The Danfoss flaw used in the attack has been identified
Assessment
A person close to PM Lecornu told AFP that ANSSI had 'identified a vulnerability' in the Danish vendor's software, and the French firm Synacktiv said an authentication bypass it reported in 2023 and 2025 'could be linked' to the attack, while Claroty Team82's August 2026 research documented a code-of-the-day auth bypass (CVE-2025-41450) and command injection (CVE-2025-41451) on the AK-SM 800A. None of this establishes the vector actually used: CERT-FR named no CVE, firmware version or entry route and published no indicators, Danfoss said most affected units were older models not covered by those advisories, and experts described the attack as opportunistic. The documented flaws are context for why the surface was exposed, not a confirmed cause of this incident.
Where this claim appeared
Génération-NT · 2026-10-13
https://www.generation-nt.com/actualites/cyberattaque-supermarches-france-danfoss-refrigeration-securite-2082732What “Weak Evidence” means
Evidence exists but is thin, circumstantial, or explicitly qualified as weak by the source that published it. Shared hosting infrastructure between threat clusters is the recurring example.
3 of 5 · rating scale
Assessed in
French supermarket cyberattack: Danfoss fridge controllers forced into defrost, stock spoiled, fires reportedThink this assessment is wrong? Report an error.