Blast of Hot Air Meets Morning Staff: Fresh Produce Ruined Overnight
On the morning of October 12, 2026, supermarket employees across France slid open refrigerator doors only to be greeted by plumes of scalding steam. Shelf after shelf of fresh beef had softened and spoiled, while seafood freezers had turned into warm-water baths. The infiltrators demanded no ransom; instead, they had directly modified defrost routines to blast continuous 50°C heat.
The disaster rippled rapidly across retail giants including Intermarché, Leclerc, and Coopérative U. Dominique Schelcher, CEO of Coopérative U, confirmed the same day that refrigeration units across several of the chain’s locations had suffered sudden cyberattacks.
Initial direct losses for the French retail sector approached €300,000, with comprehensive nationwide damages projected to climb into the millions of euros. A single altered heating parameter on industrial-grade chillers was all it took to reduce tens of tons of fresh food to biohazard waste within hours.
Commercial refrigerators rely on routine defrost cycles to prevent ice buildup on evaporators using electric heating elements. Under normal operating conditions, defrosting runs for only about two hours a day, held strictly within safe temperature thresholds. Attackers seized this legitimate functional pathway, turning a brief maintenance routine into an unrelenting 50°C heat wave.
Figure: Fresh food refrigerated display cabinets in a major European supermarket chain. Source: AFP / Tom’s Hardware
€7,000 Controller Leaves a Backdoor: Two Months Unpatched After Disclosure
At the heart of the breach was the AK-SM 800A System Manager, manufactured by Danish industrial conglomerate Danfoss. Equipped with an onboard touchscreen and engineered in Europe, each unit commands a procurement price tag of roughly €7,000. It serves as the industrial brain orchestrating a supermarket’s compressors and expansion valves—a specialized tier of equipment few would instinctively associate with casual cybersecurity exploits.
Cybersecurity research group Claroty Team82 publicly disclosed critical vulnerabilities in the device back on August 9, 2026. Inside the controller’s firmware, researchers uncovered a hidden authentication mechanism dubbed “Code of the Day,” which allowed external parties to bypass login portals and seize administrative privileges.
The platform also suffered from command injection flaws leading to Remote Code Execution (CVE-2025-41451), alongside an issue permitting authenticated users to inject arbitrary web server configuration directives. With temperature parameters left entirely unprotected at the base layer, unauthorized outsiders gained full modification access. A high price tag did not come with rigorous code auditing; a single hardcoded backchannel rendered the entire perimeter moot. Two months elapsed between public disclosure and widespread failure, yet in-production field controllers remained entirely unpatched.
Saving on Callout Fees Leaves 2,765 Controllers Exposed to the Web
Even when software vulnerabilities exist, keeping systems isolated inside segregated local networks prevents outside adversaries from reaching them. In reality, massive numbers of controllers governing the lifeblood of fresh food retail were exposed directly to the open internet without any firewall protection. Internet scanning queries via Censys uncovered 2,765 online, active units of this exact model in a single search.
On-site operations revealed even more careless shortcuts: default administrative credentials were routinely left untouched, with some reports noting passwords on certain models could not even be changed. Attackers did not even need sophisticated exploit chains—finding the IP address was enough to access the refrigeration console. The collective exposure of thousands of industrial units stemmed from retail corporate habits of slashing operational maintenance budgets.
Danfoss marketing materials have long promoted remote diagnostics and remote defrost initiation as key selling points: no need to dispatch a service technician every time an alarm sounds when an issue can be cleared with a remote click. With on-site technician visits routinely costing hundreds of euros, controllers were wired straight to public networks to clear warnings from remote offices. To shave off a few hundred euros in maintenance fees, retailers handed over their entire refrigerated inventory to the public internet.
Figure: An electronic shelf label affected during the broader network disruptions. Source: Wikimedia Commons
Flat Networks and Zero Segmentation: Electronic Shelf Labels Down Alongside Chilled Goods
The chaos unleashed by the incident was not confined to store fridges in France. Dutch grocery giant Albert Heijn had to abruptly shut down multiple brand websites, bringing online delivery services to a screeching halt. Belgian supermarket chain Delhaize, part of the same parent company, suffered widespread IT outages on the very same day.
Inside brick-and-mortar stores, as fridges went dark, electronic shelf labels (ESLs) also went haywire. Displayed prices turned erratic, and cashier checkout loyalty programs were forced offline. Albert Heijn subsequently issued a statement acknowledging that multiple connected services had been pre-emptively shut down to protect their infrastructure.
Commercial refrigeration relies heavily on industrial fieldbuses like Modbus to convey instructions, managed through central facility monitoring systems. Many retailers lumped temperature regulation, ESL systems, and POS checkout onto the exact same local network. Without network segmentation, once the perimeter gives way, disruption creeps through network cables straight into core business functions.
Industrial Systems Treated Like Office Supplies: Parameter Tweaks Break the Chain
Confronted with rotting food across retail floors, store executives framed the incident as an unprecedented, sophisticated cyber strike. However, industrial control engineers quickly countered those claims. Back in August 2026, a military commissary on a US base experienced an identical attack: freezers were toggled into permanent defrost mode, with reports stating “all frozen food was a total loss.” The equipment in question was also made by Danfoss.
Modern retail conglomerates spare no expense on IT data security. They erect multilayered firewalls around corporate datacenters and mandate monitoring software across employee laptops. Yet when it comes to operational control systems that safeguard perishable merchandise, management practices revert to negligence.
The European Union’s Cyber Resilience Act aims to curb these lapses by shifting accountability for software flaws onto device manufacturers. However, legislative mandates can only award damages after the fact; they cannot salvage tons of food spoiled overnight. As long as supermarkets treat industrial machinery like disposable office appliances, their security posture remains an illusion. Any unprotected controller left on the public web remains a ticking switch, ready to destroy critical supply chains at any moment.
References:
- Claroty Team82 Research Report
- Tom’s Hardware Coverage
- US Base Commissary Fridge Incident Discussion (Hacker News)
