Danfoss controllers hit with remote defrost trigger across 400 French stores

The incident centered on exposed Danfoss AK-SC and related controllers running unpatched firmware. Retailers confirmed the systems were managed centrally through Danfoss infrastructure; attackers triggered the defrost function while the units continued reporting normal temperatures to local staff. ANSSI stated it was coordinating at national and EU level but released no IOCs or attribution details.

CISA advisory ICSA-23-040-01 and subsequent Claroty Team82 research documented three remotely exploitable flaws in the same product line, including authentication bypass and command injection. Shodan and Censys scans at the time showed over 2,700 Danfoss devices reachable from the public internet; many still run the vulnerable firmware versions identified in the 2023 disclosure. No public evidence ties the French event to the exact CVEs, yet the attack path matches the published weaknesses.

Food cold-chain systems are now treated as high-value targets because disruption produces immediate physical loss rather than data theft. The absence of ransomware notes or payment demands suggests testing or low-sophistication actors probing supplier-managed OT networks. Groupement Mousquetaires deferred complaints to Danfoss, leaving the supplier responsible for law-enforcement engagement.

Recovery timelines remain unclear. Retailers must either isolate the controllers from the internet or force firmware upgrades that Danfoss has not yet confirmed are available for the affected legacy models. Expect similar low-noise attacks on other European cold-chain vendors within 60 days if the exposed device population is not reduced.