Date: October 12, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Operational Technology (OT) / ICS Security / Critical Infrastructure / Cyber-Physical Attacks / Supply Chain Sabotage
Tags: Danfoss, AK-SM 800A, Supermarket Cyberattack, France, Intermarche, Claroty Team82, OT Security, Modbus, Defrost Attack, Critical Infrastructure
Executive Summary
In an unprecedented cyber-physical sabotage operation against the commercial retail food sector, cyber adversaries struck hundreds of supermarket locations across France overnight on October 11–12, 2026. The attackers remotely compromised commercial refrigeration systems, taking industrial chillers offline and intentionally triggering aggressive defrost heating cycles that raised temperatures in commercial freezers to 50°C (122°F).
As reported by BleepingComputer, The Next Web (TNW), Infosecurity Magazine, and The Journal, the attack targeted prominent French retail chains—including Groupement des Mousquetaires (Intermarché) and partner supermarkets—forcing widespread store closures, total disposal of ruined meat and dairy inventories, and millions of euros in direct financial losses.
The intrusion was carried out by weaponizing internet-exposed Danfoss AK-SM 800A System Managers, the central industrial control units governing supermarket refrigeration racks. The adversaries exploited architectural weaknesses previously exposed by security researchers at Claroty Team82, including unauthenticated web management endpoints, weak access controls, and unsegmented fieldbus communication. By overriding cooling setpoints and silencing automated alarm notifications, the threat actors executed widespread food spoilage without triggering alert thresholds until supermarket employees discovered warm display cases the following morning.
Technical Deep-Dive: Architecture, Fieldbus Hijacking, and The Defrost Exploit
To understand how an external network attacker can induce physical thermal sabotage across a retail enterprise, we analyze the operational architecture of Danfoss System Managers, the Modbus fieldbus protocol, and the sabotage execution chain.
Step
Attack Phase
Target System
Action & Operational Impact
1
Reconnaissance
Internet / Broadband Routers
Scans French retail IP ranges for exposed Danfoss HTTP (80) and Modbus TCP (502) ports.
2
Initial Access
Danfoss AK-SM 800A
Bypasses weak web authentication using unauthenticated API endpoints and default engineering credentials.
3
Parameter Injection
Controller Logic
Overwrites operational parameters: sets Defrost_Force = TRUE and Defrost_Termination_Temp = 50°C.
4
Telemetry Suppression
Alarm Subsystem
Silences SMS/email alert relays and mutes high-temperature threshold triggers.
5
Fieldbus Dispatch
RS-485 / Modbus RTU
Translates IP commands to serial fieldbus, commanding evaporator heaters on store floors to fire.
6
Thermal Sabotage
Store Freezers & Chillers
Shuts down refrigerant flow and powers electric defrost coils; freezers heat from -20°C to +50°C.
7
Physical Impact
Retail Inventory
Causes massive food spoilage across tens of tons of inventory, forcing store closures across France.
1. The Component: Danfoss AK-SM 800A System Manager Architecture
In modern supermarket operations, refrigeration is not controlled by simple standalone thermostats; it is governed by centralized industrial automation:
* The Role of the System Manager: The Danfoss AK-SM 800A serves as the primary brain for supermarket refrigeration, HVAC, and energy monitoring. It coordinates multi-compressor refrigeration packs, electronic expansion valves, and evaporator defrost cycles.
* Protocol Bridging: The controller bridges higher-level corporate building management systems (communicating over Ethernet via HTTP, Modbus TCP, and BACnet/IP) with low-level field devices on the store floor (communicating via RS-485 serial links over Modbus RTU or LonWorks).
* The Internet Exposure Problem: To enable remote service diagnostics, energy optimization, and contractor maintenance, refrigeration controllers are frequently connected to store broadband routers or cellular modems with public IPv4 addresses, often lacking basic firewall rules or VPN barriers.
2. The Vulnerability Chain: Weaponizing Claroty Team82 Discoveries
The attack mirrors research previously published by Claroty Team82 ("Freeze the Controller, Defrost the Food"):
* Authentication Bypasses & Weak Credentials: The AK-SM 800A web interface contains legacy diagnostic routines and APIs that allow unauthenticated configuration reads or use standardized "Code-of-the-Day" engineering authentication schemes. Furthermore, many retail installations leave factory-default installer credentials unchanged.
