What Happened
On the night of October 11, attackers took remote control of refrigeration controllers at French supermarkets and warmed fridges and freezers to as much as 50°C. The Hacker News reports Les Mousquetaires, Carrefour, Coopérative U, Monoprix, and E.Leclerc all lost stock. Les Mousquetaires expects losses in the tens of millions of euros.
The controllers are Danfoss AK-SM and AK-SC units, which maintenance firms manage remotely. Danfoss says most hit units are older models without updates. Nobody has named the attacker or the entry method. CERT-FR has named no vulnerability. BleepingComputer also covers the incident. The Paris prosecutor opened an inquiry.
Why This Matters for Canadian Organizations
No Canadian store is named. Sekoia says Spain, Portugal, Poland, Germany, and Belgium were also hit. The lesson still applies at home. Canada’s food supply depends on cold chain equipment, and CCCS lists food and retail among critical infrastructure sectors. Building controls rarely sit under the security team’s watch. Facilities staff and outside contractors own them, and those contractors often hold remote access.
The financial hit lands fast. Spoiled inventory, forced closures, and insurance disputes arrive within hours. Earlier attacks on AK-SM 800 controllers reportedly hit 16 Russian stores and 40 Israeli stores in 2022, so the weakness is not new. Claroty also reports thousands of AK-SM 800A interfaces reachable from the internet.
What to Do
Ask facilities and your refrigeration contractors whether Danfoss AK-SM or AK-SC controllers run in your stores or warehouses. Disconnect them from the internet or restrict access to trusted IP addresses. Retire end-of-life models, since the AK-SM 800 and AK-SC 355 receive no updates. For the AK-SM 800A, move to the latest 5.3.x package and keep HTTPS enforced. If you suspect compromise, follow CERT-FR’s sequence of limiting access, factory reset, patching, secret rotation, account checks, and full reconfiguration. Add temperature alarms with independent sensors and audit every vendor remote access path. Read more in our Trends archive and News coverage.
