The Entry Method Is Unknown. The Exposure Isn’t: What to Do After the French Supermarket Refrigeration Attacks

Overnight on October 11, attackers took remote control of refrigeration systems in French supermarkets and forced cases into defrost, with setpoints reportedly raised as high as 50°C.

About 700 of France’s 10,000 supermarkets were affected, according to the Finance Minister’s statement to Parliament on October 13, 2026(1).

The number needs context. Retailer and wire-service counts differ, and the ministry has not published its definition of “affected.” This is a developing situation, and everything below is accurate as of October 15, 2026.

The attackers’ entry method has not been published, and it may not change what defenders should do. The conditions that make an attack like this possible were already in place: management interfaces reachable from the internet, devices that no longer receive updates, and uncontrolled remote access paths that run through third parties. Those conditions are measurable, and every organization with remotely managed devices can check for them today.

What Is Confirmed and What Is Not

Reported: CERT-FR, part of France’s national cybersecurity agency ANSSI, reported numerous compromises of Danfoss AK-SM and AK-SC controllers on October 12 and added Copeland and Dixell xweb devices to the list on October 13(2).

Not published: who is behind the attacks, which vulnerabilities were used (if any), and how the attackers got in. No group has claimed responsibility, and no ransom demand has been reported.

Playing the blame game is not the next step here. While this incident involves particular devices, the same risks likely exist in other classes of devices installed across sites globally, and the gaps behind them are rarely one vendor’s or one team’s to close.

If you lead security, you probably own the program but not the devices. Somewhere in a store back room sits a controller no one on your team has ever logged into, and you have to wonder whether your estate looks the same. That is not a failing of your team. It is how remotely managed equipment is usually bought, installed, and maintained. You are asked to defend equipment you cannot fully see while the facts are still emerging. Whatever those facts turn out to be, every device deserves protection, no matter who installed it or how old it is.

Why the Conditions Are Common

The conditions were public, measurable, and long-standing before October 11. No source has confirmed any of them as the cause, and CERT-FR’s alert warns against exposing management interfaces to the internet without saying that was the route(2). Four stand out, and each stays open until someone closes it.

• Reachable interfaces. On October 15, a TXOne Threat Research review using Shodan counted about 4,980 Danfoss-related hosts, just over half of them in France.3 That query is broad, so not every host is necessarily a vulnerable controller.

• End-of-life devices. Danfoss declared the AK-SM 800 end-of-life in May 2021 and phased out the AK-SC 355 in 2016(4)(5). Neither receives software or security updates, so a flaw found today stays open. That has already happened once: when a login bypass was reported on these older models in 2023, Danfoss responded with network-protection guidance rather than a fix, and the only mitigation was restricting network access(6).

• Devices that are hard to patch. Even a supported AK-SM 800A is not simple to fix. Danfoss documents a required upgrade path to the current 5.3.x package, with added security steps from release 4.0, and from release 5.0 a unit cannot be downgraded(7)(8). A staged, one-way upgrade is the kind of change that waits for a maintenance window, so the device often stays as it is.

• Shared ownership. Contractors install the devices and often manage them remotely, while security teams own the risk. That gap is why inventory and reachability must come before any tooling.

Danfoss urged customers in October 2025 to plan replacements(4), and replacement is the right long-term answer. But replacements and staged upgrades take time, and the exposure stays open until they are done. End-of-life and hard-to-patch devices both need a control that does not depend on the patch.

Details in the Public Record Worth a Closer Look

Coverage so far has centered on the store count, the end-of-life models, and the three published CVEs. Read alongside the primary sources, five details deserve more attention from defenders.

1. An administrative session is enough to cause this impact. Mass setpoint changes and forced defrost use the controller’s normal admin functions, so no code execution is required. A fully patched device still falls back to a default, weak, shared, or contractor credential, and MITRE ATT&CK for ICS lists default credentials and valid accounts among the techniques for lateral movement and persistence(9)(10). Defenders need to cover both exploit traffic and authorized-looking sessions from untrusted sources.
2. Encryption changes what passive tools can see. In Backward Compatible mode, an AK-SM 800A accepts plain HTTP, and credentials cross the network in cleartext. In Strict mode, the default from version 4.0, the unit enforces HTTPS and a session token, which hides exploit payloads from passive inspection. A rule that decides which sources may reach the management port works in both modes.
3. A factory reset does not close the exposure. CERT-FR’s remediation steps include a factory reset, and the alert says a reset removes existing persistence(2). A reset also leaves the device as exposed as before, so an exposed end-of-life unit can be compromised again.
4. Removing exposure has a contract question attached. CERT-FR’s guidance to remove internet exposure comes with a note to check insurance contract terms before cutting the data feed to the refrigeration contractor(2). Ask that question this week, because it can delay the step that matters most.
5. No authority has named a CVE. CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 are not in CISA’s Known Exploited Vulnerabilities catalog(11), so defenders should not wait for a vulnerability to be named before acting.

