A cybersecurity firm that previously warned about vulnerabilities in Danfoss refrigeration controllers is urging the industry to strengthen network security after hundreds of French supermarket fridges and freezers were remotely compromised.
Claroty CTO Amir Preminger noted that industrial control systems for refrigeration are often assumed to sit on isolated networks. Research by Claroty’s Team82 found many of these devices were in fact directly exposed to the public internet.
The French Incident
On the night of 11–12 October 2026, attackers took control of refrigeration system managers in an estimated 250–700 French supermarkets. Chains including Intermarché, Coopérative U, Carrefour Market, Monoprix, E.Leclerc and Super U were hit. Controllers were forced into extended defrost cycles, pushing temperatures as high as 50 °C and causing widespread food spoilage.
Danfoss said most affected units were older models (AK-SM800 and AK-SC355) that no longer receive security updates, or newer AK-SM800A units running outdated firmware. French authorities later extended the alert to certain Copeland and Dixell controllers.
Known Risks and Prior Warnings
Claroty had earlier identified authentication bypass and command-injection flaws in the AK-SM 800A series. CISA issued advisories in 2025 and Danfoss released firmware fixes, yet many systems remained exposed and unpatched. Scanners had previously recorded thousands of these management interfaces online, with a heavy concentration in France.
Why It Matters for White Goods
Refrigeration controllers manage temperatures, defrost cycles and food-safety logging across supermarkets and cold storage. When they are reachable from the open internet—especially older, unsupported units—the risk becomes immediate.
Key lessons:
– Never expose OT management interfaces directly to the public internet.
– Restrict remote access with VPNs, allow-listing and strong authentication.
– Maintain visibility of assets, apply patches promptly, and plan to replace end-of-life equipment.
The incident is a clear reminder that connected commercial appliances now require the same security attention as traditional IT systems. WhiteGoodsNow will continue tracking developments in this area.
