and as of publication, no attribution exists in any of the primary reporting.

The blast radius didn't respect the French border, either. Reporting aggregated by CNBC, citing Reuters and analyst Felix Aime of Sekoia Threat Detection and Research, indicates affected systems in Spain, Portugal, Poland, Germany, and Belgium. In the Netherlands, chains including Albert Heijn, Etos, and Gall & Gall (all under Ahold Delhaize) took websites and systems offline after a security incident that also knocked out electronic shelf labels — meaning in-store price displays and even loyalty programs went haywire. Tom's Hardware, citing Dutch broadcaster NOS, reports shelf-label compromise disrupted in-store pricing; Ahold Delhaize says its stores stayed open. Whether the Dutch incident is the same campaign or a separate one remains unclear — Tom's Hardware explicitly flags that the two attacks may not be related.

Under the Hood: How You Cook a Supermarket From a Browser

Here's where this stops being a weird news story and becomes a masterclass in why operational technology (OT) security is hard. Team82's August research, "Freeze the Controller, Defrost the Food," reverse-engineered the AK-SM 800A's firmware and mapped its embedded web architecture: an externally exposed Nginx reverse proxy routing .cgi requests into a FastCGI handler (sm_fcgi_app), which forwards to an internal Nginx and finally to the core web application (Task_Web inside sm_app). Layers of proxies, CGI handlers, and processes — a small web stack inside a refrigerator controller.

On top of that architecture they found three problems:

A hidden "code of the day" backdoor (CVE-2025-41450). Buried in the authentication flow was an alternate login path — apparently for vendor support or maintenance — that doesn't check the administrator's password at all. Instead, it validates against a password generated internally from the device's current date. Team82 reconstructed the entire generation algorithm. Anyone who can reproduce it can mint valid administrative credentials for any device, any day, without ever knowing a password. That's not a misconfiguration; that's a feature — and it's an administrative session at the end of it.
Shell command injection → remote code execution (CVE-2025-41451). With admin access, the path to running arbitrary code ran straight through the SMTP email configuration page. The email password field gets formatted directly into an operating-system shell command, unsanitized. Anyone who's ever written "$(rm -rf)" into a form field as a joke knows exactly where that goes: the controller executes attacker-supplied commands as code.
Nginx configuration injection. An authenticated user could also inject arbitrary directives into the device's web server configuration — enough to manipulate web traffic or trigger a denial-of-service condition.

Each weakness chains neatly into the next: bypass the login, run your code, own the console — and the console, remember, is the thing that sets defrost schedules and target temperatures for every case in the store. A defrost cycle that normally runs two hours a day, aimed at 50°C and set to never stop, is exactly the kind of "configuration change" this platform is designed to accept from an authenticated administrator. The horrifying part of the French attack isn't that someone broke the fridges. It's that they may not have needed to break anything. They may have just used the feature.

Industrial refrigeration controller — the unassuming box that runs an entire supermarket's cold chain

Now, the honest caveat, stated plainly because this piece refuses to overclaim: no source has established that the attackers used CVE-2025-41450 or CVE-2025-41451, or any specific technique. There is no public forensic attribution, no malware sample, no claim of responsibility. What we know is that the attack targeted Danfoss remote-management software (per the BBC), that the affected controllers were older models (per Danfoss), and that a complete public playbook for compromising exactly this class of console was published two months earlier. "The blueprint existed, was public, and described the locks" is a fact. "The burglars used the blueprint" is, so far, an open question. The distinction matters, and the investigation will presumably settle it.

