Supermarket fridge hack: how exposed Danfoss controllers were pushed to 50°C, and how to find yours

On the night of Sunday 11 October 2026, attackers pushed the refrigeration controllers in hundreds of French supermarkets into a continuous defrost cycle with the setpoint reportedly at 50°C, and stores threw away their fresh and frozen stock the next morning (Hardware Busters, CBS News). Danfoss, which makes the controllers, says most of the affected equipment was legacy hardware that no longer receives security updates, and the rest was running outdated firmware (Cooling Post). Paris prosecutors have opened an investigation and say the attack caused fires (CBS News).

No custom malware was needed. Defrost is a normal function; the attackers only had to reach the management interface and change what it was told to do. If you run any network that has building controllers on it — refrigeration, HVAC, a data-centre cooling plant, a warehouse — this article shows how these systems are reached, what the published vulnerabilities let an attacker do, and how to find and close the same exposure on your own network this week.

What actually happened in the stores

Reporting is still moving, and the numbers come from different companies counting different things. These are the figures with a named source behind them:

Losses were large for single sites: an Intermarché and a Super U in Haguenau, Alsace, lost about €270,000 of goods between them, according to BFMTV as reported by Infosecurity Magazine. A Sekoia analyst said stores in Spain, Portugal, Poland, Germany and Belgium were also affected (ABC News). Ahold Delhaize had a separate security incident the same weekend that took Albert Heijn's deliveries and electronic shelf labels down, but it said there was no reason to link it to the French attack.

How a supermarket fridge is reachable from the internet

A store's display cases each have a small case controller that runs the compressor, fans and defrost heaters. A system manager — Danfoss's AK-SM 800A is the current model — sits above them, collects alarms and temperatures, and holds the schedules. It has an embedded web interface for monitoring circuits, setting temperature thresholds, changing schedules and remote maintenance (Claroty Team82).

That web interface is the whole problem. Refrigeration contractors service hundreds of stores, so the cheapest way to give them access is to make the system manager reachable from the internet. Cold-aisle control panels are exposed so that maintenance firms can adjust them remotely (ABC News).

How the attackers got in has not been confirmed. Reporting points to three possible routes: controllers exposed directly to the internet, a shared remote-maintenance provider, or stolen credentials (Hardware Busters). A source close to the French prime minister said the national cybersecurity agency found a vulnerability in Danfoss software and contacted the vendor (CBS News). Danfoss named three product lines: the AK-SM800, declared end-of-life in 2021; the AK-SC355, phased out in 2016; and the current AK-SM800A, where affected units were running outdated firmware (Cooling Post).

The known bugs: a password derived from the date

In August 2026, Claroty's Team82 published three vulnerabilities in the AK-SM 800A web interface (Claroty Team82). There is no confirmed link between this research and the attack, but it shows how little stands between an exposed interface and an administrator session.

The first one is the one to understand. The getauth handler in xml.cgi accepted a password computed from the current date instead of checking the configured admin password. Anyone who reconstructs the algorithm gets an administrative session on any unpatched unit, whatever password the installer set (Claroty Team82). CISA published its advisory for it, ICSA-25-140-03, in May 2025, covering all AK-SM 8xxA versions before R4.2 (CISA). So the fix for the authentication bypass has existed for well over a year; the legacy AK-SM800 and AK-SC355 will never get one.

It is not only Danfoss. In the same round of research, Team82 found that admin credentials on Copeland's XWEB Pro supervisory controller are also derived from the date, the MAC address and keys hard-coded in the firmware (CVE-2026-21718), and showed it could change the displayed temperature and disable cooling fans while the probe reading looked normal (Refindustry). In 2019, a researcher found refrigeration controllers from another vendor that anyone could defrost by logging in with default credentials published in the vendor's own documentation (TechCrunch). The pattern is old: a web UI meant for a trusted LAN, put on the internet for convenience.

How many are exposed

Team82's Censys search found 2,765 internet-exposed AK-SM 800A interfaces (Claroty Team82), and a Shodan scan on 19 August found 3,726 of these controllers reachable from the public internet (Infosecurity Magazine).

