When Freezers Become Targets: Danfoss Vulnerabilities and the French Supermarket Cyberattacks

Hundreds of French supermarkets have reportedly been affected by cyberattacks targeting their refrigeration systems. Attackers remotely activated defrost functions, causing temperatures to rise and forcing retailers to discard substantial quantities of food.

The incidents highlight a frequently overlooked cybersecurity risk: internet-connected industrial equipment can turn a digital compromise into physical damage.

Danfoss Controllers Under Attack

The attacks reportedly involved refrigeration management systems manufactured by Danfoss, including older AK-SM and AK-SC controllers. These devices allow supermarkets to monitor temperatures, manage alarms and remotely maintain refrigeration installations.

In August 2026, Claroty's Team82 published detailed research into serious vulnerabilities affecting the Danfoss AK-SM 800A platform. Researchers identified thousands of internet-accessible controllers, illustrating the potential exposure of critical management systems.

Three previously disclosed vulnerabilities are particularly relevant:

Danfoss addressed these issues through firmware updates, with version R4.3.1 resolving the latter two vulnerabilities.

There is currently no confirmation that these particular vulnerabilities were exploited in the supermarket attacks. Some affected installations reportedly used older controller models, making the exact attack vector an important unresolved question.

How to Check Your Environment

Linux administrators can perform several non-intrusive checks to identify potentially exposed controllers.

Check whether a known controller's web management ports are accessible:

nmap -Pn -sT -p 80,443,8080,8443 <controller-ip>

Inspect its HTTP response headers:

curl -k -I --max-time 5 https://<controller-ip>/

Identify accessible web management services on an authorised internal subnet:

nmap -sT -Pn --open -p 80,443 192.168.10.0/24

These commands identify accessible services, not confirmed vulnerabilities. Administrators should verify the exact controller model and firmware version through maintenance records or the management interface.

Because refrigeration controllers are operational technology, scanning should be coordinated with the responsible maintenance team. Avoid aggressive vulnerability scans against production equipment.

Relevant CPEs and Firmware

For vulnerability management, identifying the correct product and firmware version is essential.

The relevant product family is Danfoss AK-SM 8xxA. An illustrative CPE pattern is:

cpe:2.3:o:danfoss:ak-sm_800a_firmware:*:*:*:*:*:*:*:*

This pattern is illustrative rather than a verified NVD identifier. Actual CPE entries should be confirmed against the applicable vulnerability records.

For the AK-SM 8xxA series, firmware earlier than 4.3.1 is affected by CVE-2025-41451 and CVE-2025-41452. CVE-2025-41450 was addressed in version 4.2.

The Bigger Problem: Exposed Industrial Equipment

Industrial controllers often remain operational for many years, sometimes long after security support has ended. Remote maintenance capabilities, outdated firmware and insufficient network segmentation can create dangerous combinations.

The risks extend beyond refrigeration systems. Another Danfoss vulnerability, CVE-2026-15203, affects the company's iC7 industrial drives and could allow unauthorised manipulation of device functionality through exposed engineering interfaces. Although unrelated to the supermarket attacks, it illustrates the broader importance of securing industrial equipment.

Organisations should inventory their controllers, remove unnecessary internet exposure, restrict remote management through secured networks and apply supported firmware updates. Unsupported equipment should be isolated and scheduled for replacement.

Resources

• Claroty Team82 — Freeze the Controller, Defrost the Food
• Danfoss — Security Advisories
• Danfoss — DSA-2025-08-01