DEV Community

Anoymask
Anoymask

Posted on

French Retail OT Breach: Danfoss Refrigeration Controllers Remotely Defrosted, Causing Food Waste; Fires Under Probe

#security #threatintel

1. Basic Information

2. Executive Summary

Refrigeration systems at multiple French retail chains were remotely manipulated, causing temperature spikes via defrost functions and subsequent food waste. Fires were also reported, and authorities are investigating any connection to the cyberattack.

3. Attack Flow

Observed OT Operations and Physical Impact

  1. An attacker gains remote access to refrigeration controllers running legacy Danfoss control software. The initial access method has not been disclosed.
  2. The attacker triggers the controllers' built-in automatic defrost function.
  3. Temperatures in refrigerated and frozen display units rise, breaking the cold chain.
  4. Stores shut down equipment and remove or discard fresh and frozen food.
  5. Fires are reported in some locations, prompting investigators to examine a link to the attack.

4. Attacker Location and Execution Point

  • A remote attacker reaching the refrigeration management system via the internet or remote maintenance paths. The exact entry point remains unknown.

5. Visibility for Victims and Administrators

  • Users: Notice stopped refrigerated and frozen display cases, removed goods, rising temperatures, and interrupted store services.
  • Administrators: Observe remote sessions, configuration changes, defrost commands, temperature alarms, and anomalies in controller or service provider connections.

6. Success and Failure Conditions

Success Conditions

  • Established remote access to the controller or management service.
  • The attacker obtains privileges to modify defrost and temperature control settings.
  • Inability to immediately detect and override operations on-site.

Failure Conditions and Mitigations

  • Keep management interfaces private from the internet, restricting access to trusted management networks or VPNs.
  • First, identify the device models, firmware versions, and maintenance statuses. While official patches should be applied to known vulnerabilities in the AK-SM8xxA series, R4.3.1 cannot be treated as universally applicable to the legacy AK-SM800 or AK-SC355 models reported here. For devices lacking updates, consider isolating or disconnecting remote access and replacing the hardware.
  • Automatically stop equipment and trigger notifications for temperature or defrost anomalies using local safeguards.

7. Impact of Successful Exploitation

  • Refrigeration shutdowns and food waste across 250 to 350 stores.
  • Financial losses and broken cold chains. The causal link to fires remains under investigation.
  • Disruption to the business operations of food retailers and service providers.

8. Observable Logs

The following items are candidates for internal investigation. Distinguish between facts confirmed in public reports and telemetry that organizations must verify internally.

  • Email: No email vectors specific to this incident have been confirmed.
  • Proxy / SWG / DNS: Check for remote access to StoreView or controller management interfaces, requests to xml.cgi, and abnormal configuration requests.
  • Endpoint / EDR: Check for modifications to controller firmware, defrost schedules, temperature thresholds, user accounts, and notification settings.
  • Identity / IdP: Verify remote maintenance accounts, service provider accounts, code-of-the-day or admin sessions, and VPN logins.
  • SaaS / Cloud: Check service provider portals, remote management platforms, and ticketing or maintenance records.
  • Network: Monitor for sessions from the internet to controllers, simultaneous operations across multiple stores, and abnormal scans from remote sites.

9. Determining Attack Success

Confirmed in Public Information

  • Subsequent Compromise Confirmed: Refrigeration shutdowns, temperature rises caused by defrost commands, and food waste confirmed across multiple retail chains. Fires were also reported, but their connection to the attack is under investigation.

Internal Evaluation Criteria

  • Correlate requests, responses, processes, authentication, data access, and outbound traffic chronologically to separate contact from successful compromise.
  • Do not conclude that an attack succeeded based solely on a single alert.

10. Investigation Playbook

  • Investigation Triggers: Start from simultaneous defrost events, temperature alarms, offline controllers, or service provider incidents.
  • Initial Verification: Identify affected stores, controller models and firmware, remote access paths, defrost schedules, and operator accounts.
  • Endpoint and Server Investigation: Preserve controller configurations, firmware images, web and audit logs, local HMIs, and sensor histories.
  • Authentication and Cloud Investigation: Check maintenance vendors, VPNs, local administrators, shared accounts, and credential modifications.
  • Subsequent Actions: Track simultaneous operations across multiple stores, exploitation of Nginx or SMTP settings, pivoting to IT networks, and data access.
  • Containment: Cut off remote access, switch to local control, execute temperature safety procedures, update firmware, and rotate credentials.
  • Classification: Distinguish between initial access, controller control, defrost execution, temperature deviations, and food or fire damage.

