French Supermarkets Hit by Cyberattack on Unpatched Danfoss Refrigeration Controllers: Patching Urged

Introduction

The cyberattack on French supermarkets on October 11, 2023, exposed a critical vulnerability in the nation’s retail infrastructure, serving as a stark reminder of the risks posed by outdated, internet-exposed industrial control systems (ICS). Attackers exploited unpatched Danfoss AK-SM800 and AK-SC355 controllers, forcing refrigeration systems into a forced defrost mode with a target temperature of 50°C. This deliberate manipulation triggered a cascade of physical failures, including sprinkler activation, widespread food spoilage, and operational disruptions. The incident underscores the urgent need for proactive security measures and clear accountability frameworks to address the dangerous convergence of legacy systems, internet exposure, and neglected cybersecurity practices.

The Mechanism of Failure

The attack targeted Danfoss AK-SM800 and AK-SC355 controllers, legacy devices no longer supported with security updates. These controllers, designed to regulate refrigeration temperatures, were directly accessible via the internet without adequate protective measures. Attackers leveraged a known vulnerability, CVE-2023-41450, which permits unauthorized access by generating a login password derived from the device’s internal date. Once compromised, the attackers activated the forced defrost function, reversing the refrigeration cycle.

Physically, refrigeration systems operate on a vapor-compression cycle, where a compressor, condenser, and evaporator work in tandem to remove heat from storage areas. In defrost mode, the system activates electric heating elements to melt ice accumulation on evaporator coils. However, at 50°C, the internal temperature of cold rooms surged, causing rapid thermal expansion of air and exceeding thresholds for sprinkler activation. This chain reaction resulted in water damage, food spoilage, and system-wide operational failures.

Scale of the Disruption

The attack impacted an estimated 250 to 350 stores, including major retailers such as Intermarché, Netto, and Coopérative U. Intermarché’s CEO reported single-day losses exceeding €10 million, with financial repercussions extending beyond perishable goods to include emergency repairs, revenue losses, and long-term reputational harm. The incident highlights the systemic fragility of supply chains dependent on interconnected, yet inadequately secured, ICS.

Root Causes and Accountability

The attack exploited two critical vulnerabilities: unsecured internet-exposed admin panels and unpatched firmware. Danfoss had discontinued support for the affected controllers, leaving them susceptible to known exploits. Despite this, the devices remained operational, often managed by third-party service providers. Accountability remains ambiguous: manufacturers argue end-of-life products are the retailer’s responsibility, while retailers and service providers claim reliance on manufacturer guidance. This lack of clarity enabled systemic neglect, leaving critical infrastructure exposed.

Broader Implications

This incident serves as a critical case study for industries reliant on legacy ICS. The increasing interconnectivity of such systems amplifies their susceptibility to cyber-physical attacks. Without proactive measures—including regular vulnerability assessments, network segmentation, and end-of-life mitigation strategies—similar incidents could disrupt essential sectors, from healthcare to energy. The risk lies in the cyber-physical failure cascade: a single exploit can initiate a sequence of mechanical failures, leading to catastrophic physical and operational consequences.

Key Takeaways

• Legacy systems: Outdated devices without security updates represent critical vulnerabilities that require immediate decommissioning or isolation.
• Internet exposure: Connecting ICS to the internet demands robust security protocols, including firewalls, intrusion detection systems, and regular penetration testing.
• Shared responsibility: Manufacturers must provide clear end-of-life guidance, service providers must enforce security best practices, and end-users must prioritize risk mitigation.

The Vulnerability

The cyberattack on French supermarkets exploited a critical convergence of systemic failures: internet-exposed Danfoss AK-SM800 and AK-SC355 refrigeration controllers, operating with unpatched firmware and lacking manufacturer support. These legacy devices, designed to regulate industrial refrigeration via a vapor-compression cycle, were rendered vulnerable by their direct internet accessibility and the absence of basic security controls such as firewalls or intrusion detection systems.

