The French Refrigerator Attack Wasn’t a Power Outage. Your DR Plan Needs to Know the Difference

Threat Intelligence

On the night of October 11-12, 2026, hackers remotely triggered forced defrost cycles on refrigeration controllers at hundreds of French supermarkets, raising temperatures to 50 degrees Celsius -- 122 degrees Fahrenheit -- over a six-hour window. Intermarche, Coopérative U, E.Leclerc, Carrefour, and Monoprix were all affected. Stores discarded refrigerated and frozen inventory to avoid health risks. Fires broke out at several locations. The Paris prosecutor opened an investigation. ANSSI -- France's national cybersecurity agency -- was directed by the Prime Minister to investigate. Dutch retailer Ahold Delhaize, which operates Albert Heijn, reported a simultaneous "security issue" and took systems offline.

The vulnerability at the center of the attack was not a zero-day. It had been publicly documented, responsibly disclosed, and patched two months earlier.

The Timeline That Made This Preventable

On August 9, 2026, Claroty's Team82 published research titled "Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers." The research documented multiple vulnerabilities in the Danfoss AK-SM 800A, a supervisory controller widely deployed in supermarkets, cold-storage facilities, and warehouses to centrally manage refrigeration equipment across an entire store.

Team82 identified vulnerabilities in the controller's embedded web management interface -- the component that allows remote access over the internet for maintenance. The attack surface was the web interface itself, which Claroty described as "the most realistic entry point for a remote attacker." The specific vulnerabilities included authentication bypass, command injection, and credential disclosure issues. A live physical test confirmed that a compromised controller could grant an attacker the ability to manipulate refrigeration systems remotely.

Claroty disclosed the vulnerabilities to Danfoss through coordinated responsible disclosure. Danfoss investigated, acknowledged the findings, and released patched firmware -- version R4.3.1 -- addressing all three vulnerabilities. The patch was available before Team82's public disclosure on August 9.

Approximately three weeks after the public disclosure, about a dozen US military commissaries reported food losses after refrigeration systems were affected in a similar pattern. Those incidents went largely unreported outside defense-adjacent media.

Two months after the public disclosure, the French attacks hit. ANSSI confirmed to French media that the vulnerability exploited was the one identified by Claroty in the Danfoss software. The affected units in France were described as legacy models -- older versions of the AK-SM 800A that had not received the patch.

The sequence is unambiguous: vulnerability disclosed, patch released, patch not applied, attackers exploited the known vulnerability at scale.

How the Attack Worked

Supermarket cold aisles are typically controlled by management panels that centralize control of an entire store's refrigeration and freezer infrastructure. These controllers are accessible over the internet to allow maintenance companies to adjust settings remotely -- a convenience that is standard practice in commercial refrigeration management.

The Danfoss AK-SM 800A sits at the top of that architecture. Compromise the controller, and you control every refrigeration circuit it manages. In a large supermarket, that is everything from fresh produce and dairy to frozen foods and pharmaceutical items sold over the counter.

The attack did not require physical access. It did not require insider knowledge of the target organizations' networks beyond finding internet-exposed controller interfaces. It exploited a known vulnerability for which a patch existed. The forced defrost command is a legitimate function of the controller -- the attackers used the controller's own capability against the stores that ran it.

Your DR Plan Covers the Wrong Scenario

Most organizations that store temperature-sensitive goods -- food retailers, pharmaceutical distributors, healthcare facilities, biotech companies -- have disaster recovery and business continuity plans that include cold chain protection. Those plans share a common assumption: the failure scenario is environmental or mechanical. Power outage, compressor failure, refrigerant leak, grid instability, natural disaster.

That assumption is now demonstrably incomplete.

The French attack was not a power outage. The refrigerators had power. The network was functioning. The maintenance systems were online. From the perspective of every traditional failure monitoring tool, the environment looked normal. What happened was not an equipment failure -- it was an equipment command. The refrigerators were working exactly as designed. They were designed to defrost when instructed, and an attacker instructed them to do so.

Disaster recovery plans built around the scenario "the refrigerator stopped working" do not cover the scenario "the refrigerator was commanded to work against us." The response protocols are different. The detection surface is different. The time window may be different -- a defrost cycle triggered at midnight across hundreds of locations simultaneously produces a damage pattern that looks like a simultaneous equipment failure, not a cyberattack, until someone looks at the controller logs.

The question for any organization with a cold chain dependency is direct: does your incident response plan include the scenario where your refrigeration systems are functioning normally, reporting no faults, and actively destroying your inventory?

The Healthcare Cold Chain Is Not a Peripheral Concern

Healthcare organizations have been operating cold chain security programs for years, driven primarily by vaccine storage requirements, blood product handling, and pharmaceutical integrity. HIPAA's physical safeguards and various pharmacy regulatory frameworks create documentation requirements around temperature monitoring. Most healthcare facilities have temperature logging, alarm systems, and backup power for critical refrigeration.

What most of those programs were not built for is the adversarially-commanded failure scenario the French attack demonstrates. The parallels between supermarket refrigeration infrastructure and healthcare refrigeration infrastructure are direct:

The same controller families are deployed in both environments. The Danfoss AK-SM 800A and similar supervisory controllers are used in pharmaceutical cold storage, laboratory specimen refrigeration, blood bank management, and vaccine storage systems. These are not hypothetical targets -- they are the same product line that was exploited in France, managed through the same internet-accessible web interfaces, with the same patch management challenges.