These count reachable interfaces, not vulnerable ones; a patched unit on the internet is still counted (Refindustry). The two scans also used different search engines and probably different queries, so the gap between them is not a trend.

Find your own exposed controllers

You do not need to be a supermarket to have this problem. Building management, HVAC and cooling controllers turn up on office, warehouse and data-centre networks, often installed by a contractor who set up their own remote access. Start from the outside.

If you have a Shodan account, search your own address ranges for anything with a web interface that is not a server you know about. Team82's write-up shows the AK-SM 800A UI titled "StoreView":

$ shodan search --fields ip_str,port,http.title 'net:203.0.113.0/24'$ shodan search --fields ip_str,port,org 'http.title:"StoreView" net:203.0.113.0/24'

Shodan's data can be days old, so confirm with a scan of your own from a host outside your network. This checks the usual web ports on each public address and prints the page title, which is usually enough to recognise a controller:

$ nmap -Pn -p 80,443,8080,8443 --open --script http-title -oG - 203.0.113.0/24 \    | grep -i 'open'

Inside the network, look for the same thing from the other side: which internal addresses have a port forward or a static NAT rule pointing at them, and who asked for it. On sites you do not manage directly, ask the refrigeration or HVAC contractor a plain question: how do you connect to this controller remotely, and from which addresses?

Close the door, then patch what is behind it

Danfoss's own advice for the attack is "firmware updates where available, stronger network protections and removing direct internet exposure" (Cooling Post). CISA's standing advice is the same: keep control system devices off the internet, put them behind firewalls separate from business networks, and use a VPN for remote access (CISA). In practice that is three changes.

1. Put the controller on its own segment with no inbound path

Remove the port forward first; it is the change with the biggest effect, and what it takes away is the contractor's remote access rather than local control of the cases. Then allow management traffic only from the VPN range. On a Linux router running nftables, with the controllers on 10.20.30.0/24 and VPN clients on 10.99.0.0/24:

table inet bms {  chain forward {    type filter hook forward priority 0; policy accept;     ip daddr 10.20.30.0/24 ct state established,related accept    ip saddr 10.99.0.0/24 ip daddr 10.20.30.0/24 tcp dport { 80, 443 } accept    ip daddr 10.20.30.0/24 drop    ip saddr 10.20.30.0/24 ip daddr != 10.0.0.0/8 drop  }}

The last rule matters as much as the others: a controller has no reason to open connections to the internet, so blocking its outbound traffic stops it reaching an attacker's server if it is already compromised. If it sends alarm emails, allow your mail relay explicitly above that rule.

2. Give the contractor a VPN, not a port

A per-contractor WireGuard peer limited to the controller segment gives them the same access without exposing the web UI. Keep the peer disabled until a job is booked, and you have a record of who connected and when. CISA's own caveat applies: a VPN is only as secure as the devices connected through it (CISA).

3. Update the firmware or replace the unit

For the AK-SM 800A, that means R4.3.1 or later, which fixes all three Team82 issues (Claroty Team82). For the AK-SM800 and AK-SC355 there is no update; Danfoss's advice is to migrate them to current-generation hardware (Cooling Post). Until they are replaced, the network controls above are the only protection they have.

Watch the temperature with something the attacker cannot reach

Team82 showed on Copeland's controller that an attacker can change what the display reports while switching off the cooling (Refindustry). An alarm that comes from the compromised controller is not an alarm. A cheap independent probe in each critical cabinet, reporting to a system on a different network, gives you a reading the attacker would have to compromise separately. Alert on the rate of change, not only on a threshold: a freezer climbing several degrees in ten minutes is not a door left open.

It is also worth logging every setpoint and schedule change the system manager makes, if it supports that, and sending those logs off the device. A forced defrost at 2 a.m. on every case at once is easy to spot if anyone is looking.

The one thing to remember: a controller's web interface is a remote control for physical equipment. If it answers from the internet, anyone who finds the right password — or the right date — is holding it.