Incident ResponseThreat IntelligenceSOC
Overnight on Sunday 11 October, attackers remotely switched refrigeration units at French supermarkets into defrost mode, warming stock across potentially hundreds of stores. According to BleepingComputer, the attack reportedly targeted Danfoss refrigeration controllers running older control software, and French outlets put the number of affected stores between 250 and 350. No confirmed store count has been published and no threat actor has been named.
Danfoss, Leclerc and Coopérative U had not responded to BleepingComputer's requests for comment at the time of reporting.
The reporting does not say how the controllers were compromised. Danfoss AK-SM 8xxA series devices are used to manage refrigeration and HVAC in food retail, and two flaws in that product line were already public:
| CVE | Type | Earlier warning |
|---|---|---|
| CVE-2025-41450 | Authentication bypass | CISA bulletin SB25-132, May 2025 |
| CVE-2025-41451 | Command injection | CISA bulletin SB25-237, August 2025 |
Claroty's Team82 found both and, in August, published research showing how they could be chained for remote code execution on internet-reachable AK-SM 800A management interfaces. Treat the link to this week's attack as plausible but unconfirmed: nothing published so far says these CVEs were the entry point.
Predicta Lab CEO Baptiste Robert counted 2,752 exposed Danfoss systems on Monday, 1,590 of them in France, and Shodan tracks more than 4,500 Danfoss devices reachable from the internet. That is the practical lesson: a controller that answers on a public address is findable by anyone with a search engine, whether or not a specific bug is involved.
A separate incident was announced the same day: Ahold Delhaize said it took some systems offline after a "cybersecurity incident." There is no evidence so far that the two are connected.
The reporting offers no vendor remediation guidance, so these are general steps rather than a Danfoss-specific fix:
This incident is a monitoring problem as much as a patching problem. The devices were reachable, the change that mattered was a legitimate-looking configuration action, and the first sign to the victim was warm product. Obiguard SOC is built to bring remote-access logs, VPN and firewall events, and alerts from operational and building systems into one place, so that an unfamiliar source address issuing a defrost command to a store controller at 2 a.m. is something an analyst sees, not something discovered in the morning.
It will not patch a controller or hide it from Shodan, and it cannot alert on a log source nobody forwarded. What it does is shorten the time between a bad action and a person noticing, and keep the evidence together for the investigation that follows.
If someone told your refrigeration or building controllers to change state tonight, which system would log it, and who would be looking?
See how Obiguard SOC works or talk to us about monitoring the systems your security tooling usually skips.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →