The Supermarket Fridge Hack Is a Warning About Rented Infrastructure

Why is the supermarket fridge hack a warning about rented infrastructure?

Hackers didn't melt refrigerators across France in October 2026. They hijacked Danfoss's remote-management dashboard, the shared control panel retailers never controlled themselves, and used it to run defrost cycles until stores hit 50°C overnight. Preventing the next one isn't a firmware update. It means pulling these controllers off the open internet, locking down vendor access, and replacing hardware too old to patch at all, before the next attack instead of after.

What happened to supermarket fridges across France?

The attack forced automatic defrost cycles to run continuously, pushing refrigeration units to oven-like temperatures overnight. Les Mousquetaires, the group behind Intermarché and Netto, reported figures ranging from roughly 150 to over 300 affected stores. Coopérative U and Carrefour each reported about 80 stores hit. Nationwide estimates landed somewhere between 250 and 400-plus stores out of France's roughly 15,000 supermarkets.

The money was real and fast. Two supermarkets in the Alsace region alone reported combined stock losses of €270,000. Les Mousquetaires CEO Thierry Cotillard estimated nationwide losses could reach tens of millions of euros once spoiled inventory across every affected chain is counted.

It didn't stop at the border. Dutch and Belgian retail giant Ahold Delhaize, which owns Albert Heijn, Delhaize, Etos and Gall & Gall, separately took systems offline after what it called a cybersecurity incident, disrupting delivery websites. A Sekoia threat intelligence analyst said Spain, Portugal, Poland, Germany and Belgium showed signs of the same exposure. This was a European event wearing a French dateline.

Why was the dashboard, not the compressor, the vulnerability?

The units themselves worked fine. What failed was the remote-management layer sitting on top of them: Danfoss's AK-SM and AK-SC controllers, the interfaces retailers and third-party technicians use to monitor and adjust refrigeration across hundreds of physically distant stores from one screen.

Two months before the attack, Claroty's Team82 research group had already disclosed serious flaws in the current AK-SM 800A platform: a hidden "code-of-the-day" authentication bypass (CVE-2025-41450) and a command-injection vulnerability enabling remote code execution (CVE-2025-41451). More alarming than the bugs themselves was what Team82 found when they went looking: thousands of these management interfaces sitting directly on the public internet, reachable from anywhere, with no network boundary between a hacker and a supermarket's cold chain.

Security researcher Baptiste Robert independently scanned and found 2,752 exposed Danfoss systems globally, 1,590 of them in France alone. Shodan's own tracking put the number of internet-reachable Danfoss devices above 4,500. That's not a misconfigured test server somebody forgot about. That's the normal, intended operating posture of a vendor-hosted control plane built for convenience first.

Why does "just patch the firmware" miss the point?

Here's where this stops being a routine patch-management story. Danfoss confirmed that most of the compromised units were legacy models that no longer receive security updates at all. The AK-SM 800 was declared end-of-life in May 2021. The AK-SC 355 was phased out in 2016. Some newer AK-SM 800A units that were hit weren't even end-of-life, just running outdated firmware that nobody had gotten around to updating.

Stores running those legacy controllers have no patch to apply, no update to download, no fix coming, ever. The only options are disconnect, replace, or accept the risk. That's not a software bug. That's a structural dependency: thousands of physically separate stores, each with its own cold chain, tied to the uptime and security posture of one shared, remotely managed platform none of them actually controlled.

When a single vendor's management interface is the thing standing between "store open" and "store full of spoiled food," you've effectively rented your refrigeration's control system the same way you'd rent a SaaS dashboard, except nobody framed it that way at purchase time. The retailer owns the compressor. The vendor owns the brain. The vendor's exposure becomes everyone's exposure.

Is internet-exposed OT a one-off bug?

This pattern predates the French attack by years. Danfoss's own October 2025 newsletter recorded that 16 Russian supermarkets running the AK-SM 800 were targeted in 2022, and 40 Israeli stores were hacked the same year after lacking proper firewall or VPN protection. The exposure that got exploited in October 2026 had already been demonstrated, in the wild, four years earlier.

It's bigger than Danfoss. Shieldworkz's H1 2026 OT threat advisory recorded a 77% increase in site-level operational technology cyber incidents in 2025 and identified at least 19,000 internet-exposed industrial control system devices globally in H1 2026 threat scans alone. A security expert in New Zealand called the French incident a "wake-up call" for supermarkets everywhere, noting that any device facing the internet, or sitting a couple of hops away from one, is a possible attack path. The fridge hack is a symptom. The disease is an entire category of operational technology that got connected to the internet for vendor convenience and never got re-secured for the risk that created.

