← All resources

Fridges hijacked: the CERT-FR Danfoss alert (12/10/2026)

Published October 13, 2026 · 7 min read · CyberNovaLabs.io

A cyberattack drove freezers in hundreds of French supermarkets to 50 degrees. The box at fault was not an IT server: it was a refrigeration controller fitted by a cooling engineer, reachable from the internet, never updated. Thousands of SMEs have one.

In short

During the night of 11-12 October 2026, attackers took remote control of Danfoss refrigeration controllers and pushed temperature setpoints to 50 degrees in Intermarche, Systeme U, E.Leclerc and Monoprix stores^[2]. On 12 October, France's CERT-FR published alert CERTFR-2026-ALE-012, reporting numerous compromises of AK-SM and AK-SC series equipment and restating that exposing their management interface to the internet goes against good practice^[1]. Danfoss says most affected units were obsolete products or were running outdated firmware^[2][4].

What actually happened

At the centre of the case sits the AK-SM 800A, a system manager: a small web server that drives a site's display cases and cold rooms, reads the probes, triggers defrost cycles and sets temperature thresholds. It is almost always installed by the refrigeration contractor, and almost always reachable remotely so that contractor can intervene without driving to site.

Researchers at Claroty Team82 had documented an authentication bypass on this range, CVE-2025-41450, rated 8.2 out of 10: a hidden code-of-the-day mechanism derived from the device's own date, and therefore reproducible by an attacker to open a fully authenticated administrative session^[3]. Firmware R4.2 fixes that flaw, and R4.3.1 fixes two further vulnerabilities^[3][5]. Scanning the internet at the time, Claroty counted 2,765 exposed controllers^[3].

The patches had not reached every site. CERT-FR recommends disconnecting or filtering access to AK-SM and AK-SC instances and, where compromise is suspected, restricting network access, performing a factory reset, applying all available patches, rotating secrets, reviewing existing accounts and fully reconfiguring the device^[1]. Cooling Post reports roughly 500 supermarkets affected and stock losses running into millions of euros^[4]. No group has claimed the attack so far.

Why this concerns an SME that is not a supermarket

The instinct is to file this under retail. That misreads it. What was attacked is not a corporate information system: it is a box in a plant room, connected to the internet by a contractor, running firmware frozen since installation. Thousands of SMEs have exactly that box.

The list is longer than people assume: a butcher's, caterer's or grower's cold room, a restaurant's walk-in, a pharmacy's vaccine fridge, a laboratory's freezers, a temperature-controlled warehouse, a brewery tank. Beyond refrigeration, the same architecture covers building management systems, air conditioning, alarms, cameras, access control, lifts, solar inverters and EV chargers.

The common factor is not the brand but how the equipment lives: installed by a trade that is not IT, administered remotely, password shared between technicians, firmware never revisited, and nobody inside the company aware it holds a public address. It is the same mechanism we saw with the NetScaler flaws exploited before the patch and in ANSSI's report on stolen DGFiP credentials: entry through a door nobody was watching.

The four countries: who to call

In France, ANSSI was tasked at the Prime Minister's request and contacted the affected companies^[2]. In the other three countries where CyberNovaLabs.io works the contact changes, but the reflex does not: report to the cyber authority, and handle the personal-data question separately.

The second reflex is separate from the first. The flaw documented by Claroty allows, among other things, generation of a report disclosing internal IP addresses, user names and site names^[3]. If employee credentials could be read, this is no longer only a technical incident but a possible personal data breach, with the 72-hour deadline to notify the competent authority. We set out that reflex in our piece on the Flink breach that started with a former employee's login.

The sum to do this morning

Assumptions to replace with your own figures: a cold room holding 8,000 euros of goods, one night at lost temperature, two days closed at 3,000 euros of daily turnover, 600 euros for the emergency call-out. That is 14,600 euros for a single room, before the insurance file and the food-safety records you will have to justify. Against that, closing the controller's internet access and routing it through a VPN costs a few hours of contractor time.

What this says beyond refrigeration

An SME broadly knows its IT estate: workstations, a server, email, a website. It rarely knows its controller estate, because those were bought as trade equipment rather than as IT. Yet they have addresses, web interfaces, accounts and vulnerabilities exactly like a server, with nobody tracking their patches.

So the inventory, not the patch, is the real action of the week. You cannot protect what you have never listed, and the bill for the night of 11-12 October runs into millions of euros of stock for businesses that, the day before, thought their cyber risk stopped at their mailbox.

At CyberNovaLabs.io

We do not sell industrial security audits. But if you are an IT provider, an MSP or an installer, this alert is an immediate reason to meet your clients: an inventory of exposed equipment is a short, priceable and urgent engagement. That is exactly the conversation we open for you through B2B appointment setting, in Brussels as in the other three countries we cover. Qualification criteria written before launch, no minimum term, per appointment or on a retainer, priced on quotation. Let us discuss your target in 20 minutes.

Sources

1. CERT-FR — CERTFR-2026-ALE-012, Incident de securite ciblant les Danfoss serie AK-SM et AK-SC (12/10/2026)
2. franceinfo — Des magasins Systeme U et Intermarche touches par une cyberattaque contre leurs installations frigorifiques (12/10/2026)
3. Claroty Team82 — CVE-2025-41450, Danfoss AK-SM 8xxA Series, contournement d'authentification (CVSS 8,2)
4. Cooling Post — Danfoss moves to mitigate cyberattack (12/10/2026)
5. Refindustry — Danfoss, Copeland and Trane address controller security vulnerabilities (13/08/2026)

Read next