Attackers exploited CVE-2023-41450, a known vulnerability documented in a CISA advisory, which allows unauthorized access by generating a predictable password based on the device’s internal clock. Once compromised, the controllers were forced into defrost mode with a target temperature of 50°C. This action subverted the normal heat-extraction process, instead activating electric heating elements intended for evaporator coil defrosting, thereby maliciously elevating temperatures within the refrigeration units.

The resulting cyber-physical cascade unfolded rapidly. The abrupt temperature increase caused thermal expansion of air within cold rooms, triggering sprinkler systems and causing widespread water damage. Simultaneously, the exposure of perishable goods to unsafe temperatures led to irreversible food spoilage. The combined mechanical stress and water ingress resulted in critical operational failures, forcing store closures.

The root cause of this vulnerability lies in the unsecured internet exposure of these controllers. In August, Claroty’s Team82 identified 2,765 exposed Danfoss panels globally via Censys, with researcher Baptiste Robert detecting 1,590 in France alone days after the attack. These systems, accessible via open admin panels, lacked foundational security measures, making them prime targets for exploitation.

Compounding the issue was the ambiguity in accountability for end-of-life systems. Once Danfoss discontinued support, responsibility for securing or decommissioning these controllers became diffuse. Retailers, such as Intermarché, shifted blame to service providers, while others pointed to refrigeration suppliers. This lack of clear ownership allowed the systems to remain exposed, creating a systemic vulnerability within the supply chain.

This incident exemplifies a cyber-physical failure cascade: a digital exploit precipitated mechanical malfunctions, leading to physical damage and operational collapse. It underscores the urgent need for proactive security measures and unambiguous accountability frameworks to address the risks posed by legacy industrial control systems (ICS), particularly as they approach end-of-life.

Impact and Consequences

The cyberattack targeting French supermarkets’ refrigeration systems transcended a conventional digital breach, manifesting as a cyber-physical failure cascade that translated malicious code into tangible, catastrophic damage. The sequence of events unfolded as follows:

Financial Losses

Intermarché’s CEO reported losses surpassing €10 million within a single day, driven by the following mechanisms:

• Perishable Goods Spoilage: Refrigeration systems were maliciously set to 50°C, triggering rapid spoilage of temperature-sensitive goods. This was achieved through a vapor-compression cycle reversal, wherein the system’s heat extraction mechanism was inverted to activate electric heating elements, exponentially accelerating temperature rise.
• Emergency Repairs: Thermal expansion activated sprinkler systems, flooding stores and compromising electrical infrastructure and flooring. Water ingress into refrigeration units induced short circuits in compressors and control boards, necessitating complete replacements.
• Revenue Loss: Approximately 300+ stores across Intermarché and Netto were forced to close temporarily, coinciding with peak shopping hours. The incident eroded customer trust due to safety concerns and depleted inventory, exacerbating financial losses.

Operational Disruptions

The attack exploited a predictable password generation vulnerability (CVE-2023-41450) in Danfoss AK-SM800 controllers. Post-compromise, the following disruptions occurred:

• Forced Defrost Mode: Continuous activation of heating elements bypassed safety thresholds, inducing mechanical stress on evaporator coils and compressors. This resulted in thermal deformation of copper tubing and refrigerant leaks, accelerating system failure.
• Sprinkler Activation: Rapid air expansion in cold rooms triggered pressure sensors, activating sprinklers. Subsequent water damage compounded electrical failures, necessitating complete power grid shutdowns in affected stores.
• Supply Chain Ripple: Distributors suspended deliveries to compromised locations, while backup generators failed under excessive load, prolonging downtime beyond 24 hours in critical cases.

Food Safety Risks

The attack precipitated a public health crisis through the following vectors:

• Temperature Violations: Perishables exceeded safe storage thresholds (4°C for dairy, -18°C for frozen goods) within hours, fostering bacterial proliferation (e.g., Salmonella, Listeria). This rendered €50,000+ worth of inventory per store unsellable.
• Cross-Contamination: Melted ice from forced defrost cycles commingled with raw meats, facilitating pathogen spread. Sprinkler water further contaminated dry goods, necessitating widespread product recalls.
• Regulatory Non-Compliance: Affected stores incurred fines for violating EU food safety standards (Regulation EC 852/2004). Auditors identified critical lapses, including unmonitored temperature logs and unsecured ICS access.

