OPINION
My refrigerator has one job, and as far as I know it doesn’t have a website. That puts it ahead of a fair number of French supermarkets.
Overnight on Sunday, somebody got into the systems that run the fridges and freezers at hundreds of stores in France and turned the cold up to 50 degrees Celsius, which is about 122 Fahrenheit, or a bad day in Phoenix. At around 150 Intermarché stores the heat ran for six hours, the chain’s owner told Reuters. On Monday, staff at one Paris store were tipping cartfuls of thawed food into a dumpster while melted ice cream ran into the street. Intermarché’s boss put the damage at “tens of millions of euros nationwide in a single day.” The Paris prosecutor reported fires.
Nobody knows yet who did it, and I’m not going to guess. I’m more interested in how easy it may have been.
A password that changes every day, on a schedule
A source in the French prime minister’s office says the national cybersecurity agency found a vulnerability in software from Danfoss, a Danish company that makes the control panels for supermarket refrigeration. Danfoss says the units that got hit were running outdated firmware, and that most were older models that no longer get security updates. The company says it has long told customers to update or replace them.
In this product line, “outdated” covers a lot. In May 2025, the U.S. Cybersecurity and Infrastructure Security Agency warned that Danfoss’s AK-SM 8xxA controllers had a login bypass “caused by datetime-based password generation.” In August of this year, the security firm Claroty explained what that meant. The controllers had a hidden “code of the day,” apparently left in for vendor support, that let you in as administrator without the real password. The code was worked out from the date. Anybody who figured out the formula once could get in on any day of the year.
That’s not a lock. It’s a sign on the door saying the combination is today’s date, with the numbers shuffled a little. And the door was facing the street. Claroty searched the public internet scanning services and found “thousands of publicly accessible management interfaces” for these controllers. CISA’s advice in 2025 was to make sure such systems are “not accessible from the Internet,” which is the kind of advice you’d think nobody would need.
Nobody has confirmed that this particular flaw is the one used in France. Danfoss named its AK-SM800 among the affected models, without the “A,” and investigators haven’t said what they found. But the company’s own explanation, old firmware on equipment reachable from outside, describes the risk the U.S. government spelled out 17 months ago.
The case for the supermarkets
It’s easy to sit at home and say the stores should have patched. The stores have a better argument than that. A supermarket chain runs refrigeration in hundreds or thousands of stores, many installed by contractors and maintained remotely by other contractors, precisely so that nobody has to drive out at 3 a.m. when a freezer acts up. Updating firmware on a control panel that runs every freezer in the building means touching the thing that keeps the whole store’s stock cold, and older models can’t be updated at all. They have to be replaced, at real cost, in thousands of stores.
When CISA published its warning, it also said no public exploitation had been reported and that the flaws had “a high attack complexity.” A busy operations manager reading that in 2025 could reasonably have put it below the leaking roof. Nevertheless, whoever did the hacking committed a crime, and the people throwing out the ice cream are the victims.
All true. The trouble is that “high attack complexity” lasts only until somebody publishes the formula, and the hidden login was Danfoss’s design choice, not the stores’. France’s retail federation has already called on Danfoss to be fully transparent about what happened, Reuters reported. That’s a fair request from customers who were told for years to update and are now being told, in effect, that they should have listened.
Meanwhile, at the commissary
None of this is only a French problem. In late August, freezers failed at U.S. military commissaries in several states, some of them going into defrost mode overnight, and three military criminal investigative agencies opened cases.
Nobody has said what equipment those stores use or whether there’s any connection to France. Asked about it at the time, a defense official told Military Times the department was aware of a possible disruption and added, “Beyond this we have nothing additional to provide.”
That was seven weeks ago. No findings have been announced since, and on Monday it was France’s turn to dump the frozen aisle.
I have a feeling my own refrigerator is safe. It’s too old to have a website, and too old to get updates, which until this week I’d have counted as a problem.
Sources
- Reuters via KFGO, “Hackers heat French supermarket fridges, sparking fires and spoiling food” (Oct. 12, 2026). Used for: the 50°C figure, Intermarché’s 150 stores and six hours, the Paris dumpster, Cotillard’s estimate, the prosecutor, ANSSI’s Danfoss finding, Danfoss’s firmware statement and the FCD.
- CBS News, with AFP (Oct. 12, 2026). Used for: Danfoss’s legacy-model statement and the AK-SM800 and AK-SC355 models.
- CISA, ICS Advisory ICSA-25-140-03, “Danfoss AK-SM 8xxA Series” (May 20, 2025, updated Aug. 26, 2025), via its CSAF record. Used for: the datetime-based password flaw, the internet-exposure advice, the exploitation status and “high attack complexity.”
- Claroty Team82, “Freeze the Controller, Defrost the Food” (Aug. 9, 2026). Used for: the code-of-the-day login and the exposed interfaces.
- Military Times, “DOD confirms refrigeration disruption at military commissaries” (Aug. 28, 2026). Used for: the defense official’s statement.
- Stars and Stripes, “Army, Air Force special agents investigate refrigerator outages affecting several commissary stores” (Sept. 1, 2026). Used for: the defrost outages and the three investigations.
- Stars and Stripes, “Refrigeration failures affect 4 military commissaries in Europe” (Sept. 30, 2026). Used for: no findings announced.
We reported the attack in Hackers Heat French Supermarket Fridges to 122°F, Spoiling Food and weighed the possible culprits in Who Hacked France’s Supermarket Fridges? The Suspect List.