The widespread cyberattacks that hit the refrigeration systems of French supermarkets this weekend show what’s at stake when remote access internet connections aren’t secured and hackers exploit them. Earlier this year, attackers went after U.S. water utility controllers and gas station fuel tank gauges, and in those cases too, the devices they reached were connected directly to the internet. Following the attacks on water utilities, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) advised organizations to “remove remote access when it is unnecessary and secure it when it is necessary.”
Both hacking sprees stemmed from unsecured remote access to controllers, but the images of empty shelves and defrosted, spoiled food being thrown away may have provided the global wakeup call cyber defenders need.
The French Supermarkets Cyberattack: What Happened
Overnight on October 11, attackers took remote control of refrigeration systems in hundreds of stores across France and forced fridges and freezers into defrost, with setpoints reportedly raised to 50°C (122°F). Staff arrived on Monday morning to warm display cases, spoiled stock and, in some stores, equipment that had started to catch fire, according to BleepingComputer and the Paris prosecutor. Le Monde, as reported by TIME, said the attackers also extended some defrost cycles from one hour to eight to delay the alarms that would normally alert staff.
Intermarché and Netto, Coopérative U, Carrefour and Monoprix have confirmed affected stores, E.Leclerc has said one of its refrigeration suppliers was hit, according to The Hacker News, and Reuters puts the total at a minimum of 350 supermarkets. Thierry Cotillard, who heads Les Mousquetaires, told BFMTV the losses amount to “tens of millions of euros nationwide in a single day.” The Paris prosecutor has opened an investigation, and on October 12, CERT-FR, part of France’s national cybersecurity agency ANSSI, issued alert CERTFR-2026-ALE-012 confirming “numerous compromises” of Danfoss AK-SM and AK-SC series controllers.
But the damage isn’t contained to France. Speaking on CNN on October 13, Nozomi Networks co-founder and CTO Moreno Carullo also pointed to South Africa, Portugal, Belgium and Poland, and Reuters, citing a Sekoia analyst, reported affected retailers in Spain, Portugal, Poland, Germany and Belgium.
As of October 13, no group has claimed responsibility and no ransom demand has been reported.
Why Physical Systems Often Require Remote Access
Remote access to operational technology (OT) is often a practical necessity. A grocery chain with thousands of refrigerated units across hundreds of stores, or a small water utility with a lean team both typically rely on contractors who maintain those systems and reach must them remotely. That makes securing each connection critical. If a controller that runs a physical process can be reached from the internet, the hygiene step are straightforward:
- Control and monitor the connections to the devices often through gateways and secure remote access
- Keep its firmware supported and current
- Replace default or shared credentials
- Make sure someone would notice if it received a malicious command
As this latest string of remote-access attacks makes clear, too often they steps aren’t followed. During the CNN interview Carullo described the mechanics plainly: operators need to manage these systems remotely, but securely, because if an attacker can reach the control interface, “he is able to send his commands.”
How Cyber-Physical Systems in a Supermarket Work
A supermarket runs more OT than most shoppers would guess, and refrigeration is usually the largest part of it. Each display case, cold room and freezer has its own case controller. It reads temperature probes, drives the electronic expansion valve that meters refrigerant into the evaporator, and runs the heaters that periodically melt ice off the evaporator coil. Those case controllers report over a fieldbus to a central system manager, which in this incident was a Danfoss AK-SM or AK-SC unit. The system manager holds the schedules, setpoints, alarm thresholds and defrost cycles for the whole store, and it runs an embedded web server so technicians can administer it remotely.
Three features of this design shape the risk:
- Defrost is a legitimate function. Every refrigerated case needs it, and controllers are typically configured to delay temperature alarms while it runs, because a temporary rise is expected. An attacker who forces a long defrost at that point is using the controller’s own logic rather than a software flaw, which makes the change look routine to anything that isn’t watching for it.
- The retailer often doesn’t operate these systems directly. Coopérative U’s chief executive, Dominique Schelcher, said its stores don’t buy from Danfoss; they are customers of refrigeration contractors who supply and maintain the systems. That leaves open who is responsible for firmware, credentials and network exposure.
