bk99.de entertain the web since 1997

bk99.de
TG · SecurityCurated

Heated freezers: what the attack on French supermarkets teaches

Summary

During the night to 12 October 2026, unknown attackers took over the refrigeration controllers in hundreds of French supermarkets and heated up freezers, spoiling the goods. According to the manufacturer Danfoss and the French authority CERT-FR, the cause was refrigeration controllers that were directly reachable from the internet and lacked current firmware. This post puts the incident into context and summarises what CERT-FR and the German BSI now advise operators of networked controllers.

What happened

Shortly before midnight on Sunday, 11 October 2026, temperatures began to rise in refrigerated aisles and freezers in French supermarkets. According to the Guardian, set points were changed remotely from as low as minus 27 degrees to over 50 degrees Celsius; one supermarket in Normandy reported 80 degrees. Within a few hours the goods had thawed; in some stores fires set off the sprinklers.

Stores of Intermarché, Netto, Coopérative U, Carrefour, Leclerc and Monoprix as well as independent shops were affected. The figures differ: Cybernews, citing BFMTV, reports around 400 stores, the Guardian up to 700. Two stores in Alsace reported combined losses of 270,000 euros; Intermarché CEO Thierry Cotillard expects losses in the tens of millions, which according to the retailers are hardly insured. The Paris prosecutor’s office is investigating; nobody has claimed responsibility so far.

The cause: open remote maintenance and old firmware

Supermarket refrigeration systems are usually maintained remotely by refrigeration contractors; the controllers report faults and can be operated via a web interface. Many of these interfaces were directly reachable from the internet. Danfoss stated that the affected devices were running outdated firmware; the manufacturer said it had identified security flaws the previous year and had long recommended installing updates or replacing unsupported devices.

In August 2026 the security company Claroty published three vulnerabilities in the Danfoss AK-SM 800A system manager (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452), including an authentication bypass. Danfoss fixed them in firmware R4.3.1. At the time, Claroty counted 2,765 devices of this type reachable via internet search engines. The authorities have not publicly confirmed whether exactly these vulnerabilities were used; Danfoss and CERT-FR speak of unpatched systems reachable from the internet.

According to CERT-FR, not only Danfoss devices of the AK-SM and AK-SC series were affected, but also the xweb systems from Copeland and Dixell. According to the Guardian and Hackaday, a similar incident hit refrigeration systems in US military commissaries in August.

What CERT-FR recommends

CERT-FR published alert CERTFR-2026-ALE-012 on 12 October and updated it until 16 October. The first step for devices that are not compromised: end their reachability from the internet, check the insurance conditions beforehand if the contractor needs the data for alarms, and review the entire configuration, especially the defrost schedules.

Access should then only run via a secured VPN or a protected network. Allowing only the refrigeration contractor’s IP addresses in the firewall is possible as an emergency measure, but not permanently. For Danfoss devices, CERT-FR names firmware updates, the “Strict” security mode and changed default passwords. Compromised devices should be restarted or reset to factory settings. CERT-FR explicitly warns: for devices without security updates, a reset is not enough; they remain vulnerable and are very likely to be taken over again.

The BSI recommendation

The German BSI had already issued recommendation BSI-CS 154 “Threats from internet-connected OT systems” on 9 October 2026, i.e. before the attack. It is aimed at operators of small installations, explicitly including food refrigeration, and names four steps in a fixed order: prevent direct access from the internet, secure access, keep systems up to date, make the measures routine.

In practice this means: no port forwarding to controllers, operator interfaces or industrial protocols such as Modbus-TCP; remote access at least via VPN; disable default accounts and set your own passwords. The BSI stresses that a password alone is not enough, because some vulnerabilities can be exploited without authentication, and that a dynamic IP address is no protection. Anyone who puts controllers on the internet without protection is acting “fundamentally in breach of duty”. As examples, the BSI cites attacks on more than 30 US water utilities in August 2026 and on Polish wind farms and power plants in December 2025.

Who is behind it?

