DVID logo
FR
News
Cyber

Fridges at 50 °C: what the attack on Danfoss controllers really says about connected device security

By DVID
12 min read
Danfoss refrigeration controllers

On the night of October 11 to 12, 2026, around 400 French supermarkets, according to several media outlets, discovered in the early morning that their refrigerated cabinets and cold rooms were heating up: the Danfoss cyberattack.
The attackers stole no data. They took control of the refrigeration control systems and caused the destruction of entire stocks of fresh products.

What happened

The facts established so far:

  • The target: Danfoss refrigeration system managers, which control the refrigerated cabinets, cold rooms and refrigeration plants of many stores. Intermarché and Coopérative U confirmed they were affected, and E.Leclerc is also mentioned. The exact number of stores per chain varies depending on the source.
  • The modus operandi: according to BFMTV, the attackers remotely triggered the defrost function, continuously, with a 50 °C setpoint. According to Points de Vente, some installations went from -18 °C to +30 °C. The Paris public prosecutor mentions goods losses and fires breaking out on some equipment. Defrosting is a normal function: the equipment heats up briefly to melt the frost. The attackers therefore did not need a flaw in the cooling function. Administrator access was enough to use a legitimate function maliciously.
  • The targeted equipment: according to Danfoss, most of the affected units are older-generation products without security updates: the AK-SM800, declared end of life in 2021, and the AK-SC355, removed from the catalog in 2016. The affected AK-SM800A units, still supported, were running outdated firmware. Danfoss speaks of a limited number of affected systems.
  • The exposure: CERT-FR says it is aware of many compromises of this equipment and reminds that exposing a management interface on the Internet goes against best practices. The editor-in-chief of LeMagIT says he counted nearly 3,000 French IP addresses exposing a Danfoss console. For their part, Claroty researchers had identified 2,765 AK-SM 800A controllers visible from the Internet, across all countries. The director general of ANSSI called for these controllers to be urgently disconnected from the Internet, or at the very least for very restrictive network filtering to be applied.
  • The follow-up: the Paris public prosecutor opened an investigation entrusted to the French anti-cybercrime office (OFAC). According to the professional federation Snefcca, installers have disconnected the affected supervision systems and are waiting for a procedure validated by Danfoss before reconnecting them.

Why it was possible: three layers of causes

The attack cannot be explained by a single flaw. The facts known so far describe three layers that added up. The exact role of the third one in this attack remains to be confirmed.

Danfoss refrigeration controllers

1. Exposure: an administration console reachable from the Internet

Part of the remote maintenance of this equipment relies on a platform hosted by the manufacturer, which connects to the controllers using their IP address, a username and a password. In practice, this means the equipment's authentication service must be reachable from outside the store.

This is the central point. An administration interface exposed on the Internet is quickly indexed by search engines specialized in connected devices. From then on, its security rests entirely on the strength of its authentication. Without a VPN, address filtering or segmentation, there is no other barrier left.

2. Life cycle: end-of-life products and unapplied patches

Two of the models mentioned no longer receive updates, for five years in one case and ten in the other. The third one does, but the targeted units had not installed them. Danfoss says it has long recommended updating supported systems and migrating older ones.

This is not a problem specific to one manufacturer. A refrigeration controller is installed for ten or fifteen years, often by a refrigeration technician, and rarely followed by the store's IT team. It is rarely considered an IT asset. It therefore appears neither in the inventory, nor in the patch management process, nor in the end-of-life equipment replacement plan.

3. Design: a hidden secret and sensitive functions controllable remotely

Researchers from Claroty's Team82 discovered three vulnerabilities in the AK-SM 800A. Danfoss fixed them in 2025, and Claroty published its detailed analysis in August 2026:

  • CVE-2025-41450: an authentication bypass through a hidden "code of the day" password, computed solely from the date. It affects versions prior to 4.2 (Danfoss advisory of March 2025).
  • CVE-2025-41451: a command injection in the email alert configuration, leading to remote code execution, after authentication. It affects versions prior to 4.3.1 (Danfoss advisory of August 2025).
  • CVE-2025-41452: external control of the web interface configuration, leading to denial of service, after authentication. It affects the same versions.

