Investigators hunt French supermarket fridge hackers, no claim of responsibility

French investigators hunted hackers in Paris on Tuesday after connected refrigerators at hundreds of supermarkets were remotely reset, with no group claiming responsibility or demanding ransom. The attack affected at least 350 stores, including Carrefour, Monoprix, Intermarche and Cooperative U, causing food to spoil. Investigators and experts linked the incident to outdated Danfoss software and internet-exposed systems, while thousands of interfaces remained publicly reachable.

Danfoss said many affected refrigeration units had reached end of life, no longer received security updates or were running outdated firmware.

Claroty identified weaknesses in the Danfoss AK-SM 800A controller that could allow intruders to bypass authentication and run code; the flaws have since been patched.

Reuters found at least 4,500 Danfoss interfaces viewable through Shodan on Tuesday, although it could not determine how many used vulnerable software.

Onyphe said outdated and vulnerable Danfoss versions remained widely represented among publicly accessible interfaces, while only a small minority appeared to run the latest software.

Published Oct 14, 2026 12:17 am KST

Boxes of perished goods are seen outside an Intermarche supermarket in Paris the day after a cyberattack targeted refrigeration systems at French supermarket chains, causing food losses and fires at several stores, France, Tuesday. Reuters-Yonhap

PARIS — French investigators on Tuesday were hunting the hackers who seized control of cooling units at hundreds of supermarkets in a cyberattack that underlined the vulnerabilities of connected systems, with no group publicly claiming responsibility.

The absence of a claim of responsibility by hacktivists or a ransom demand by cybercriminals has puzzled investigators, according to a source with knowledge of the probe. Typically, such groups tend to quickly seek to monetise their hacks or claim credit for them for political ends.

The cyberattack, which manually overrode the temperatures at fridges in supermarket groups including Carrefour, Monoprix, Intermarche and Cooperative U, appears to have been easy to pull off, three cyber experts told Reuters.

Staff at some Paris supermarkets threw boxes full of perished meat and frozen goods into giant trash containers on Tuesday. At least 350 supermarkets — a small fraction of the total number in France - were caught up in the strike.

Firm blames outdated software

The affected fridges relied on software by Danish firm Danfoss.

On Monday, Danfoss said many of the affected units had "reached end of life and no longer receive software or security updates" or were "running outdated firmware." It said it had "advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."

The company declined further comment on Tuesday.

The serious vulnerabilities present in older versions of Danfoss' firmware have been known for months.

On August 9, cybersecurity firm Claroty detailed weaknesses - since patched - in the Danfoss AK-SM 800A controller that could have allowed intruders to bypass authentication and run code on compromised devices.

'Basic cyber hygiene'

Although the precise mechanism by which attackers compromised the refrigerators has not been publicly disclosed, cybersecurity experts said all signs pointed to a basic stunt enabled both by the failure to adopt Danfoss' updates and by exposing device interfaces to the internet.

"This is about basic cyber hygiene," said Ken Munro, a partner at the British cybersecurity firm Pen Test Partners. "Get it wrong and you get a smelly mess of defrosted food."

He said the well-known vulnerabilities meant the attackers were essentially pushing at an open door, something that meant the hack could easily be "kids messing around."

"If this was a nation state, why affect only a subset of French fridges? There are plenty of other nations with fridges on the internet," he said. "No ransom or demand suggests a lack of appreciation of the potential commercial losses that the fridge owners may experience."

Problem still exists

Plenty of fridges remain reachable via the internet. Using the internet scanning service Shodan, Reuters found at least 4,500 Danfoss interfaces still viewable on Tuesday.

Reuters could not independently establish how many of them were running vulnerable software, but French internet scanning company Onyphe said only a small minority of the devices appeared to be running the latest version of the software.

Outdated and vulnerable versions were "still widely represented among publicly accessible interfaces," Onyphe said.