Taken together, these details lead to one conclusion: the impact stage needs only an administrative web session, so patching alone does not close the exposure. What decides the outcome is who can reach the management interface, and that is a question of visibility and control rather than of any single vulnerability.

Why Accepting the Risk No Longer Holds

These conditions sit in the gap between knowing a device is at risk and acting on it. Visibility comes first and deserves the investment, and for most programs it is the foundation everything else builds on. Protection is the next stage of the journey: a control in the network path that decides what reaches the device before the device handles it.

Many organizations bridge that gap by accepting the risk, an understandable choice for systems that cannot easily be patched or taken offline.

58% of OT cybersecurity decision makers say they handle security updates for systems that cannot be taken offline by accepting the risk and monitoring closely(12).

The assumption behind that choice is that these devices are obscure enough to be passed over.

That assumption no longer holds. The scans that count exposed controllers are public, so anyone can find these devices. And AI is lowering the barrier to attack to nearly zero: finding exposed devices, reading advisories and research, and turning them into working steps no longer takes specialist skill or much time. When the impact needs only an administrative session, relying on obscurity is no longer a safe assumption.

Monitoring is the right place to start, and most programs begin there. But it is a stage on the maturity journey, not the end of it. Monitoring an unprotected device is like installing a camera in the factory: you get a clear view of the fire or the theft as it happens, but with no extinguisher or security guard anywhere in the picture, nothing stands in its way. Until inline prevention is in place, the device is just as exposed as it was when the journey began. Refrigeration shows why. Defrost is a legitimate function, and controllers are typically set to delay temperature alarms while they run(13). Le Monde reported that attackers stretched some defrost cycles from one hour to eight(14), delaying the alarm that tells staff something is wrong. A monitoring alert might still flag the change, but by then the command has already run, and the stock keeps warming while someone decides what to do.

Monitoring signals that fit this pattern are worth building as the first stage: bulk setpoint or defrost writes across many cases, admin sessions outside business hours, sessions from sources outside the contractor allowlist, and controllers still running in plain-HTTP mode.

This incident is one example of a much wider problem. Any remotely managed device installed years ago, reachable by a contractor, and rarely touched carries the same exposure. Tomorrow it could be industrial ovens shutting off mid-batch or irrigation systems flooding a field. Refrigeration was the target this time. The next step on the journey is the same for every operator: move from seeing exposure to preventing it, with a control in the path before the next target is chosen.

What Prevention in the Network Path Looks Like

To show how an inline control works, we use three flaws Danfoss fixed in the supported AK-SM 800A in 2025(15). No authority has linked them to these attacks, and we make no such link. They simply illustrate how an inline control protects a device that has not been, or cannot be, updated. TXOne Threat Research reproduced all three and validated that TXOne EdgeIPS protects against each(3).

Three uses of that prevention apply to the conditions described above.

1. **Virtual patching for supported units that cannot upgrade yet.** An AK-SM 800A can be protected against the three flaws while it waits for the staged upgrade to 5.3.x, so the exposure closes without waiting for a maintenance window. This applies to units that use unencrypted HTTP management access, typically those on firmware older than 4.0.
2. **Policy enforcement for end-of-life units.** The AK-SM 800 and AK-SC 355 will never receive fixes, and Team82 did not test them(13). For these units, the network path is the only place left for a control. Deployed inline as the only network path to the controller, TXOne Edge restricts access to authorized service providers. It denies internet-originated sessions, allows contractor VPN sources to the required management ports only (HTTPS and SSH), and drops every other service. That follows CERT-FR’s guidance to disconnect these controllers or filter access(2).
3. **Segmentation from store IT.** Separating refrigeration controllers from the rest of the store network limits what a compromised manager can reach and blocks unexpected outbound connections afterward.

TXOne Edge is one option, and the right starting point depends on where your program is today. EdgeFire provides the protected remote path, combining an OT-native firewall, inline IPS, and VPN. EdgeIPS protects one device (1:1) or several (1:N), depending on the Edge model, and deploys transparently without network redesign.