11. Defense and Detection Ideas

  • Single Events: Detect unexpected defrost commands, temperature threshold changes, code-of-the-day logins, and abnormal xml.cgi requests.
  • Chronological Correlation: Correlate remote logins, configuration changes, defrosts, temperature rises, and alarm suppression or device offline events.
  • Threat Hunting: Search for internet-exposed AK-SM 800A units, legacy firmware, shared maintenance accounts, and multi-store operations occurring simultaneously.
  • Log Limitations: IT SIEMs alone will miss controller commands and physical processes, making OT telemetry and sensor data necessary.
  • Priority Mitigations: Prioritize stopping internet exposure, applying official patches to AK-SM8xxA series devices, isolating or disconnecting legacy or unpatchable devices from remote access, strictly controlling maintenance vendor access, enforcing temperature safety measures, and segmenting store networks.

12. Facts / Inference / Hypothesis

Facts

  • On the night of October 11, 2026, an attacker remotely operated refrigeration controllers running legacy Danfoss control software, triggering the built-in automatic defrost function.
  • Reports indicate that 250 to 350 stores were affected, including Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U.
  • Temperature increases caused fresh and frozen food waste and financial losses, and the Paris prosecutor is investigating a possible link between the food loss and reported fires.
  • Predicta Lab identified 2,752 Danfoss systems exposed on the internet, reporting 1,590 located in France. Shodan is tracking over 4,500 units.
  • CVE-2025-41450 is an authentication bypass abusing the code-of-the-day mechanism, CVE-2025-41451 is post-authentication RCE via command injection, and CVE-2025-41452 is a DoS via Nginx configuration manipulation.
  • According to Danfoss official information, CVE-2025-41450 is patched in version 4.2 for AK-SM8xxA series controllers, and CVE-2025-41451/41452 are patched in version 4.3.1. It has not been confirmed whether these CVEs were used in this attack.
  • No evidence that these CVEs were used in this incident has been published, and the initial access method remains unknown.

Inference

  • While internet-exposed legacy controllers represent a realistic entry point, it cannot be determined whether the current impact stems from a service provider compromise, credential abuse, or known CVEs.
  • The correlation between defrost commands and temperature alarms serves as evidence of successful OT manipulation that may be missed by IT alerts alone.

Hypothesis

No additional hypotheses. Unverified items are listed in "Open Questions and Further Investigation."

13. MITRE ATT&CK

ID Technique Confidence Basis
T0831 Manipulation of Control high The attacker remotely operated the refrigeration controller's defrost function to raise temperatures.

14. Open Questions and Further Investigation

  • Discrepancies exist in source data regarding the number of affected stores; it is unclear whether reports of 250 to 350 stores align with figures obtained by AFP from individual companies in terms of scope, aggregation timestamps, and confirmed damage ranges.
  • The initial access method and the relationship between compromised service providers and Danfoss controllers.
  • Whether CVE-2025-41450, CVE-2025-41451, or CVE-2025-41452 were utilized.
  • The exact number of affected stores and controllers, the identity of the attacker, their objectives, and recovery status.

15. Impact on SOCs and Organizations

Supermarkets, refrigerated warehouses, and food logistics facilities should note that internet-exposed refrigeration control systems and remote maintenance services carry similar physical risks. Create asset inventories of device models and generations, update AK-SM8xxA series devices with official patches, and isolate or disconnect legacy or unpatchable equipment from remote access. Monitoring defrost instructions and temperature anomaly alarms across equipment and SOCs is critical.

16. Target Audience Summaries

  • SOC Teams: Correlate remote logins and configuration changes with defrost commands, temperature alarms, and device offline events using IT and OT logs.
  • Administrators: Inventory target devices, apply official patches to AK-SM8xxA series units, and isolate management planes of legacy equipment from the internet.
  • Users: Follow guidance regarding store refrigeration equipment anomalies and product removal notices, and refrain from purchasing or consuming food with uncertain temperature management.

Top comments (0)