How can you prevent the next fridge hack?

France's national cybersecurity agency, CERT-FR, issued emergency guidance telling every operator of AK-SM and AK-SC controllers to pull them off the open internet immediately. Combined with Danfoss's own guidance and broader ANSSI hardening recommendations, that remediation breaks into concrete steps any operator running remotely managed OT should check right now:

1. Restrict network access to service providers only. No refrigeration, HVAC, or building-management controller should be reachable from the open internet. Access should route through a VPN or similarly restricted channel limited to the vendor or contractor who actually needs it.
2. Factory-reset any compromised or suspect device. Assume persistence. A reset clears unknown changes before you reconfigure.
3. Apply every available security fix. For devices still receiving updates, this is non-negotiable and should be scheduled, not deferred.
4. Change device credentials. Default and long-standing credentials on OT hardware are a known weak point; rotate them as part of any incident response, not just after a breach.
5. Audit existing accounts. Know who and what has access to your management interfaces, and remove anything you can't account for.
6. Fully reconfigure the device. Don't just undo the attacker's changes; rebuild the configuration from a known-good baseline.

That checklist works for devices still supported by the vendor. It does nothing for end-of-life hardware like the AK-SM 800 or AK-SC 355, where no patch exists and never will. For those, the only real options are replacement or isolation behind a network boundary the operator actually controls, not the vendor's convenience layer.

Is the real fix ownership rather than patching?

I've shipped internal tools that other teams depend on, and the checklist above is good incident response. But it treats the symptom. The real question is who holds the keys to systems your business cannot run without.

A supermarket chain doesn't think of its refrigeration controller as "software it runs." It thinks of it as a fridge. But the controller is software, built and hosted by a vendor, exposed to the internet by design, and shared across a huge number of unrelated customers. When that vendor's platform has a flaw, every customer inherits the blast radius at once, which is exactly what happened across five or six countries in one night.

This is the same failure mode this publication has tracked in consumer hardware: when Samsung pushed a firmware update that could brick a fridge, or when Cricut could remote-lock a cutter you'd already paid for, the lesson was that whoever controls the software layer controls the thing you thought you owned. The Danfoss incident is the industrial-scale version of that same problem, except instead of one appliance in one kitchen, it's refrigeration across hundreds of stores and five countries, and the stakes are measured in tens of millions of euros of spoiled food rather than a bricked blender.

The pattern repeats because the economics of vendor-hosted OT look identical to SaaS economics: it's cheaper and faster to let one vendor host a remote dashboard for thousands of customers than for each operator to run and secure its own management layer. That tradeoff makes sense for a lot of software, which is part of why tech teams are quietly rebuilding their stacks around things they own instead of things they rent. It makes much less sense when the dashboard controls physical equipment keeping food, medicine, or people safe. If you wouldn't accept a shared outage risk for your point-of-sale system, you shouldn't accept it for the system keeping your inventory at 4°C.

Owning that control plane doesn't mean building your own refrigeration firmware from scratch. It means insisting on network segmentation you administer, VPN-gated access instead of open internet exposure, firmware you can audit and schedule updates for, and a contractual commitment from the vendor about end-of-life support timelines before you buy a single unit. It means treating OT procurement the way serious engineering teams are starting to treat software procurement generally, as described in why bricked hardware and missing update support erode real ownership: ask what happens when the vendor stops supporting the thing, before you're the one standing in a dark aisle with spoiled stock.

What does this mean for every other "boring" system you rent?

Refrigeration isn't unique. HVAC, access control, manufacturing line controllers, warehouse logistics systems, building management platforms. All of them increasingly ship as vendor-hosted, internet-reachable control planes managed through a dashboard the operator doesn't own. The Danfoss incident is proof of what that architecture costs when it goes wrong, measured in food, money, and the operational chaos of hundreds of stores losing cold storage on the same night.

If you're an IT or operations leader signing off on the next piece of "smart" building or facilities technology, ask the vendor directly how their management interface is exposed, who else shares that exposure, and what your fallback is on the day they get breached or the day they declare your model end-of-life. If the honest answer is "you're on the shared platform with everyone else, and there's no isolated fallback," you're not buying infrastructure. You're renting a single point of failure and hoping it never gets found.

The same instinct pushing engineering teams toward running AI on infrastructure they own instead of renting someone else's API applies just as directly to the control systems keeping your fridges, your HVAC, and your access doors running. Owning the control plane, not just the hardware, is the actual lesson here.