- The estate is distributed: a chain can have hundreds of stores, each with its own system manager and almost none with on-site security staff.
Old Firmware, End of Life and Who Owns the Patch
Danfoss told Cooling Post that the majority of affected units were either legacy products or current products running outdated firmware. The legacy units are the AK-SM 800, declared end of life in May 2021, and the AK-SC 355, phased out in 2016, which means neither receives software or security updates. The current-generation AK-SM 800A units that were hit had not been updated.
Danfoss had warned about this. In its October 2025 Tech Insider newsletter, the company announced a hard end-of-service policy for legacy products including the AK-SM 800 and AK-SC 355, urged customers to plan replacements, and cited two earlier incidents from 2022: 16 Russian supermarkets using the AK-SM 800 targeted at the start of the war, and 40 stores in Israel hacked, all of them without proper firewall or VPN protection.
A refrigeration plant is expected to run for many years, while the software on its controller has a much shorter support window. Carullo wrote last week about the controller that “was installed before most of the people who maintain it were hired,” and about OT teams that may get one maintenance window a year. Once a controller reaches end of life there is no patch to wait for, and the remaining options are isolation, compensating controls or replacement.
The Broader Pattern: Controllers Reachable from the Internet
CERT-FR’s alert states that exposing a management interface to the internet is contrary to good practice. It tells operators to disconnect or filter access to every AK-SM and AK-SC instance, and it describes restricting access to trusted IP addresses as only a first, temporary measure where remote administration can’t be avoided. French media report that an October 13 update to the alert added Copeland and Dixell XWEB controllers, after an E.Leclerc store in the Tarn that uses Dixell equipment also lost its cold chain.
The exposure was measurable well before the attack. On October 12, researcher Baptiste Robert found 2,752 exposed Danfoss systems, 1,590 of them in France, and a day later Reuters found at least 4,500 Danfoss interfaces still visible through Shodan. French scanning firm Onyphe said only a small minority appeared to be running the latest software. As noted above, such exposures extend well beyond France.
The same precondition runs through this year’s other major attacks on cyber-physical systems. In water, a joint advisory in April (AA26-097A) described Iranian-affiliated actors accessing internet-exposed Rockwell Automation controllers with the vendor’s own engineering software. In July alone, CISA saw more than 100 internet-exposed systems in the U.S. water and wastewater sector targeted, many of them PLCs connected directly to cellular modems with nothing in between. The attackers changed passwords and IP addresses to lock operators out, in some cases disabled shutdown processes and alarms, and caused boil-water notices and sustained manual operations. That campaign has an earlier precedent: in 2023, the CyberAv3ngers group took over internet-exposed Unitronics controllers at the Municipal Water Authority of Aliquippa using the factory default password, 1111.
At gas stations, CISA, the FBI, NSA, the Department of Energy and other agencies issued a joint advisory in June warning that actors were compromising internet-exposed automatic tank gauges (ATGs), the devices that monitor fuel levels and leak detection, and modifying them through command execution. The advisory listed hardcoded credentials and authentication bypass among the likely attack vectors and warned that attackers could disable alerts meant to catch leaks. Days later, Shadowserver counted 909 exposed ATGs in the United States.
Attention Can Spark Action
The ATG case also shows that public attention can change the numbers. Bitsight, which scans continuously for these devices, found that exposed ATGs in the U.S. held in a band of roughly 4,300 to 5,300 IP addresses a month for ten months, then fell 56% between March and June 2026. The decline began in April, when fuel industry associations issued urgent advisories and began coordinating a response with CISA and the Department of Energy, and it continued through the CNN reporting and the June joint advisory. By comparing against a second port that barely changed, Bitsight estimated that about three-quarters of the drop reflected devices actually taken off the internet rather than routine address changes. (Bitsight counts several ports and methods, so its figures run higher than Shadowserver’s filtered single-port count.) Bitsight also cautioned that a gauge moved behind a firewall can still be vulnerable to an attacker already inside the network, and that more than 800 U.S. ATGs on the second port were still exposed in June.
