On the night of October 11, 2026, attackers remotely accessed the refrigeration controllers at an estimated 250 to 350 French supermarkets, forcing them into continuous defrost cycles and pushing freezers to 50 degrees Celsius and beyond. Intermarche, Cooperative U, E.Leclerc, Carrefour, and Monoprix all confirmed stores were hit. Meat, frozen goods, and vegetables were thrown out by the truckload. At some locations the heat caused refrigeration equipment to catch fire. French prosecutors opened a criminal investigation, but no group has yet claimed responsibility.
The hardware at the center of the attack was the Danfoss AK-SM 800A, a supervisory controller that manages refrigeration across an entire supermarket installation. Claroty’s Team82 researchers disclosed three vulnerabilities in this platform at DEF CON in August 2026, including CVE-2025-41450, a hidden authentication mechanism that generates a valid admin password from the device’s current date. Danfoss had shipped a patch in firmware R4.3.1 in 2025. According to Claroty’s research, roughly 2,800 Danfoss management interfaces were still reachable from the public internet at the time of their August report, many of them running outdated firmware. CERT-FR, France’s national cybersecurity incident response center, confirmed compromises across both the AK-SM and the older AK-SC series.
The Vulnerability Was Public and the Patch Was Available
The attack worked because the controllers were exposed and unpatched, not because there was anything novel or unconventional in the approach. CVE-2025-41450 was publicly documented by CISA in May 2025 and disclosed publicly in August 2026. By October, Danfoss itself acknowledged that most of the affected units had reached end of life and were no longer receiving updates, with the remainder running outdated firmware. Some controllers also had default credentials in place.
This is a pattern that appears on OT and IoT assessments regularly. The controller belongs to the facilities team or to the refrigeration contractor under a service agreement, not to IT, if there even is an IT. OT security sits outside whoever owns the corporate network. The result is hardware that sits on the internet for years without firmware updates, without rotation of default credentials, and without anyone treating it as something that needs to be in scope for a security program.
What Defenders Should Take from This
Internet-facing OT and IoT devices need the same patch discipline and credential hygiene that IT systems do, but they rarely get it. Claroty’s scan found nearly 2,800 exposed Danfoss interfaces in August. A Shodan query in the same month returned over 3,700. Most of those operators had a patch available but did not apply it. The Copeland XWEB Pro, another widely deployed refrigeration controller, carried 23 documented vulnerabilities as of Claroty’s August research, 21 of them rated high. Danfoss and Copeland issued firmware fixes, but firmware that stays in a vendor advisory and never gets installed does nothing.
The broader lesson is about asset ownership. These controllers should not be reachable from the public internet at all. CERT-FR’s guidance after the attack told operators to segment refrigeration control networks from corporate networks and restrict remote access to a single managed entry point. That is network segmentation 101. A device that can only be accessed through a VPN with current authentication is much harder to mass-exploit than one with a management interface open to the internet.
How Raxis Can Help
Our IoT penetration testing and OT penetration testing finds exactly this kind of exposure: internet-facing controllers, default credentials, unpatched firmware, and missing network segmentation, before an attacker does. An internal network penetration test maps how far an attacker can move from a compromised OT device into the broader environment, which matters when a refrigeration controller sits on the same network as corporate systems. Our external network penetration test identifies management interfaces your team did not know were reachable from the internet. And, of course our PTaaS services provide penetration testing coverage year-round so that you’re not waiting to find out if your systems are vulnerable to newly discovered exploits.
The devices that ended up in the news this week were not exotic targets. They were standard commercial hardware, deployed everywhere, with a known vulnerability and a missing patch. If your IoT and OT environment has not been tested, the question is not whether it has exposures like this. It is how many.
