No zero-day in the French supermarket refrigeration attack

What the record shows

The controllers were reachable from the internet and a valid login was enough. A defrost cycle is an ordinary administration function on a Danfoss AK-SM or AK-SC controller, not a hidden path through broken code. Somebody signed in and set it running continuously with the setpoint at fifty degrees.

France's own incident response team described the problem that way overnight. CERT-FR's bulletin CERTFR-2026-ALE-012 is about the exposure of a management interface, and its remedy is two words: disconnect, or filter. ANSSI's director said the same on the night: disconnect everything that can be disconnected, or apply a very restrictive filtering policy, until more is known.

The damage was physical and quick. Staff arriving on Monday morning met heat coming out of the freezer aisles, stock thrown away on food-safety grounds, small fires reported, and one ice-cream freezer photographed at 26.5 °C. Le Monde's reporting carries the detail that settles intent: the defrost window was stretched from an hour to eight, so the alarms would fire late.

The count matters too. The chains' own figures put it at roughly four hundred stores out of about fifteen thousand in France. Large, but not the national shutdown some of the coverage implied.

Danfoss split the affected kit in its own statement: end-of-life controllers that no longer receive software or security updates, and current models on units that had simply not been updated. One is a migration problem and the other is a contract problem, and both belong to the shop.

The research that gets attached to this story deserves a boundary. Claroty's work covers the current AK-SM 800A, the flaws it found were fixed in firmware and never applied on some sites, and the team counted 2,765 management interfaces reachable from the internet. A link between those published flaws and this incident has not been established, and the reporting that implies one is going further than the evidence.

What it means if you run the estate

The exposure is the finding. An estate can be compromised through a login and a setting that were always there, on equipment nobody classified as a computer. If the only control between the internet and a plant room is a password set at commissioning, the security question is not whether the software has bugs. It is who holds that login and why the console answers from outside at all.

Sources

• CERT-FR, CERTFR-2026-ALE-012 (the disconnect-or-filter bulletin)
• next.ink, the analysis that reframes the story
• heise online, the incident and the Paris prosecutor
• L'Express, the counts and Le Monde's eight-hour detail
• Claroty Team82, the controller research (not linked to the incident)
• Danfoss advisory DSA-2025-03-01