We do not claim Edge would have prevented, stopped, or detected these attacks, because the entry method is unpublished. Coverage also depends on the device, so confirm that your specific controller models are covered when considering any solution.

Two Paths You Can Start Today

You do not need to know the entry method to act. Two paths can run at the same time, and each does a different job. The first is the set of cyber hygiene basics that every program should already have in place. The second is a short set of questions for your contractors, which is where gaps are most likely to be overlooked. We group the checks within our Discover. Assess. Protect lifecycle framework.

Path 1: Six hygiene basics. If any of them is missing, close it first.

Discover

1. Identify every controller you have and who can reach it. Record each one’s model, location, owner, managing contractor, and update status.
2. Ask your contractors for their list and reconcile it with yours.

Assess

1. Check whether any management interface is internet-facing. Scan your external IP ranges the way an attacker would. Ask contractors about cellular modems and other connections they installed.
2. Review each controller's firmware and update status. Mark which ones cannot be patched or replaced this month, starting with every end-of-life model, and plan an upgrade or replacement for each.

Protect

1. Close internet exposure first, then limit contractors’ remote access to a secure VPN or protected network. Review remote access accounts, remove any no longer needed, and replace default or shared credentials. On supported units, confirm strict session control is on (the default from version 4.0).
2. Devices that cannot be patched or replaced this month need inline prevention, not only monitoring. Segment them and restrict what can reach them.

Path 2: Three contractor questions. If you run stores, plants, or facilities rather than the security program, you are well placed to ask these. They are the questions most likely to be overlooked, and the ones that reach into the supply chain. Ask them of every contractor:

· What do you manage for us?

· How do you connect to it?

· When was it last updated?

Be prepared for what the answers reveal. Answering these questions can reveal gaps well beyond the controllers themselves: remote access paths no one documented, devices never in the security program’s scope, and supplier relationships with no security requirements attached. That is a useful result, not a failure. Each gap you find is one you can now close, and the gaps were there before you asked.

Share the answers with your security lead. If you suspect a controller was compromised, follow CERT-FR’s remediation guidance and industry best practice: limit access to service providers only, factory reset the device, apply current fixes, change credentials, check accounts, and reconfigure it completely(2).

The two paths work together: the checks tighten what you already know, and the questions show you what you do not. The entry method is still unknown. The conditions never were, and you can start closing them today.

Next Step

Start with both paths. For controllers that cannot be patched or replaced yet, monitoring is a sound first step, but prevention closes the exposure. Talk with a TXOne OT security specialist about putting inline prevention in front of your remotely managed controllers.

Talk with a TXOne OT security specialist about inline prevention for remotely managed controllers.

Sources

1. [Associated Press: Cyberattacks disrupt refrigeration systems at European supermarkets (October 13, 2026), published by PBS NewsHour]
2. [CERT-FR: CERTFR-2026-ALE-012, Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (security incident targeting remote refrigeration controllers; in French; October 12, updated October 13, 2026)]
3. TXOne Networks Threat Research Note: Danfoss Refrigeration Controller Compromises in France, version 1.0 (October 15, 2026)
4. [Danfoss: Tech Insider October 2025 (October 31, 2025)]
5. [The Hacker News: Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers (October 13, 2026)]
6. [Synacktiv: Authentication bypass in Danfoss System-Managers models SM800 & SC255, security advisory (published May 22, 2023; updated October 31, 2023)]
7. [Danfoss: AK-SM 800A Series, software downloads and upgrade guidance (current package 5.3.x, October 2026)]
8. [Danfoss: Tech Insider, Food Retail (AK-SM 800A software release notes)]
9. [MITRE ATT&CK for ICS: Default Credentials (T0812)]
10. MITRE ATT&CK for ICS: Valid Accounts (T0859)
11. CISA: Known Exploited Vulnerabilities Catalog
12. TXOne Networks / Omdia OT Security Survey, 2025
13. Nozomi Networks: French Supermarket Fridge Cyberattacks and the Risks of Internet-Connected OT (October 13, 2026)
14. TIME: ‘Unprecedented’ Cyberattack Targets French Supermarket Fridges (October 13, 2026)
15. CISA: ICS Advisory ICSA-25-140-03, Danfoss AK-SM 8xxA Series (Update A, August 26, 2025)
16. Claroty Team82: Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers (August 9, 2026)