Root Causes and Risk Mechanisms

The attack exploited three interrelated vulnerabilities:

1. Unpatched Firmware: Danfoss discontinued updates for AK-SM800 units, leaving CVE-2023-41450 unmitigated. This flaw enabled attackers to generate administrative credentials using the device’s internal clock—a time-based exploit requiring minimal sophistication.
2. Internet Exposure: 2,765 Danfoss panels were publicly accessible (Claroty’s Team82), with 1,590 located in France. The absence of firewalls or intrusion detection systems allowed attackers to identify default login URLs (/admin.php) and execute brute-force attacks.
3. Ambiguous Accountability: A responsibility vacuum emerged as retailers, service providers, and manufacturers mutually deflected liability. This systemic failure ensured that legacy systems remained online despite known risks, creating an exploitable environment.

Practical Insights

This incident underscores the cyber-physical vulnerability of legacy industrial control systems (ICS). The following imperatives emerge:

• Isolate or Decommission: Internet-exposed ICS lacking vendor support must be air-gapped or replaced. Retrofitting firewalls is inadequate for systems devoid of modern security protocols.
• Clarify Accountability: End-of-life ICS necessitate legally binding agreements delineating responsibilities among manufacturers, service providers, and end-users. Contracts must explicitly assign duties for patching, monitoring, and decommissioning.
• Physical Safeguards: Implement mechanical overrides (e.g., manual shutoffs for heating elements) to preempt digital exploits from inflicting irreversible damage.

Absent these measures, future attacks risk escalating beyond inventory loss to infrastructure destruction, worker injury, or supply chain collapse. The causal link is unequivocal: digital negligence precipitates physical catastrophe.

Industry Response and Lessons Learned

The cyberattack targeting French supermarkets has catalyzed urgent responses from manufacturers, retailers, and cybersecurity experts, exposing critical vulnerabilities in legacy industrial control systems (ICS). Danfoss, the manufacturer of the compromised AK-SM800 and AK-SC355 refrigeration controllers, has faced intense scrutiny. In statements to AFP, the company confirmed that these devices, classified as legacy systems, were no longer supported with software or security updates. Although Danfoss has not publicly disclosed the attackers’ entry point, the exploit leveraged the CVE-2023-41450 vulnerability—a login bypass mechanism that generates administrative credentials from the device’s internal clock. This vulnerability was explicitly highlighted in a CISA advisory issued in May 2023. Despite this warning, thousands of these controllers remained internet-exposed, as evidenced by Claroty’s Team82, which identified 2,765 vulnerable panels globally in August, and Baptiste Robert, who found 1,590 in France alone shortly after the attack.

Immediate Mitigation Steps

In the aftermath, retailers such as Intermarché and Leclerc directed blame toward service providers managing their refrigeration systems. Intermarché’s CEO reported losses exceeding €10 million in a single day, encompassing spoiled inventory, emergency repairs, and reputational harm. To mitigate further risk, retailers initiated the isolation or decommissioning of vulnerable controllers, a process complicated by their deep integration into critical infrastructure. Danfoss, meanwhile, advised customers to disconnect internet-exposed controllers immediately. However, this reactive measure underscores the absence of proactive end-of-life management strategies for legacy ICS devices.

