Executive Summary
In October 2026, threat actors executed a coordinated cyberattack against French supermarket chains including Intermarché, Coopérative U, Carrefour Market, and Leclerc, affecting 250-350 stores. The attackers exploited vulnerabilities in Danfoss refrigeration controllers to remotely trigger defrosting systems, raising temperatures to 50 degrees Celsius and causing massive food spoilage and financial losses. The attack leveraged known CVEs (CVE-2025-41450 and CVE-2025-41451) in older Danfoss AK-SM 800A series controllers that were publicly accessible via the internet.
This incident represents an alarming evolution in critical infrastructure attacks, demonstrating how operational technology vulnerabilities can cause immediate physical and economic damage. With over 4,500 similar Danfoss devices exposed online globally, this attack highlights the urgent need for better OT security practices and network segmentation in critical supply chain infrastructure.
Why This Matters Now
This attack demonstrates the growing threat to critical infrastructure through IoT and OT vulnerabilities, with attackers increasingly targeting systems that directly impact food supply chains and public safety, making immediate OT security measures essential.
Attack Path Analysis
Attackers exploited authentication bypass (CVE-2025-41450) and command injection (CVE-2025-41451) vulnerabilities in internet-exposed Danfoss AK-SM 8xxA refrigeration controllers to gain initial access. They escalated privileges through command injection to gain administrative control over the systems. Lateral movement occurred across multiple supermarket chains' refrigeration networks, targeting 250-350 stores across six major French retail chains. Command and control was established to coordinate the synchronized attack across all compromised systems. No traditional data exfiltration occurred, but the attack culminated in significant business impact by remotely triggering defrost systems, destroying food inventory and causing operational disruption.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers exploited authentication bypass vulnerability CVE-2025-41450 in internet-exposed Danfoss AK-SM 8xxA refrigeration controllers to gain unauthorized access to management interfaces
Related CVEs
CVE-2025-41450
CVSS 8.2An authentication bypass vulnerability in Danfoss AK-SM 8xxA Series refrigeration controllers allows unauthenticated remote attackers to gain unauthorized access to system management interfaces.
Affected Products:
Danfoss AK-SM 8xxA Series – < 4.1.2
Exploit Status:
exploited in the wildCVE-2025-41451
CVSS 8.7A command injection vulnerability in Danfoss AK-SM 8xxA Series refrigeration controllers allows authenticated remote attackers to execute arbitrary commands on the underlying system.
Affected Products:
Danfoss AK-SM 8xxA Series – < 4.1.2
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Exploitation of Remote Services
Command and Scripting Interpreter: Unix Shell
Impair Defenses: Disable or Modify Tools
Hardware Additions
Data Manipulation: Stored Data Manipulation
Endpoint Denial of Service
Service Stop
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
CISA Zero Trust Maturity Model 2.0 – IoT and OT Device Security
Control ID: Device Security - Advanced
NYDFS 23 NYCRR 500 – Cybersecurity Program
Control ID: 500.02(b)
Digital Operational Resilience Act (DORA) – ICT Third-Party Risk
Control ID: Article 11
PCI DSS 4.0 – Internal Vulnerability Scans
Control ID: 11.3.1
ISO 27001:2022 – Network Controls
Control ID: A.13.1.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Supermarkets
Direct targets of critical infrastructure attack on refrigeration systems causing food spoilage, financial losses, and operational disruption across major French chains.
Retail Industry
Vulnerable to IoT-based attacks on essential systems; requires enhanced segmentation and egress controls to prevent similar refrigeration controller compromises.
Food Production
Cold chain disruption threatens food safety compliance; needs encrypted traffic monitoring and anomaly detection for temperature-critical industrial control systems.
Industrial Automation
Danfoss controller vulnerabilities expose HVAC and refrigeration systems to remote exploitation requiring zero trust segmentation and inline IPS protection.
Sources
- Cyberattack shuts down refrigerators at French supermarketshttps://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/Verified
- CISA Security Bulletin SB25-132 - Danfoss Authentication Bypass Vulnerabilityhttps://www.cisa.gov/news-events/bulletins/sb25-132Verified
- CISA Security Bulletin SB25-237 - Danfoss Command Injection Vulnerabilityhttps://www.cisa.gov/news-events/bulletins/sb25-237Verified
- Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllershttps://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllersVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely have constrained this refrigeration controller attack by limiting lateral movement across supermarket networks and reducing blast radius. Zero Trust segmentation could have prevented the synchronized coordination across 250-350 stores.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Zero Trust fabric controls would likely have reduced the initial attack surface by isolating refrigeration controllers from direct internet exposure and constraining unauthorized access paths to critical operational systems.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies would likely have constrained the scope of administrative access by limiting privilege escalation paths and reducing the blast radius of compromised controller credentials across refrigeration infrastructure.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely have significantly constrained lateral movement between store locations and retail chains, reducing the attack scope from hundreds of stores to isolated network segments with limited cross-chain reachability.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely have detected and constrained the coordinated command infrastructure by identifying suspicious communication patterns across distributed retail locations and limiting centralized control channel establishment.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls would likely have maintained visibility into outbound communications and constrained any potential data movement, though this attack focused on operational impact rather than information theft.
While Zero Trust controls could have reduced the scale of impact by limiting the number of affected stores and constraining cross-chain propagation, compromised refrigeration units would still pose inventory risk within isolated network segments.
Impact at a Glance
Affected Business Functions
- Food Retail Operations
- Cold Chain Management
- Fresh Product Storage
- Frozen Product Distribution
Estimated downtime: 3 days
Estimated loss: $15,000,000
No confirmed data exposure - attack focused on operational disruption of refrigeration systems causing food spoilage and supply chain interruption across 250-350 French supermarket stores.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation to isolate critical OT/IoT devices like refrigeration controllers from internet access and create secure network boundaries
- • Deploy Cloud Firewall (ACF) with egress filtering to prevent unauthorized outbound communications from compromised industrial control systems
- • Establish Multicloud Visibility & Control to monitor anomalous interactions with critical infrastructure systems and detect coordinated attacks across multiple locations
- • Implement Inline IPS (Suricata) with updated signatures to detect and block exploitation attempts against known CVEs in industrial control systems
- • Enable Threat Detection & Anomaly Response capabilities to baseline normal refrigeration system behavior and alert on deviations that could indicate compromise