Healthcare cold chain failures have patient safety consequences that food spoilage does not. Compromised blood products, degraded vaccines, spoiled biologics, and temperature-sensitive medications represent patient safety events, not just financial losses. A six-hour defrost cycle in a hospital blood bank or a pharmacy refrigerator carrying temperature-sensitive oncology medications has consequences that cannot be remediated by throwing out inventory and restocking.

Legacy devices are endemic in healthcare. The French attack specifically affected older Danfoss models that had not been patched. Healthcare facilities are well-documented to run legacy OT and medical device firmware for years beyond vendor support -- the same economics that prevent timely patching of infusion pumps and imaging equipment apply equally to the refrigeration controllers on the same network segments.

Remote access is the standard maintenance model. Just as French supermarket chains allowed remote access to their refrigeration controllers for maintenance convenience, healthcare facilities routinely allow vendor remote access to building management systems, HVAC, and laboratory equipment. That remote access is the entry point the Danfoss vulnerability exposed.

What Non-Healthcare Organizations Need to Learn From Healthcare

Healthcare has developed cold chain governance frameworks that most industries with cold chain dependencies have not. The regulatory pressure of vaccine storage requirements, blood banking standards, and pharmaceutical handling regulations has produced documentation practices, temperature monitoring protocols, and response procedures that are absent in many retail, food service, and logistics environments.

The French incident is an argument for extending that governance posture beyond healthcare.

Specifically: the difference between a healthcare facility's cold chain response and a supermarket chain's cold chain response should not be that the hospital has a HIPAA-driven temperature log and the supermarket does not. It should be that both organizations have:

A current inventory of every internet-accessible controller managing temperature-sensitive infrastructure, with firmware versions documented against known CVEs. The Danfoss patch existed. The question is whether any organization running that controller knew they needed to apply it, and when.

A network segmentation policy that separates refrigeration management systems from general internet access. The web interface being internet-accessible is a design choice, not a requirement. Maintenance access can be provided through VPN or other controlled channels that do not expose the management interface to the open internet.

An incident response playbook that explicitly covers adversarially-commanded equipment failure, not just environmental failure. The detection signature is different -- normal power, normal network, active controller commands, anomalous temperatures -- and the response timeline may be shorter.

A vendor notification and patch management workflow for OT devices. IT patch management workflows do not naturally extend to refrigeration controllers, building management systems, or industrial IoT. That gap is structural and requires explicit ownership.

The Patch Gap Problem at Scale

The French attack is not primarily a story about sophisticated attackers. The technical barrier to exploiting the Danfoss vulnerability, once Claroty published the research in August, was substantially lower than it had been before. The research documented the attack surface, described the vulnerability classes, and provided enough technical detail for capable threat actors to develop working exploits. The US military commissary incidents in late August suggest exploitation began almost immediately after disclosure.

Two months is not a long time to patch industrial controller firmware across hundreds of locations. Unlike server operating systems where patch deployment can be automated and rolled out centrally, OT device patching often requires scheduled maintenance windows, vendor involvement, physical access, and testing to confirm refrigeration systems continue to function correctly after firmware updates. In a retail environment operating seven days a week with no planned downtime, the logistics of patching 300+ stores in 60 days are genuinely difficult.

That difficulty is not an excuse -- it is a risk management decision. Organizations that assessed the Claroty disclosure in August, recognized that legacy Danfoss units were in their environment, and determined that patching within 60 days was not operationally feasible should have had compensating controls in place: network segmentation, enhanced monitoring, vendor notification, or accelerated patching priority for the most critical locations. Those that did neither are the ones discarding inventory today.

The healthcare lesson is directly applicable: OT patch management requires its own program, its own timelines, its own risk acceptance process, and explicit ownership. Waiting for OT patches to fall into the IT patch management cycle means they do not get applied until after the incident.

What to Do Now

For any organization running Danfoss AK-SM 800A controllers: apply firmware R4.3.1 immediately if not already done. ANSSI has confirmed this is the exploited vulnerability. The patch exists. This is not a complex remediation decision.

More broadly, the French incident is the right moment to review cold chain infrastructure security posture across any organization with temperature-sensitive dependencies:

Identify every internet-accessible refrigeration or HVAC management interface in your environment. Conduct a CVE check against current firmware versions. Assess whether maintenance remote access can be moved behind VPN or access controls that do not require an internet-exposed management interface. Review whether your incident response plan includes the adversarially-commanded failure scenario. Verify that your cold chain DR plan distinguishes between environmental failure and active compromise -- the response actions and time windows are different.

The attack surface is not unique to French supermarkets. The Danfoss AK-SM 800A is deployed in supermarkets, cold storage facilities, warehouses, pharmaceutical distribution centers, and healthcare facilities worldwide. The vulnerability was documented, the patch was available, and the attack happened anyway. The question for organizations outside France is whether the same conditions exist in their environments -- and whether they will address them before or after their own version of this incident.

This is an entry in the Threat Intelligence series.