Skip to content
HACKTECH
Mobile & IoTReported Published 6 sources

US agencies warn of attacks on refrigeration controllers after European supermarket hacks

CISA, the FBI and the US Departments of Health and Human Services, Agriculture and Transportation warned on 5 November 2026 that attackers are targeting unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. According to BleepingComputer, the warning followed October attacks that remotely defrosted refrigerators at an estimated 250 to 350 French supermarkets, a second wave affecting more than 115 stores across six European countries, and an incident at three facilities of France's blood service. The agencies urged operators to take controllers off the public internet, change default passwords and apply available updates.

  • OT security
  • industrial IoT
  • refrigeration controllers
  • Danfoss
  • CISA advisory
  • critical infrastructure

What the sources report

  • The agencies said attackers may exploit authentication bypass flaws, code injection or weak configurations to change temperature settings and force units into continuous heating or defrost cycles, risking inventory loss, equipment damage and fire hazards.
  • BleepingComputer reported that the October attacks hit controllers running older Danfoss software and that the attacks targeted Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers; at the time of the October attacks it said no information was available on how the controllers were compromised.
  • TechCrunch reported that some affected systems were Danfoss units that no longer received security updates and, citing Reuters, that the US Department of Defense is investigating hacks targeting freezers run by the military.
  • Claroty Team82's August 2026 write-up detailed CVE-2025-41450 (an authentication bypass through a hidden code-of-the-day mechanism), CVE-2025-41451 (post-authentication command injection leading to remote code execution) and CVE-2025-41452 in Danfoss AK-SM 800A controllers, addressed in firmware R4.3.1, and counted 2,765 exposed devices on Censys; BleepingComputer said it had not been confirmed whether these flaws were exploited in the attacks.
  • France's blood service, EFS, said a 2 November incident at a refrigeration supplier raised temperature and defrost thresholds at three facilities, with no health impact identified and no loss of blood products reported, according to BleepingComputer.
  • According to TechCrunch, the US has not attributed the activity; the agencies' recommendations include securing necessary remote access, isolating OT from business networks, retiring unsupported equipment and enforcing safe temperature limits.

What it means for your organisation

The incidents share a pattern: refrigeration controllers reachable from the internet, in some cases on older or unsupported software, and managed remotely through third-party service providers. The impact is physical, from spoiled stock to equipment damage and risk to stored blood products, and such systems can sit outside IT asset inventories and penetration test scopes. Claroty's August write-up counted 2,765 exposed Danfoss AK-SM 800A controllers on Censys, so the first check is whether any of them are yours.

What we check

  • Scan external IP ranges and internet-scan data such as Shodan and Censys for exposed refrigeration, HVAC and building-management web consoles, including Danfoss and Copeland/Dixell interfaces.
  • Confirm controller firmware against vendor advisories (for Danfoss AK-SM 800A, R4.3.1 or later according to Claroty) and check that no default or shared credentials remain.
  • Map third-party maintenance access paths (VPNs, cloud monitoring portals, remote desktop tools) and confirm each requires MFA and individual vendor accounts.
  • Verify OT/IT segmentation and that independent temperature alarms and safety limits would detect and constrain malicious set-point changes.
  • Check whether incident response playbooks and tabletop exercises cover physical-impact OT scenarios, such as forced defrost cycles or malicious set-point changes.

Sources

Services that cover these checks

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Threat modelling

    Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

    Duration: 2 to 5 days per system, remote or on site

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works