Danfoss refrigeration controllers: what the French supermarket attacks show
Five stories from 12 October to 8 November 2026 point to one problem: refrigeration controllers reachable from the internet. Here is what sites should take from them.
Written by AI from the Brief stories it cites. Code checks that every number and CVE id in it appears in those stories; no person reviews it before it is published. How posts are made · Report an error
In short
- Attackers changed temperature and defrost settings at French supermarkets through internet-exposed refrigeration controllers, and stores discarded food.
- CERT-FR confirmed Danfoss AK-SM and AK-SC, Copeland and Dixell XWEB systems were involved. How attackers got in is still unconfirmed.
- Forescout found 12,976 internet-exposed service observations on 6,017 public IP addresses in 99 countries and territories.
- Some affected units are obsolete or run outdated firmware. Researchers had warned of flaws months before the attacks.
- Remove public access, put management interfaces behind a firewall or VPN with multi-factor authentication, and watch for setpoint changes.
Attacks reached the physical process
Overnight from 11 to 12 October 2026, attackers changed temperature and defrost settings in refrigeration systems at hundreds of French stores. Stores discarded fresh and frozen food. Later reports put the number at more than 700 supermarkets. One report said criminals hacked thousands of controllers and raised heat to 50°C (122°F).123
The lesson for a site is plain. A controller setting is a process setting. Changing it can spoil product with no malware on any office PC. The stories name food retail, cold chain and hospitals as at risk.4
The same interface was exposed again and again
CERT-FR confirmed that Danfoss AK-SM and AK-SC, Copeland and Dixell XWEB systems were involved. The stories describe the compromised devices as internet-accessible. ANSSI reported compromises of Danfoss, Copeland and Dixell devices.342
Forescout's Vedere Labs found 12,976 internet-exposed service observations tied to refrigeration control systems on 6,017 public IP addresses in 99 countries and territories. France is not the only place where these systems are reachable. A site anywhere should check its own exposure.4
Warnings and fixes lagged behind
Researchers warned of flaws in refrigeration controllers months before the attacks. The stories also say many of the devices get no updates or run outdated firmware. Some Danfoss units are obsolete. For those units, a patch is not a plan. Access control has to do the work.21
Claroty's Team82 used an AI coding agent to reproduce three known flaws in Danfoss AK-SM 800A controllers: CVE-2025-41451, CVE-2025-41452 and CVE-2025-41450. Chaining two gave root-level command execution on a lab device in about 28 minutes, at a cost of about US$6. The source does not say which organisations are affected. It does show that known flaws can be reproduced quickly.5
What is still unknown
The stories do not agree on every detail. One says the attack used Danfoss control software. Others say Danfoss, Copeland and Dixell products were involved. French authorities have not confirmed initial access, the exploited flaws or the responsible actors. None of the stories is marked as a known exploited flaw. Sites should not assume the Team82 flaws were the ones used in France.1235
What to do now
Search your asset inventory and external IP ranges for Danfoss AK-SM, AK-SC and AK-SM 800A, Copeland, and Dixell XWEB interfaces reachable from the internet. Check whether any units are obsolete or no longer receive updates.3451
Remove direct internet access and place management interfaces behind a firewall. Require a VPN with multi-factor authentication for remote access. Limit access to known administrator addresses. Watch for unexpected changes to setpoints or defrost schedules outside maintenance windows, and for logons from unfamiliar internet addresses. Copeland says it is working with impacted customers.42
The stories this draws on
- Attackers spoiled food at French supermarkets by altering refrigeration controls Critical
- Researchers warned of refrigeration controller flaws months before French supermarkets were hit Critical
- Internet-exposed refrigeration controllers at over 700 French supermarkets reportedly tampered with Critical
- Internet-exposed refrigeration controls found in 99 countries after French supermarket attacks Critical
- AI tool rebuilt attacks on Danfoss refrigeration controllers in 28 minutes Medium