The Fridge Was the Attack Surface: What the French Supermarket Hack Teaches SMEs About Equipment You Forgot You Own

What Actually Failed

The compromised equipment was refrigeration controllers — chiefly Danfoss AK-SM and AK-SC series devices that manage cooling and defrost cycles in food retail. Three conditions came together:

• The controllers' web interfaces were reachable from the public internet. In the days after the attack, researchers counted thousands of internet-facing Danfoss controller interfaces, more than half of them in France. These are management interfaces that were never meant to face the open internet.
• Known, published weaknesses. In March 2025, researchers at Claroty disclosed that the current AK-SM 800A platform accepted a "code of the day": a code derived from the device's date that bypassed the configured administrator password entirely (CVE-2025-41450). A command-injection flaw followed (CVE-2025-41451). CISA published an advisory in May 2025 and updated it in August 2025; Danfoss fixed the bypass in release R4.2 and shipped firmware 4.3.1 in August 2025.
• Nothing was updated. Danfoss stated that most affected devices were obsolete models — the AK-SM800 and AK-SC355, out of support since 2021 and 2016 respectively — and that the current AK-SM 800A units involved were running outdated firmware.

Investigators have not confirmed which flaw the attackers actually used. But the conditions — exposed interfaces, a published password bypass, unpatched and end-of-life devices — describe a target that required little sophistication to find and compromise.

"It's Just a Fridge Controller" Is Exactly How It Gets In

No supermarket chain listed its defrost controllers among its crown jewels. That is the point. Embedded and operational-technology (OT) equipment — refrigeration, HVAC, access control, building management, production-line controllers — tends to fall outside the IT asset register. It is installed by a vendor, maintained by a service provider, connected to the network for remote support, and then forgotten.

The "we're too small to be a target" argument fails for the same reason. The exposed interfaces were found by scanning the internet, not by selecting victims. Whoever ran the attack did not need to care which company owned the device. If your organisation operates any internet-reachable embedded equipment, you are already on someone's list — not because of who you are, but because of what you expose.

The Real Vulnerability Was the 14 Months

Look at the timeline:

1. March 2025 — the authentication bypass is disclosed and fixed in release R4.2.
2. May 2025 — CISA publishes advisory ICSA-25-140-03.
3. August 2025 — firmware 4.3.1 closes the remaining flaws; CISA updates its advisory.
4. October 2026 — hundreds of stores are hit while running outdated or end-of-support firmware.

The fix existed for more than a year before the attack. This is the pattern in most real-world incidents: not zero-days, but the gap between a published advisory and action in your environment. For OT and embedded devices that gap is usually widest, because nobody owns the question. The facilities team assumes the vendor patches; the vendor assumes the maintenance contract covers it; IT does not know the device exists. An advisory that matches your estate is only useful if someone is tasked — by name, with a deadline — to act on it.

Your Supplier's Device Is Your Risk

Intermarché's own statement pointed to a service provider that manages its refrigeration systems. That framing matters legally as well as operationally. Under NIS2 — in Luxembourg, the Law of 5 May 2026 — in-scope entities must address the security of their supply chain, including the relationships with direct suppliers and service providers. Food production and distribution are themselves in scope as an Annex II sector.

Two consequences follow. If you are an in-scope entity, "our maintenance contractor installed it" is not a defence; the equipment on your network is part of your risk context, and you need contractual and practical answers on exposure, patching and end-of-life. And if you are the supplier — the integrator, the maintenance firm, the installer — expect your regulated customers to start asking those questions, because their regulator expects them to.

Five Questions Worth Asking This Week

1. Which embedded or OT devices are on our network, and who owns each one — internally, by name?
2. Which of them have management interfaces reachable from the internet, and why?
3. Which are past end-of-support, and what is the replacement plan?
4. When a CISA, CERT-FR or vendor advisory is published, who checks it against our actual equipment — and how long does that take today?
5. What do our contracts with equipment suppliers and maintainers say about patching, exposure and incident notification?

If any answer is "we're not sure", that uncertainty is the finding.

Where Cyvalent Fits

This incident sits squarely in the class of problem Cyvalent works on: knowing what assets and suppliers make up your estate, matching published advisories to the equipment you actually run, and turning findings into remediation that is assigned, tracked and evidenced rather than noted and forgotten. Our vCISO services bring senior ownership to those questions, and Cyvalent RGX, our AI-assisted risk, governance and execution platform, is designed to support the advisory-to-asset matching and the risk-to-task-to-evidence chain that keeps a 14-month gap from going unnoticed. No tool would have made this attack impossible — but a closed loop between advisory, asset and action is what separates a patched estate from a headline.

If the questions above are hard to answer for your organisation, talk to us.