French refrigeration controllers now have the same kind of attention: a national CERT alert, an open criminal investigation, statements from the vendor and the largest retailers, and coverage well beyond the security press. If operators, contractors and vendors respond the way the fuel sector did, exposure could fall just as quickly, and the scanning firms already counting these devices would be able to show whether it does.
These incidents involved different sectors, different devices and, in most cases, different or unknown actors. In the water cases, attackers needed no exploit at all, only a reachable controller and a weak or default password, and the ATG advisory pointed to long-known weaknesses such as hardcoded credentials. How the Danfoss controllers were compromised hasn’t been disclosed, but they were reachable in the same way.
Earlier Warnings About Multi-Vendor Web Interface
Research from Claroty's Team82 also showed how the AK-SM 800A’s web interface could be compromised. They reported three vulnerabilities:
- CVE-2025-41450, a hidden “code-of-the-day” authentication path that accepts a password generated from the device’s current date
- CVE-2025-41451, a command injection in the alarm-to-email settings that allows remote code execution after login
- CVE-2025-41452, which lets an authenticated user inject Nginx configuration directives and crash the web service.
Firmware R4.3.1 addresses all three, and CISA had published the first two in 2025 vulnerability bulletins (May and August). Team82 disclosed similar issues in Copeland XWEB Pro supervisory controllers in the same period, and the Dixell report shows the exposure extends beyond one vendor.
That research, together with Danfoss’s end-of-service notice, gave operators months to inventory controllers, update supported units and take interfaces off the internet. Two caveats apply:
- Neither CERT-FR nor Danfoss has said which vulnerability, if any, was used in this attack
- The older AK-SM 800 and AK-SC 355 were outside the scope of Team82’s testing.
Even Earlier Warnings About Danfoss Web Interfaces
As is often the case when a major incident happens, older warnings resurface. As early as May 2023, French security firm Synactiv published an advisory that describes a login bypass in the Danfoss SM800 and SC255/SC355 system managers. Those are the same end-of-life models Danfoss says made up most of the units hit this week in France. It’s the same “code-of-the-day” mechanism Claroty later found in the current AK-SM 800A (CVE-2025-41450): a backup password generated from the device’s date. On these older models, anyone can ask the device for its date without logging in, so an attacker can work out that day’s code and get in. Danfoss acknowledged the report but said it only affects end-of-life products, so there’s no fix. The only mitigation is to restrict network access.
Other Refrigeration Cyberattacks
Refrigeration outages at U.S. military commissaries in late August also deserve a closer look. At least six commissaries reported outages within days of each other, and one, Fort Huachuca in Arizona, said all of its freezers went into defrost mode overnight, according to Stars and Stripes. The Army CID’s Cyber Field Office, which investigates computer intrusions, and the Air Force Office of Special Investigations confirmed active investigations. No findings have been announced, defense officials have not said whether unauthorized access was involved, and there is no confirmed link to the French attack. The failure mode, however, a forced defrost issued through a centralized controller, is the same one the French stores experienced.
The same day the French stores found their freezers warm, Dutch-Belgian grocery giant Ahold Delhaize disclosed a separate security issue within its network and took some systems offline as a precaution. Work stopped at several distribution centers for Albert Heijn, one of its subsidiaries; online ordering went down across its Dutch and Belgian brands; and Albert Heijn warned that some shelves could be empty. Ahold Delhaize says it has so far found no evidence of data theft, and the Dutch National Cyber Security Centre has said it sees no reason to believe the incidents in the European food sector are connected.
The two events reached the food supply from different directions: one through store OT systems and the other through IT and logistics systems. Keeping shelves stocked depends on both, so a security program that covers corporate IT but not store and warehouse OT, or the reverse, leaves part of that supply chain unprotected.
Hard-Coded Credentials and the Cyber Resilience Act
The code-of-the-day mechanism (CVE-2025-41450) belongs to a familiar category: a vendor maintenance path that works the same way on every unit of a product. Hard-coded and universal credentials are particularly dangerous in OT because the operator usually can’t change them, so a single discovery applies to every installation. Nozomi Networks Labs has disclosed this pattern in other products, including a hard-coded password protecting the user database in GE Vernova’s EnerVista UR Setup (CVE-2025-27255) and a static password protecting backups on Advantech EKI-6333AC access points (CVE-2024-50377). In both cases only the vendor could fix it.