周二，巴黎数百家超市的联网冰箱遭到远程重置，法国调查人员随即展开追捕行动。目前尚无任何组织声称对此事负责或索要赎金。此次攻击至少影响了350家门店，包括家乐福、Monoprix、Intermarche和Cooperative U等连锁超市，导致食品变质。调查人员和专家将此次事件归咎于丹佛斯公司过时的软件和暴露在互联网上的系统，同时数千个接口仍可公开访问。

丹佛斯表示，许多受影响的制冷设备已经达到使用寿命终点，不再接收安全更新或运行过时的固件。

Claroty 发现丹佛斯 AK-SM 800A 控制器存在漏洞，可能允许入侵者绕过身份验证并运行代码；这些漏洞后来得到了修复。

路透社周二通过 Shodan 发现了至少 4500 个丹佛斯接口，但无法确定其中有多少使用了易受攻击的软件。

Onyphe 表示，过时且存在漏洞的丹佛斯版本​​仍然广泛存在于公开可访问的界面中，而只有少数界面似乎运行的是最新软件。

发布于2026年10月14日凌晨12:17（韩国标准时间）

周二，在法国巴黎一家Intermarche超市外，可以看到堆放着腐烂商品的箱子。此前一天，法国连锁超市的制冷系统遭到网络攻击，导致多家门店发生火灾并造成食品损失。（路透社-韩联社）

巴黎——周二，法国调查人员正在追捕黑客，这些黑客通过网络攻击控制了数百家超市的制冷设备。此次网络攻击凸显了联网系统的脆弱性，目前还没有任何组织公开声称对此负责。

据一位知情人士透露，黑客行动主义者既未声称对此事负责，网络犯罪分子也未提出赎金要求，这​​令调查人员感到困惑。通常情况下，这类组织往往会迅速寻求将黑客行为变现，或出于政治目的而声称对此负责。

三位网络专家告诉路透社，这次网络攻击似乎很容易实施，攻击者手动控制了家乐福、Monoprix、Intermarche 和 Cooperative U 等超市集团的冰箱温度。

周二，巴黎一些超市的员工将装满腐烂肉类和冷冻食品的箱子扔进巨型垃圾桶。至少有350家超市——仅占法国超市总数的一小部分——受到罢工影响。

公司将责任归咎于过时的软件

受影响的冰箱使用的是丹麦丹佛斯公司提供的软件。

丹佛斯周一表示，许多受影响的设备“已达到使用寿命终点，不再接收软件或安全更新”，或者“运行的是过时的固件”。该公司表示，已“建议客户将受支持的系统更新到最新固件，并将旧系统迁移到当前一代解决方案”。

该公司周二拒绝进一步置评。

丹佛斯旧版本固件中存在的严重漏洞已为人所知数月之久。

8 月 9 日，网络安全公司 Claroty 详细介绍了丹佛斯 AK-SM 800A 控制器中的漏洞（现已修复），这些漏洞可能允许入侵者绕过身份验证并在受感染的设备上运行代码。

“基本网络安全卫生”

尽管攻击者入侵冰箱的具体机制尚未公开披露，但网络安全专家表示，所有迹象都表明，这是一次简单的作弊行为，其原因在于未能采用丹佛斯公司的更新，以及将设备接口暴露在互联网上。

“这关乎基本的网络安全卫生，”英国网络安全公司Pen Test Partners的合伙人肯·芒罗说。“如果做错了，就会酿成一团糟，就像解冻的食物散发着难闻的气味一样。”

他说，众所周知的漏洞意味着攻击者实际上是在推一扇敞开的门，这意味着这次黑客攻击很可能是“小孩子在胡闹”。

“如果这是某个国家发起的攻击，为什么只影响一部分法国冰箱？还有很多其他国家的冰箱也在网上销售，”他说道。“没有勒索赎金或提出任何要求，这表明他们没有意识到冰箱所有者可能遭受的潜在商业损失。”

问题依然存在

仍有许多冰箱可以通过互联网访问。路透社使用网络扫描服务Shodan发现，截至周二，至少还有4500个丹佛斯冰箱的接口仍然可以访问。

路透社无法独立确定其中有多少设备运行着存在漏洞的软件，但法国互联网扫描公司 Onyphe 表示，只有极少数设备似乎运行着该软件的最新版本。

Onyphe表示，过时且存在漏洞的版本“仍然广泛存在于公开可访问的界面中”。