Gérôme Billois of the consultancy Wavestone told the Guardian he considers two scenarios possible: young people or activists who wanted to show what they could do, or deliberate destabilisation by state actors; he names Iran and Russia. Security researcher Kevin Beaumont contradicted the portrayal as a sophisticated attack on 12 October: the cause was a lack of security by the vendor and in operation, not any special capability of the attackers.

Neither thesis is proven. According to the Guardian, initial investigations suggest that the attackers disabled alarms or extended defrost programmes so that the damage was only noticed in the morning. Billois also criticises that France has not yet implemented the EU Cyber Resilience Act of 2024, which sets minimum security requirements for networked products.

Ideas

  • Refrigeration controllers on the internet are part of the food supply.
  • Remote maintenance by contractors belongs behind a VPN, not on the open internet.
  • Firmware updates only help if they are actually installed.
  • Devices without vendor support must be replaced or taken offline.
  • Disabled alarms turn a fault into a total loss.
  • A reset removes the attackers, not the vulnerability.

Insights

  • The damage was not caused by a new attack technique, but by known and fixed vulnerabilities in devices that sat openly on the internet. Responsibility is spread across vendor, refrigeration contractor and retailer, and precisely because of that nobody felt responsible for a long time.
  • Operational technology (OT) follows different rhythms from office IT: controllers run unchanged for years, and updates are often the responsibility of an external contractor. Without contractual obligations on updates and access paths, the gap stays open.
  • Official recommendations such as BSI-CS 154 were available before the attack. The bottleneck is not knowledge, but implementation by small operators.

Facts

  • The attack began in the night from Sunday, 11 October, to Monday, 12 October 2026.
  • CERT-FR names Danfoss AK-SM and AK-SC as well as Copeland and Dixell xweb as affected systems.
  • Danfoss fixed the vulnerabilities reported by Claroty in firmware R4.3.1 for the AK-SM 800A.
  • Claroty counted 2,765 AK-SM 800A devices reachable from the internet.
  • The BSI published recommendation BSI-CS 154 on 9 October 2026.

References

Critique

  • The debate about Russia or Iran as perpetrators is a distraction: there is no evidence of a state attacker, whereas openly reachable controllers with outdated firmware are documented.
  • Devices with long-fixed vulnerabilities kept running openly on the internet without updates, and after the attack the retailers pointed to their contractors; Coopérative U stated that it is not a Danfoss customer at all. Anyone who buys remote maintenance must define access paths and update obligations contractually.

Remarks

  • Depending on the source, the number of affected stores ranges from around 400 to 700; there is no official figure yet.
  • According to the Guardian, France is, based on figures from the company Upguard and measured by exposed records, the most hacked country in Europe.

Recommendations

  • Check whether your own controllers, operator interfaces or router management are reachable from the internet, and remove port forwarding to such devices.
  • Allow remote maintenance by contractors only via VPN and specify access paths, updates and reporting obligations in the maintenance contract.
  • Check controller firmware regularly and replace devices without vendor support.
  • Set up alarms so that their deactivation is itself reported, for example via independent temperature monitoring.

Read the original article

Search the Web Archive

Own project · 2026

SYN-ACK reflection: when your own web server works for someone else’s attack

In October 2026 the firewall log of my home network suddenly showed hundreds of connection attempts to my reverse proxy, all from two networks of a Polish provider. The analysis revealed crafted SYN packets whose replies nobody ever answered, so most likely not an attack on me but on the network of the supposed senders. This post shows how to recognise SYN-ACK reflection, why my country block did not apply and how I drop the packets in OPNsense for a limited time.

RFC · 2014

RFC 7258: Pervasive monitoring is an attack

RFC 7258 explicitly declares large-scale passive monitoring a form of attack that protocol design must take into account. Threat models have to include powerful global observers.

fefe · 2013

What the hacker community knew about surveillance all along

After the Snowden revelations in summer 2013, Felix von Leitner pointed out that the hacker community had lived for years with the certainty that intelligence services were largely tapping the internet. What was new to technical people was not whether, but the extent that had become known. Above all, the community had countered, with free software ranging from PGP and TrueCrypt through Linux and FreeBSD to Firefox, Jabber and OpenSSL.