* Remote Configuration Overwrites: Once authenticated to the web interface or communicating over unprotected Modbus TCP (port 502), the controller permits full read/write access to internal holding registers governing refrigeration logic.
3. The Sabotage Mechanism: Forced Defrost Heating Loops
In standard commercial refrigeration, cooling coils naturally accumulate ice. To clear frost, controllers periodically execute a controlled "defrost cycle":
* Standard Defrost Cycle: The controller shuts off liquid refrigerant flow to the evaporator and briefly activates small electric heating elements or circulates hot gas for 10 to 15 minutes, terminating the cycle once coil temperatures reach approximately 4°C to 10°C to preserve frozen inventory stored at -18°C.
* Weaponized Defrost Execution: The attackers issued bulk configuration commands overriding standard safety parameters:
1. Forced immediate defrost state on all connected cold-storage circuits simultaneously.
2. Overrode the Defrost Termination Temperature parameter, setting the cutoff ceiling to an extreme 50°C (122°F).
3. Disabled safety timeout watchdogs, keeping high-voltage heating coils energized for hours.
* Alarm Suppression: Crucially, the attackers suppressed external alarm relays. Under normal conditions, a thermal spike above -10°C would trigger emergency dial-out alerts to regional facility managers. By modifying notification registers, the attack ensured that freezer alarms remained silent, allowing food to thaw and spoil undetected throughout the night.
Industry Impact on Food Safety & Critical Commercial Infrastructure
The French supermarket cyberattack illustrates the catastrophic potential of cyber-physical attacks against commercial Operational Technology (OT):
* Food Security & Public Health Threat: Cold chain integrity is strictly regulated under European food safety standards. When temperatures exceed safe thresholds, raw meat, dairy, and seafood rapidly cultivate bacterial pathogens (e.g., Salmonella, Listeria), requiring total destruction of hundreds of tons of food.
* Severe Economic Damage: Beyond the millions in spoiled inventory, stores faced days of lost revenue, emergency sanitization costs, refrigeration technician shortages, and severe reputational damage.
* The "Invisible OT" Blindspot: Corporate cybersecurity teams routinely monitor enterprise endpoints and cloud workloads, yet building management systems (HVAC, chillers, power distribution) are frequently outsourced to facilities contractors operating without basic cybersecurity hygiene.
Defensive Hardening Blueprint & Remediation Strategies
Facilities managers, retail enterprise CISOs, and OT security engineers must enforce immediate compensating controls to protect cold-chain and building automation infrastructure:
1. Immediately Disconnect OT Controllers from the Public Internet
* Zero Public Exposure: Industrial controllers, including Danfoss AK-SM series, should never be directly accessible from the public internet.
* Enforce Private VPN / ZTNA Architecture: All remote vendor access and management must occur through a secure, enterprise-managed Virtual Private Network (VPN) or Zero Trust Network Access (ZTNA) gateway enforcing phishing-resistant Multi-Factor Authentication (MFA).
2. Firmware Upgrades & Credential Hardening
* Apply the latest firmware updates released by Danfoss for AK-SM 800A and legacy AK-SM 800 series controllers.
* Mandate the replacement of all default manufacturer, technician, and installer passwords with unique, complex passphrases.
* Disable legacy unencrypted protocols (HTTP, Telnet) in favor of secure alternatives (HTTPS, SSH).
3. Network Microsegmentation on Retail Store Floors
* Isolate refrigeration and building management systems into a dedicated, air-gapped or firewalled OT VLAN.
* Block all inter-VLAN routing between the refrigeration network and public guest Wi-Fi, point-of-sale (POS) terminal networks, and corporate office workstations.
4. Independent, Out-of-Band Temperature Monitoring
To protect against controller blinding:
* Deploy independent, battery-powered IoT temperature loggers connected via separate cellular or LoRaWAN networks directly to external cloud monitoring platforms.
* Configure alerting thresholds that trigger immediate SMS/phone escalations to on-call facility managers if temperatures exceed critical limits, independent of the primary refrigeration controller's state.
For industrial cybersecurity teardowns, OT threat intelligence, and cyber-physical infrastructure defense guides, subscribe to Digital Spying.