Skip to main content
You don’t need a nation state to warm up a fridge 
  • OT, ICS, IIoT, SCADA
  • Vulnerabilities and Disclosures

You don’t need a nation state to warm up a fridge 

Andrew Tierney

14 Oct 2026 9 Min Read

TL;DR 

  • Over the night of the 11th of October 2026, the fridges and freezers in several hundred French supermarkets were made to warm up. Stock was binned, some equipment reportedly caught fire, and losses run to tens of millions of euros. 
  • The controllers are Danfoss AK-SM and AK-SC units, many reachable directly from the internet, with a built-in login derived from the current date. 
  • That login is a code generated from the current date by an algorithm. Reaching 50C meant forcing the defrost heaters to stay on across the store’s cases, not just changing a setpoint. Both took some knowledge. 
  • No AI or insider access needed, and basic cyber hygiene would have prevented it. 

Widespread food spoilage across Europe

Over the night of the 11th of October 2026, the fridges and freezers in several hundred French supermarkets were made to warm up. Stock was spoiled across Intermarché, Netto, the U cooperative, Carrefour Market and Monoprix, with E.Leclerc also reported. The Paris prosecutor has reported fires. Losses run into tens of millions of euros, with similar reports from Spain, Portugal, Poland, Germany and Belgium. 

What stands out is how little it took. 

What these controllers are 

The controllers are Danfoss AK-SM and AK-SC system managers, common across European food retail. A system manager is the box Danfoss calls the brain of the store’s refrigeration. It does not cool anything itself. It coordinates the controllers that do. 

The cooling in a modern supermarket is central. One or more compressor racks, the packs, make the cold for the whole store, and Danfoss pack controllers run them, bringing compressors in and out to match demand. Large stores now run these on CO2. Each display case and cold room then has its own small controller that manages that case: its temperature and its defrost. The system manager sits on top of all of them, logging data, raising alarms, running schedules, and pushing settings down to every controller. 

It is not a thermostat with a web page. It logs temperatures, pressures, defrost cycles and compressor load continuously, and keeps the food-safety temperature records (HACCP) that retailers are legally required to hold. It tunes how hard the plant runs to save energy, and raises alarms by email and to Danfoss’s Alsense cloud. A single store has dozens of cases and cold rooms. The logging and alarms exist because nobody can walk round reading all of them every few minutes, and a slow fault or an overnight drift would be missed if they tried. 

The built-in login 

The AK-SM has a second login path that does not use the normal username and password form. It is reached by setting undocumented attributes in a request to xml.cgi, it needs no valid account, and it returns an administrative session if you supply the right code. 

The code is generated from the device’s date by a fixed algorithm, with no per-device secret, so the same code is valid on every unit for a given day. The controller will even hand out its own date to anyone who asks, without logging in, so you do not have to guess what day it thinks it is. 

Working out the code means recovering the algorithm. Two teams have done it: Synacktiv in 2023 on the SM800, SC255 and SC355, and Claroty’s Team82 on the current AK-SM 800A in 2026, where it is CVE-2025-41450. Neither published the algorithm or a working proof of concept, so it is not a copy-paste exploit today. It is also not hard to reach. With the firmware in hand, recovering it is a modest reverse-engineering job, and once recovered the same daily code opens every exposed unit and can be scripted. 

Getting a freezer to 50C 

Getting in is the easy part. Turning that into warm food, and then into a fire, takes a bit of knowledge of how the refrigeration works. 

A refrigerated case cools the air with an evaporator coil, the cold part behind the cabinet. Moisture freezes onto that coil as frost, the same as in a home freezer. Frost insulates the coil and chokes the airflow, so the case gets less efficient. To clear it, the controller runs a defrost: it stops cooling that case and switches on an electric heater on the coil for a few minutes to melt the frost, then goes back to cooling. A sensor or a timer ends the defrost once the coil is clear, so the heater is never on for long. 

Change a case’s target temperature and it drifts up to store ambient, around 20C to 25C, which is enough to ruin stock. To push past that you force the defrost to stay on and defeat the sensor and timer that end it, so the heater just keeps heating. The settings that control defrost, its method, its schedule, the termination temperature and the time limit, are ordinary parameters, described in the Danfoss manuals. 

The heater lives on the case controller, not the system manager, so the attacker is really reconfiguring dozens of case controllers, not one box. That is not one click. What makes it practical is that the system manager is built to push settings to every controller at once, and to disable the alarms at the same time so nobody is paged. So: trivial to get in, a bit of refrigeration knowledge to turn it into damage, then scriptable across the whole store. Someone who understood supermarket refrigeration, or who read the documentation, could do it. 

The fires are the part that turns spoiled stock into a safety incident. A defrost heater is built to run for short periods. Held on continuously it runs for far longer than it is meant to, and can get hotter. The heaters usually have a thermal cut-out of their own, so they should trip rather than burn. Where there is already a weak point, such as a poor electrical connection, the extra duty is what makes it overheat and smoke. That makes the fires look like a side effect of running the heaters far outside their normal duty, not something the attacker set out to cause, and not something that would happen at all sites. 

Why were they on the internet 

Whoever put these controllers online was not trying to expose a control system, but that is what happened. The refrigeration is usually fitted and maintained by a third party who needs remote access to it. A cellular modem on the unit is the quick way to give them that, quicker than asking the retailer for a managed connection. So the controller ends up on the internet, on a link the retailer often does not own, cannot see, and has no record of. The people who would normally catch an exposed management interface never get the chance. 

Who did it 

We do not know, and the barrier is low enough that it does not narrow the field much. A bored teenager could have done this. So could a state actor choosing a deniable, low-cost way to disrupt a country’s food retail. There are also reports that these controllers were attacked quietly a few years ago, so it would not be the first time. Now that it is front-page news and trivial to repeat, expect copycats within weeks. 

This is not just Danfoss 

This is not specific to one vendor. The pattern is a refrigeration or building controller with a web interface on the public internet and a built-in credential never meant to be reached from there. CISA covered both Danfoss and Copeland in the same advisory batch in August 2025. 

In separate research, now in coordinated disclosure, we found internet-exposed controllers from another vendor already compromised by a botnet. We pulled and analysed the implant. The devices are low-powered and on slow cellular links, which rules out crypto mining and makes them poor for denial-of-service. On that reasoning, what is left is access. Someone is collecting footholds on the same class of device that just spoiled a few hundred supermarkets. We will publish the detail once disclosure completes. 

Basic hygiene would have prevented it 

Two things would have changed the outcome. Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor’s own connection, change known and default credentials, and patch to a current release. CERT-FR said the same in CERTFR-2026-ALE-012 on the 12th of October. 

There was plenty of warning 

The access was known, the mechanism documented, and the fix available. The devices were still on the internet and still on old firmware. 

Takeaways 

If you run refrigeration, or any controller a contractor reaches remotely, assume it is on the internet until you have checked. Take it off the internet, put remote access behind a VPN and an allowlist, change known credentials, and patch. That is the baseline, not the whole job. Owning and documenting these third-party connections, monitoring them, and segmenting the network properly all sit behind it. 

None of this needed sophistication. It needed a controller on the internet and a login anyone can generate. Both are things you can find and fix today.