The EU Cyber Resilience Act (CRA) targets exactly this issue. Annex I requires products with digital elements to ship with a secure-by-default configuration and to protect against unauthorized access through appropriate authentication and access controls. Article 13 sets a support period of at least five years in most cases, and since September 11, 2026, manufacturers have had to send an early warning within 24 hours when they become aware of an actively exploited vulnerability or a severe incident. The UK took a similar step at the device level: since April 2024, its PSTI regime has made universal default passwords non-compliant on consumer connectable products.
This incident also shows where the CRA stops. Its Annex I requirements apply from December 11, 2027, to products placed on the market from that date, so they won’t apply to a controller installed in 2015, even though the reporting duties cover older products. European regulation is also changing vendor behavior in another way: Danfoss says its hard end-of-service policy is “driven by recent European cybersecurity legislation,” because continuing to service legacy products would create new legal obligations to keep providing security updates. The likely near-term effect is that support for older devices ends sooner, leaving operators to rely on their own visibility and compensating controls.
AI Is Shortening the Time Defenders Have
With any new high-profile attack, the question on every reporter’s mind is whether AI was involved, and how. On CNN, Carullo explained how AI has changed the picture for defenders: “In the past, very high skilled people were required to find these kinds of vulnerabilities. Today, AI progress allows even less skilled professionals to find them and exploit them at scale.” Because these attacks are now “cheaper” and “easier,” he added, the range of possible motives widens, from financial gain to activism or simply a demonstration of capability.
Industry data points to the same conclusion. Synack’s 2026 State of Vulnerabilities Report, summarized by Help Net Security, found AI-enabled adversaries exploiting newly disclosed vulnerabilities within hours of public disclosure, while average time to remediate in the programs it tests was still 38 days. In June, Carullo wrote that the release of OpenAI’s GPT-5.5-Cyber and Anthropic’s Claude Mythos marked “a genuine inflection point for cybersecurity,” citing an 83% success rate on vulnerability-reproduction benchmarks.
On October 12, Anthropic’s Frontier Red Team published research suggesting small AI models may be months away from self-replicating across commercial IoT devices and noted that Mirai spread simply by trying manufacturers’ default credentials.
Apply that to the Danfoss case. Team82’s research involved extracting firmware and reverse engineering a multi-layer web service, which is the kind of specialist work that frontier models are now accelerating. Once a flaw is public, the time between an advisory, a working exploit and mass scanning is getting shorter. An OT patch cycle built around annual maintenance windows is no defense at all.
What Retail Operators Should Do Now
If you operate refrigeration, HVAC or building systems across a distributed estate, these are the questions to answer this week:
- Can anyone reach it from the internet? Check your external IP ranges the way an attacker would, including cellular modems and contractor-installed connections, and remove direct access wherever the business can operate without it. Where remote access is required, CISA recommends routing it through a secure, centrally managed gateway with phishing-resistant multi-factor authentication and unique credentials.
- Do you know what you have? You need a complete inventory of every system manager and controller, including its firmware version and whether it is end of life. Without it, you can’t match published vulnerabilities to your own devices.
- Would you notice a defrost command at 2 a.m.? Continuous network monitoring that understands OT behavior can flag setpoint changes, unusually long defrost cycles, new remote logins and configuration writes that fall outside normal patterns, even when the attacker is using a legitimate function.
- Who owns the risk in your contracts? If a contractor manages the system, your agreement should cover firmware currency, credential management and remote access controls.
- What if you think you were affected? Follow CERT-FR’s remediation guidance, which starts by cutting off exposed access and includes a factory reset, current fixes and a full reconfiguration of the device.
As Carullo said on CNN, companies “should monitor the assets they have in their network to be able to proactively protect these devices.” That holds for the HVAC and building management systems in the same stores, which contractors often reach remotely in the same way.
At Nozomi Networks, we help retailers and critical infrastructure operators identify every connected asset; understand which ones are vulnerable, exposed or out of support; and detect the behavioral changes that indicate an attack in progress, so they can act before stock spoils or equipment fails. To discuss what this means for your sites, contact us today.