Danfoss recommends upgrading to firmware R4.3.1 or later, which covers all three. An AK-SM 800A left on an older version also accumulates the vulnerabilities published in 2023 (CVE-2023-25913 to 25915, versions prior to 3.3), which could already lead to a full compromise.

The case of CVE-2025-41450 is instructive. A password derived from the date is not a secret: the algorithm is in the firmware, and anyone able to extract and analyze that firmware can reproduce it. It is a maintenance mechanism designed to make technicians' work easier, which becomes an entry point for an attacker. This pattern is not isolated: in the same series of research, Claroty found hardcoded credentials shared across all devices at an HVAC controller manufacturer.

The attack also raises a design question that goes beyond this specific case. On any remotely controllable equipment, a function capable of destroying the contents of an installation should be bounded by a limit that the network interface cannot change: maximum duration, maximum temperature, or an independent cut-off. We do not know what limits existed on the models concerned. The question applies to all manufacturers of connected equipment.

What we do not know yet

For the sake of rigor, facts must be separated from hypotheses:

  • The exact vector is not confirmed. CVE-2025-41450 only affects AK-SM 8xxA units prior to version 4.2. The older models (AK-SM800, AK-SC355), the majority of the affected units according to Danfoss, were necessarily compromised another way: default credentials, weak passwords or vulnerabilities never fixed for lack of support. ANSSI says it identified a vulnerability in software from the vendor and contacted them, without further public details. To date, nothing settles the question.
  • Beware of a confusion that is circulating. Several media outlets relayed a Danfoss advisory dated September 18, 2026 describing a read/write access and program execution flaw. According to Danfoss' official security advisories page, the advisory published on that date concerns debug interfaces in iC7 drive software, not refrigeration controllers. Nothing links it to this attack at this stage.
  • The lack of detection during the night is not explained. Claroty had shown that a compromised controller could shut down cooling while displaying fake temperatures. Nothing indicates this mechanism was used here.
  • The perpetrator and the motive are unknown. No claim of responsibility has been made public.

Any more specific claim on these four points would, at this stage, be speculation.

What it changes for each stakeholder

For operators (stores, retail chains)

Refrigeration is just one example. A modern store hosts dozens of connected devices that are not managed by the IT team: building management systems, heating and air conditioning, lighting, electronic shelf labels, cameras, access control, connected scales, energy meters, charging stations. Each one is installed and maintained by a different contractor, often with its own remote access. The three causes described above apply to all of them: exposure, life cycle, design.

Connected equipment in a store

The first step is therefore to know what is connected. This equipment must be in the inventory, follow the patch management process and have a planned end-of-life date. No administration interface should be directly reachable from the Internet. If remote access is needed, it goes through a VPN or a dedicated access gateway, with strict filtering. This is ANSSI's immediate recommendation for Danfoss equipment, and it applies to all others. Finally, this equipment must be isolated in dedicated network segments, so that a compromise spreads neither between devices nor to the store's information system.

Detection matters as much as prevention. Temperature monitoring independent of the controller, alerting through its own channel, would have made it possible to react much earlier instead of discovering the damage at opening time. If a device is compromised, its own alarms are no longer a reliable source. The same principle applies to any critical function: monitor it through a means the attacker does not control.

Three checks to do right now

  1. Search for your own public IP ranges on a connected device search engine (Shodan, Censys or equivalent) and check that no technical console shows up, whatever the equipment.
  2. Ask each technical contractor (refrigeration, heating, security, energy) for the list of remote accesses open on your sites, with the model and firmware version of each device.
  3. Check that alarms for critical functions go through a channel independent of the equipment they monitor.

Auditing: measure rather than assume

These checks give a first picture. However, they rely on contractors' statements and on what you think has been installed. An audit lets you observe the real state, at several levels:

Security audit of connected equipment
  • External exposure audit: identify, from the Internet and without intrusive interaction, everything visible from your sites. This is the view the attackers behind this campaign had.
  • Mapping and review of internal segmentation: discover the equipment actually present on the network, including what is missing from the inventory, and check that it is isolated as intended.
  • Review of contractors' remote access: who can connect, through which path, with which credentials, and who keeps track of it.
  • Targeted penetration test: on a sample of critical equipment, check in real conditions whether an attacker can take control and what they can do next.