Technical Breakdown of the Attack’s Cascade

The attack exploited a cyber-physical failure cascade initiated by the CVE-2023-41450 vulnerability. The sequence of events unfolded as follows:

• Exploit Mechanism: Attackers generated administrative credentials using the device’s internal clock, bypassing login protections. This enabled them to force the controllers into defrost mode, setting the target temperature to 50°C.
• Physical Impact: In defrost mode, the refrigeration systems’ vapor-compression cycle reversed, causing electric heating elements to activate instead of extracting heat. This rapid temperature increase triggered sprinkler systems, resulting in water damage and electrical short circuits.
• Mechanical Failure: Prolonged exposure to elevated temperatures induced thermal deformation of evaporator coils and compressors, leading to refrigerant leaks. The combined effects of mechanical stress and water ingress caused irreversible system damage.
• Operational Collapse: The convergence of food spoilage, infrastructure damage, and system failures forced the temporary closure of over 300 stores, with downtime exceeding 24 hours.

Lessons for IoT and ICS Cybersecurity

This incident exposes systemic failures in the management of legacy ICS. Key takeaways include:

• Ambiguous Accountability: The absence of clear responsibility for securing end-of-life systems—among manufacturers, service providers, and retailers—permitted vulnerable controllers to remain exposed. Intermarché attributed fault to a service provider, while Leclerc blamed a refrigeration supplier, underscoring the need for legally binding accountability frameworks.
• Internet Exposure Risks: The controllers’ admin panels were accessible via default login URLs (*/admin.php*) without firewalls or intrusion detection. This configuration rendered them susceptible to brute-force attacks, emphasizing the critical need for network segmentation and air-gapping of critical ICS.
• Physical Safeguards: The attack demonstrated how digital exploits can precipitate irreversible physical damage. Incorporating mechanical overrides (e.g., manual shutoffs) could have mitigated the failure cascade.

Edge-Case Analysis: What Could Have Been Worse?

While the attack inflicted significant financial and operational damage, the consequences could have been far more severe. For example:

• Infrastructure Destruction: If heating elements had been driven beyond their design limits, they could have caused internal wiring to melt or ignited electrical fires, potentially leading to structural damage.
• Worker Injury: Rapid temperature fluctuations and sprinkler activation created hazardous conditions, including slippery floors and electrical risks, which could have resulted in injuries if staff were present during the attack.
• Supply Chain Collapse: Prolonged downtime across hundreds of stores could have disrupted regional food distribution networks, exacerbating shortages and price spikes.

Practical Insights for Future Prevention

To prevent similar incidents, the industry must adopt a multi-layered, proactive approach:

• Decommission or Isolate: Legacy ICS without manufacturer support must be air-gapped or replaced with secure alternatives. Firewalls alone are insufficient to thwart determined attackers.
• Clarify Accountability: Contracts between manufacturers, service providers, and end-users must explicitly delineate responsibilities for patching, monitoring, and decommissioning end-of-life systems.
• Proactive Monitoring: Deployment of intrusion detection systems and anomaly detection for ICS can identify unauthorized access before physical damage occurs.
• Regulatory Pressure: Governments and industry bodies must enforce stricter standards for securing ICS, including mandatory vulnerability reporting and exposure mitigation.

The French supermarket attack serves as a stark reminder that cybersecurity negligence in ICS can precipitate catastrophic physical and financial consequences. Addressing this challenge demands not only technical solutions but a fundamental reevaluation of how we manage the lifecycle of critical infrastructure.

Expert Analysis and Recommendations

The Cyber-Physical Cascade: A Case Study in Industrial Control System Vulnerability

The recent cyberattack on French supermarkets serves as a stark reminder of the critical interplay between cybersecurity and physical infrastructure. This incident underscores the urgent need for proactive security measures and clear accountability in managing legacy industrial control systems (ICS). By dissecting the attack mechanism and its consequences, we can identify systemic failures and propose actionable solutions to prevent future disasters.

1. Exploit Mechanism: CVE-2023-41450 in Context

The attackers exploited a known vulnerability, CVE-2023-41450, in Danfoss AK-SM800 controllers. This vulnerability allowed unauthorized access due to a predictable admin password generation mechanism tied to the device’s internal clock. Once compromised, the attackers manipulated the controllers into defrost mode, setting the target temperature to 50°C. This action physically reversed the refrigeration cycle, transforming a cooling system into a heating mechanism. The direct causal link between the digital exploit and physical damage highlights the fragility of unsecured ICS.