By the Numbers: The Attack in Data

Metric	Figure	Source
French stores affected	~400 of ~15,000 (≈2.7%)	BBC (chain-supplied figures)
Intermarché / Netto stores affected	180, plus ~100 preventively disconnected	BBC / CNBC
Coopérative U stores targeted	>100	BBC
Carrefour stores hacked	80 of 6,000	BBC
Monoprix stores hacked	5% of 400+	BBC
Peak fridge temperature commanded	50°C (122°F)	Chains' statements via BBC/CNBC/Reuters
Duration at Intermarché	6 hours overnight	Intermarché via BBC/Reuters
Normal defrost cycle	~2 hours/day	Tom's Hardware (La Dépêche)
Losses, two Alsatian stores	€270,000 combined	BFMTV via BBC
Les Mousquetaires projected losses	"several million euros"	CNBC (company statement)
Exposed AK-SM 800A controllers (Aug 2026 scan)	2,765 devices	Claroty Team82 / Censys
Countries with affected systems	6+ (France, Spain, Portugal, Poland, Germany, Belgium)	CNBC via Reuters
Countries with related/parallel incidents	Netherlands (shelf labels, websites)	Tom's Hardware / NOS

"Why Is This on the Internet?" — and the Uncomfortable Answer

The top comment sentiment on the 789-point Hacker News thread (910 comments and climbing) was a frustrated chorus: why does a fridge controller need internet exposure at all? One commenter sneered that connectivity exists "for a single reason: spyware." Another fired back with the operations-side truth: monitoring, logging, alerting, and control of temperatures that directly correlate with spoilage and lost revenue — of course a multinational grocery chain wants that.

Both are right, and the collision between them is the actual lesson. A smarter commenter cut to the real distinction: there's a difference between passive monitoring (telemetry flowing out to a dashboard) and remote control (an engineer on another continent being able to change what the machine does). The first justifies connectivity. The second is where the risk compounds — and it's the second that the AK-SM 800A's entire value proposition, and this attack, are built on. The industry-standard fix — put the controllers on a private network, broker remote access through a VPN or jump host, log every administrative action — is well understood and routinely skipped, because every layer of it costs money and adds friction to the very maintenance workflow the connectivity exists to enable.

Then there's the ugliest wrinkle in the whole affair: Danfoss told the BBC that the affected cold units were older models whose security software could not be updated to address the risk, while noting the company has "long advised" customers to keep supported systems current. Read that carefully. The fix for the exact weaknesses Team82 disclosed exists — in new firmware, for supported units. The stores that got hit were running the installed base that can't take the patch. This is the EOL problem in miniature, and it's everywhere: the newest firmware exists, the deployed fleet predates it, and the gap between those two facts is where attacks live. A patch you cannot install is a disclosure without a defense — arguably worse than silence, because it hands attackers a verified map while leaving defenders holding instructions they can't follow.

What This Changes

Grocery just joined the grid. Critical-infrastructure conversations have historically meant power plants, pipelines, water treatment. A European food-retail sector just learned that its cold chain is attackable at scale through a single vendor's management platform — and the EU's response signals it took the point. European Food Commissioner Christophe Hansen publicly condemned the attack with a line that would have sounded alarmist a month ago: "Food security requires more attention at all levels. Because the weaponisation of food has become a reality." When the agriculture commissioner starts talking like a counterterrorism official, procurement requirements change. Expect supermarket chains across Europe to suddenly find budget for network segmentation audits, and expect OT vendors to face questions about why support backdoors in critical infrastructure were ever a design pattern.

The disclosure dilemma gets sharper. Team82 did everything right: researched, disclosed responsibly, and Danfoss shipped fixed firmware. Two months later, the exact class of device they studied was allegedly used to spoil food across a continent. This is the recurring knot of vulnerability research in OT — publication arms defenders with knowledge and attackers with a target list, and when a large fraction of the installed base can't patch, the attackers hold the better cards. The 2,765-exposed-devices figure wasn't sensationalism in August; it was probably an undercount of what's reachable, and it's now the most cited number in a French criminal investigation.

Your threat model includes the vendor's convenience features. Every smart-building platform — HVAC, access control, elevators, refrigeration — is converging on the same architecture: an embedded web console, cloud-manageable, sold on the promise of remote everything. The AK-SM 800A's "code of the day" is a reminder that convenience paths get built deep into firmware, survive audits, and only become visible when someone with a firmware dump and six weeks of patience goes looking. If your organization runs facilities, the audit question is no longer "is our network secure?" but "what can the refrigeration vendor's console do, who can reach it, and what happens when they use it the wrong way?"