An audit is only a snapshot at a given moment. Its value depends entirely on the action plan that follows. But for a fleet of connected equipment inherited from fifteen years of successive installations, it is often the only way to know where to start.

For integrators and maintainers (refrigeration technicians)

Remote access simplifies maintenance, but it comes at a cost. Equipment installed with an exposed console and credentials shared between customers creates a risk that hits the entire fleet at once. The maintenance contract must specify who is responsible for security updates and who decides to replace equipment that is out of support.

For manufacturers

Remote maintenance is a legitimate market demand. It does not require exposing the equipment on the Internet. Proven architectures exist: the equipment itself establishes an outbound connection to a relay service, with mutual certificate authentication, without any inbound port open on the site.

Three other principles emerge from this case. No secrets embedded in the firmware, because they will eventually be extracted. Limits that cannot be changed remotely on functions capable of causing physical damage. And active management of the end-of-life fleet: clear end-of-support notices, direct communication with customers whose equipment is still in service, and replacement or isolation solutions.

Finally, a penetration test of the product before it goes to market, then at each major change, makes it possible to find this type of flaw before researchers or attackers do. In this case, the vulnerabilities were found by an external research team, on a product already widely deployed.

The regulatory framework is heading in this direction. The European Cyber Resilience Act requires secure-by-default configuration, no known exploitable vulnerabilities when placed on the market, and vulnerability management throughout the support period. Its obligations to report actively exploited vulnerabilities have applied since September 11, 2026, including, according to the text, for products placed on the market before December 2027. Most other requirements apply from December 11, 2027. On the industrial side, the IEC 62443-4-2 standard addresses precisely these topics at the component level, notably with requirements CR 1.1 (human user identification and authentication) and CR 1.5 (authenticator management).

Where training plays a role, and where it does not

Let's be clear: no training would have fixed a fleet of controllers installed ten years ago and never updated. That problem is a matter of governance and operations. It is handled through inventory, network segmentation, monitoring and replacing end-of-life equipment.

On the operations side, raising the awareness of technical teams and maintainers helps get this equipment recognized as IT systems. It does not replace the measures above.

DVID training board for IoT security

On the other hand, several causes of this attack are decided at design time, and that is where training product teams has a direct effect.

The DVID trainings most directly related to this case:

TrainingWhat it brings to this case
Basic firmware analysisUnderstand how an attacker extracts and analyzes a firmware, and why a hidden password algorithm does not withstand this analysis. This is typically the kind of analysis that uncovers a vulnerability such as CVE-2025-41450.
JTAG/SWD debug interfacesUnderstand why debug ports left accessible make it possible to retrieve the firmware and the secrets it contains, and how to lock them.
IEC 62443-4-2 pathTranslate the authentication and authenticator management requirements (CR 1.1, CR 1.5) into concrete design choices for a component.
CRA pathPrepare for compliance with the regulation's essential requirements, from secure-by-default configuration to vulnerability handling after placing on the market.

These trainings are carried out on real hardware: a dedicated electronic board on which participants apply these techniques themselves, in person or in a virtualized environment. The goal is not to scare. It is to make visible, from the design stage, what an attacker will see anyway once the product is on the market.

Conclusion

There is nothing sophisticated about this attack. Public information points to consoles exposed on the Internet, end-of-life equipment and uninstalled patches, on a product range whose authentication vulnerabilities had been published and fixed. The exact vector remains to be established, but each of these elements was known and documented before October 11.

What is unprecedented is the consequence: a cyberattack that physically destroys food stocks on a national scale, in a single night. It is a reminder that industrial connected objects are not a separate kind of technical equipment. They are IT systems, and they must be designed, deployed, monitored and maintained as such.

Sources (in French unless stated otherwise)

DVID
The security of connected devices starts here
Home
Services
Board
Testimonials
Support
Blog
Privacy
Terms
DVID © 2026. All rights reserved
Never miss an update
Don't miss any news about DVID: trainings, updates, events… Subscribe to our newsletter and stay in the loop.