Abstract:
On the night of October 11th to 12th, freezers and refrigeration equipment in many French supermarkets suddenly heated up. The attacker switched the refrigeration system to defrost mode, causing the equipment to heat cooling components to melt ice; Paris prosecutors said the temperature of some equipment rose to 50 degrees Celsius, and some equipment even caught fire. Stores have been forced to throw away refrigerated and frozen food, and the associated losses could amount to millions of euros. French media reported that more than 400 stores have been affected; Carrefour said about 80 stores were affected, Les Mousquetaires Group to which Intermarché and Netto belong said more than 300 stores were affected, and Monoprix said about 5% of stores were affected. Coopérative U said 80 of its approximately 2,000 stores were experiencing problems.
The French cyber security agency CERT-FR confirmed that multiple refrigeration equipment remote control systems were compromised, involving Danfoss AK-SM and AK-SC series, as well as Copeland's XWEB and Dixell XWEB supervision systems. Danfoss said most of the affected devices are older controllers, including the AK-SM 800 and AK-SC 355. Paris prosecutors have launched an investigation, but so far, the identity of the attacker, the method of intrusion, and whether the attacker exploited known vulnerabilities have not yet been announced.
IP address data company IPinfo looked back at Internet scanning records before the incident and found that from October 6 to 7, about five days before the attack, a total of 2,528 Danfoss StoreView control panels around the world were accessible from the public network, of which 1,331 were in France, accounting for 53% of the total; the remaining 1,197 were distributed in another 72 countries and regions. France has more exposures than all other regions combined, followed by Poland with 179, the United States with 101, Portugal with 92 and Belgium with 85. The statistics here are public network control panels that can be discovered by scanning, which does not equal the number of supermarkets, nor does it mean that every panel has been compromised; IPinfo pointed out that one IP address does not always correspond to a store, and the number is only a minimum estimate based on IPv4 and its scanning port.
These control panels did not suddenly appear online after the incident. IPinfo's weekly scans from the end of March 2026 show that around 2,464 to 2,622 Danfoss control panels are exposed every week around the world, with around half of them located in France. Of the 1,331 French panels discovered in the October scan, 1,019 had appeared on the same IP address on March 30, indicating that many devices had been exposed for at least half a year. Although the proportion of software updates for French devices increased from 14% in March to 24% in October, progress has been slow.
IPinfo found that 1,136 of the control panels scanned in France, about 85%, were running software with known security flaws; the proportion in other countries and regions was also about 84%, indicating that the problem in France is mainly due to the large number of devices exposed to the public network, rather than that its patching rate is significantly worse than elsewhere. Of the vulnerable devices in France, 527 are older controllers that Danfoss has stopped supporting; 280 are missing 2023 security fixes, and a further 329 are missing 2025 fixes. The old AK-SM 800 has stopped life cycle support in 2023. In the same year, security researchers disclosed a vulnerability that can bypass login; newer controllers may also lack subsequent patches if they are not upgraded to the corresponding firmware.
After the attack, the number of public network exposures dropped rapidly. In a scan conducted by IPinfo on October 14, only 316 of the original 1,331 French addresses were found to be still online, a decrease of approximately 76%; the number of old controllers that had stopped supporting dropped from 527 to 64, and even the number of fully updated devices dropped from 195 to 54. Based on this, IPinfo determined that many stores may have disconnected from the public network instead of completing software updates. Another Internet scanning agency, Censys, also observed a significant decrease in the number of relevant panels in France, but some old equipment continues to be exposed.
CERT-FR warns that attacks targeting these refrigeration control systems may still be ongoing. The agency recommends that operators remove public network access to the equipment and change remote maintenance to a secure VPN or protected network connection; Danfoss equipment should also update the firmware, set the security level to Strict, and change the default password. Operators should also check the complete equipment configuration, especially the defrost schedule. A factory reset alone is not enough to eliminate the risk, as devices that are no longer supported and cannot be patched can still be compromised again.
IPinfo's scan can only show whether the control panel is exposed and the approximate software version. It cannot prove that these known vulnerabilities are the entrance to this attack, nor can it confirm which stores were invaded. The fact that the public network is accessible does not necessarily mean that it can be breached, but when the old control system lacks updates for a long time and is directly connected to the Internet, the risk will increase significantly.
Comments