⚠️ Limitations & Caveats

Attribution: none. No group has claimed the attack; no public forensic analysis ties it to a specific actor, technique, or CVE. Any confident story about "how they did it" is speculation.
The fires are contested. Reuters reporting (via BBC) describes "small fires" in some stores; Les Mousquetaires told CNBC the overheating "resulted in smoke, but no fires have been reported." Treat fire claims as disputed at the chain level.
The 50°C figure comes from the chains and press, not Danfoss. The BBC notes Danfoss "did not confirm any reports about just how warm the fridges and freezers could become." The number is consistent across multiple retailers but remains company-reported.
The Netherlands may be a separate incident. Albert Heijn/Etos/Gall & Gall website outages, shelf-label compromise, and Delhaize disruption may share a cause with the French fridge attack or may not — Tom's Hardware explicitly reports the connection as unclear, and Ahold Delhaize describes a "security issue within its network" without linking it to Danfoss.
Loss figures are preliminary. Early estimates near €300,000 (Tom's Hardware, citing La Dépêche) sit alongside "several million euros" projections; Les Mousquetaires is still awaiting court-appointed bailiff and insurance assessments.

🎯 The Bottom Line

A 50°C freezer aisle is a funny image until you realize it required no 0-day, no stolen password, and no physical access — just an internet-exposed console, an older controller that can't be patched, and a public research paper that mapped the locks two months early. The supermarket hack isn't a freak event; it's the OT security debt of the entire smart-building economy coming due in the most legible way possible. The wave of heat was the alert. The question is whether anyone outside the grocery aisle is checking their own controllers.

📚 Sources

BBC News — "Fridges in French supermarkets hit by cyber attack" (Ian Aikman & Hugh Schofield): store-by-store counts, Intermarché's six hours at 50°C, Danfoss's older-model/unpatchable statement, Paris prosecutor probe, Commissioner Hansen quote. https://www.bbc.com/news/articles/crq5nzxv9q4yo
CNBC — "French supermarket fridges get hacked, heating to 122°F and sparking fires": multi-country spread per Reuters/Sekoia, Les Mousquetaires loss projection, Ahold Delhaize statement, the smoke-vs-fires conflict. https://www.cnbc.com/2026/10/13/france-supermarket-hack-cyberattack-fridges-fires.html
Tom's Hardware — "'Unprecedented' Cyberattack cripples supermarket fridges across Europe as hackers activate automatic defrosting": the 2-hours-a-day-to-continuous-at-50°C detail, La Dépêche and NOS citations, Dutch electronic shelf label and pricing disruption. https://www.tomshardware.com/tech-industry/cyber-security/unprecedented-cyberattack-cripples-supermarket-fridges-across-europe-as-hackers-activate-automatic-defrosting-delivery-and-store-prices-also-impacted-by-incident
Claroty Team82 (Gold — primary research) — "Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers" (Amir Zaltzman, Aug 9, 2026): CVE-2025-41450 code-of-the-day auth bypass, CVE-2025-41451 command-injection RCE, Nginx config injection, 2,765 exposed devices on Censys, coordinated disclosure and firmware fix. https://www.claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
Hacker News (Bronze — community sentiment) — "Hackers activate automatic defrosting in supermarket fridges across Europe": 789 points, 910 comments, front page Oct 12–13. https://news.ycombinator.com/item?id=50055304

All claims verified against Gold-tier (Claroty Team82 primary research) and Silver-tier (BBC, CNBC, Tom's Hardware) sources. Each source URL was scraped and confirmed accessible with full content. Reuters-derived facts carry explicit attribution to Reuters via the publishing outlets. Conflicting claims (fires vs. smoke; Dutch incident linkage) are presented as disputed. Last verified: October 13, 2026.