Cyberattack on Connected Fridges in France

Another IoT cyberattack, this one in France:

Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected.

[…]

Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process.

Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.

Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that can be updated is also vulnerable.

Tags: cyberattack, cybercrime, France, Internet of Things

Posted on October 14, 2026 at 10:10 AM • 8 Comments

Comments

Gordon • October 14, 2026 10:54 AM

Unfortunately the BBC story doesn’t say how the attackers gained access to the network(s) in the first place.

Given the number of affected devices and the stated vulnerability being the software in each device, it seems they were all available for anyone on the internet to attempt to hack.

Why would individual devices, in this case refrigerated display cases, be directly exposed to the wider internet? Is my mental model of the network architecture somehow wrong?

I’m assuming each store has a security device at the transition to the internet, say “router on a stick” architecture, and that the central office would use VPN to connect to the router so the central control mechanism can act as if its on the LAN inside each store.

Seems to me like the problem is not only firmware which can no longer be updated, but also poor network security practices. What am I missing here?

Stéphane Bortzmeyer • October 14, 2026 12:40 PM

@Gordon We don’t know everything yet. What is known: there have been reports on the vulnerability of this brand https://blog.claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers (no proof that it was these vulns that were used this week), Danfoss has several weaknesses https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/ https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01/

The rest is mostly hearsay (the CTO refused to connect the fridges through the local network so the company in charge of the fridge used a direct 4G connection, this sort of stuff).

lurker • October 14, 2026 1:25 PM

@Gordon
you’re not missing anything, @Bruce summed it up perfectly:

“Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that can be updated is also vulnerable.”

Clive Robinson • October 14, 2026 2:49 PM

@ Bruce, ALL,

This is not the first recent attack on networked fridges in shops.

I provided a link in,

https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-i-caught-a-squid.html/#comment-458947

To the Stars and Stripes US military magazine.

They reported that several military base commissary refrigerators had mysteriously been hacked,

Army, Air Force special agents investigate refrigerator outages affecting several commissary stores

Three military criminal investigation agencies confirmed Tuesday agents are investigating refrigeration outages that occurred at commissary stores across the country within days of each other.

“Army Criminal Investigation Division’s Cyber Field Office and Air Force Office of Special Investigations confirmed they have active investigations into the situation. The Air Force said that the Defense Criminal Investigative Agency is taking the lead.

None elaborated on the nature of the investigation.

Unverified sources have suggested the outages affected up to a dozen stores, though the Defense Department has declined to release anything beyond an acknowledgment of a “possible refrigeration disruption.”

It was also unclear Tuesday how many of the outages persisted at the stores, which remained open to sell dry goods.“

‘https://www.stripes.com/theaters/us/2026-09-01/army-cid-investigates-commissary-refrigerator-outages-22721718.html

Whilst the Military agencies are not saying very much, the article has indicated that,

“Last month, several security news outlets cited research that noted there can be security flaws in refrigeration systems that make them vulnerable to an outside attack.”

Clive Robinson • October 14, 2026 3:26 PM

@ Bruce,

You might want to update things.

Apparently it was not just France,

“Most of the damage was done in France, but food retailers in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain were also affected.”

https://www.securityweek.com/refrigeration-controller-hack-spoils-food-across-european-supermarkets/

“The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives.

Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches.”

So for those wanting more attack details,

https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers

As Claroty eventually say,

“Customers using affected AK-SM 800A controllers should upgrade to firmware version R4.3.1 or later as soon as possible. Organizations should also avoid exposing management interfaces directly to the Internet and ensure that access to administrative services is restricted to trusted management networks or secured through VPNs and other appropriate network segmentation controls.”

Or in short,

“Employ Mitigation by segregation.“

Vesselin Bontchev • October 15, 2026 2:38 AM

It didn’t help that

The vulnerable fridges were discoverable with a simple Shodan query;
The credentials were username “admin” and password equal to the current date;
It was possible to log in even without credentials, with a single POST request. Reference

“Cyberattack” is such a pompous name for it. “Bored teenagers having fun with fridges run by idiots” is a more appropriate description.

Tom Frenaye • October 15, 2026 10:57 AM

The French problem also seems to have affected USA Big Y supermarkets. Customers can get products ordered for in-person pickup at local stores in New England.

Clive Robinson • October 15, 2026 11:25 AM

@ Tom Frenaye, ALL,

With regards,

“The French problem also seems to have affected USA Big Y supermarkets.”

I was looking into this over night as it’s a bit more than Big Y involved…

There is in fact a “corporate holding connection” in that a large corporation owns both European and US sales “Brands” and outlets…

But an interesting point came up as to why some have been attacked and others not…

US Food Safety Regulations are a lot weaker than European ones.

In Europe there is a requirement for near continuous monitoring and recording of food safety data to do with refrigeration.

Which in turn necessitated “24×7 safety teams” that for cost and practicality reasons were located at a central hub location often colocated with HQ or Head Office buildings and data centers.

This in turn required constant data connections from all outlets back to HQ.

Thus the bean counters pushed for low grade internet connectivity in conjunction with stock control and the like and including other electrical / environmental / security systems.

The US does not have similar levels of monitoring required. Thus in many cases although the refrigerators are networked to a central place it is only within the individual outlets thus does not require to be internet connected.

It was only companies that had EU requirements that had in effect developed their own bespoke systems that “just put the same” into their US holdings.

There is a lesson there for all security personnel, I wonder if it will however be both “learnt” and “what the lessons have taught be followed”.

Schneier on Security

Cyberattack on Connected Fridges in France

Comments

Leave a comment Cancel reply