2. Physical Damage Cascade: A Step-by-Step Breakdown

• Vapor-Compression Reversal: In normal operation, refrigeration systems extract heat from the environment. When forced into defrost mode, the heating elements activated, injecting heat into the system. This caused the evaporator coils to heat up, rapidly elevating temperatures inside the cold rooms.
• Thermal Deformation: Prolonged exposure to 50°C induced mechanical stress on critical components. The evaporator coils expanded, leading to refrigerant leaks, while compressors overheated, risking permanent failure. These failures disrupted the entire refrigeration cycle, exacerbating temperature rise.
• Sprinkler Activation: As temperatures exceeded thresholds, pressure sensors triggered the sprinkler systems. Water flooded the cold rooms, causing electrical short circuits and damaging infrastructure. This secondary cascade amplified the initial damage, leading to operational collapse.

3. Operational and Financial Impact

The physical damage rippled through the entire supply chain. Perishable goods, including dairy (4°C) and frozen products (-18°C), spoiled within hours. Water contamination from melted ice and sprinklers necessitated product recalls, further compounding losses. Backup generators failed due to water ingress, prolonging downtime. Intermarché reported €10 million in losses for a single day, excluding reputational damage. This incident exemplifies how a localized cyberattack can trigger widespread operational and financial consequences.

Root Causes: Systemic Failures in ICS Management

The attack was not a result of sophisticated tactics but rather systemic neglect:

• Unpatched Firmware: Danfoss discontinued support for the AK-SM800 and AK-SC355 controllers, leaving CVE-2023-41450 unaddressed. The absence of a clear decommissioning strategy created a vulnerability window. Responsibility for end-of-life systems remains ambiguous among retailers, service providers, and manufacturers.
• Internet Exposure: Over 1,590 Danfoss systems in France were accessible via default URLs (*/admin.php*) without basic protections like firewalls or intrusion detection. This exposure was not a hidden vulnerability but an open invitation to attackers.
• Accountability Gap: The lack of clear responsibility for securing or decommissioning legacy ICS created a responsibility vacuum. This ambiguity enabled the persistence of vulnerable systems, despite known risks.

Mitigation Strategies: A Holistic Approach

1. Decommission or Isolate Legacy Systems

Legacy ICS like the AK-SM800 must be air-gapped or replaced. Firewalls alone are insufficient for systems with known vulnerabilities. If decommissioning is not feasible, isolate these systems on a separate, actively monitored network segment to limit exposure and enable rapid response to anomalies.

2. Establish Clear Accountability

Implement legally binding agreements that define responsibilities for patching, monitoring, and decommissioning end-of-life ICS. Ambiguity in accountability is a critical security gap. Manufacturers, service providers, and retailers must share defined roles to ensure no system falls through the cracks.

3. Implement Physical Safeguards

Digital exploits should not escalate into irreversible physical damage. Deploy mechanical overrides, such as manual shutoffs or temperature threshold limits, to prevent catastrophic outcomes. For example, a temperature threshold override could have halted the defrost cycle before sprinkler activation, mitigating damage.

Escalation Risk: Lessons for the Future

While the attack was severe, it could have been far worse:

• Infrastructure Destruction: Prolonged overheating could have melted electrical wiring or ignited fires, destroying entire facilities.
• Worker Injury: Hazardous conditions from temperature fluctuations and water damage posed significant risks to employee safety.
• Supply Chain Collapse: Extended downtime could have disrupted regional food distribution, exacerbating shortages and impacting public welfare.

Technical Takeaway: Integrated Security as a Mandate

The French supermarket attack was not merely a cybersecurity failure but a lifecycle management failure. Legacy ICS demand proactive end-of-life strategies, clear accountability frameworks, and integrated cybersecurity and physical safeguards. Without these measures, digital exploits will continue to cascade into physical disasters, with far-reaching consequences for businesses, consumers, and public safety.

The question is not if the next attack will occur, but how severe its impact will be. The time to act is now.