senn-techCold chains under attack: what is known about the Danfoss controllers and what is not
In the night from 11 to 12 October 2026 refrigeration failed in supermarkets in France. According to Help Net Security, settings on remote-controlled refrigeration controllers from the manufacturer Danfoss were altered, so that chilled and frozen cabinets warmed up and goods spoiled. The groups named are Mousquetaires (Intermarché, Netto), Coopérative U and Leclerc, and BFMTV speaks of hundreds of stores. How the attackers got in is not confirmed. This post separates what is documented from what forums suspect, and says what an operator of refrigeration systems can take from it.
What is documented and what is not
By the sources we read, only the frame is documented. According to Help Net Security a podcaster confirmed that attackers took over remote-controllable Danfoss systems, and an internal Intermarché note says the attack happened "at Danfoss". The source itself points out that it is open whether Danfoss was breached or the attackers reached the devices another way. Damage of tens to hundreds of thousands of euros per group is not independently confirmed. According to the source there is no recognisable link to the disruption at Ahold Delhaize in the Netherlands and Belgium, reported the same day.
A Tom's Hardware headline speaks of "automatic defrosting". We could not retrieve the article text, so we give the headline only as a claim.
What has been known about the system since August
On 9 August 2026 the research team Claroty Team82 published vulnerabilities in the Danfoss AK-SM 800A, a central management system for refrigeration controllers. By Claroty it sits in supermarkets, cold stores and warehouses. Three vulnerabilities concern the web interface:
| CVE | Effect | CVSS | Precondition |
|---|---|---|---|
| CVE-2025-41450 | "Code of the day" login: a password generated from the device date, which can be recomputed and opens an administrator session | 8.2 | none |
| CVE-2025-41451 | The password of the email settings reaches a shell command unsanitised, code execution possible | 7.6 | logged in |
| CVE-2025-41452 | An uploaded configuration file for the internal web server changes routes and crashes the interface process | 5.4 | logged in |
According to Claroty, Danfoss fixed the flaws in firmware R4.3.1. On the same page, though, a dashboard entry for CVE-2025-41450 refers to a patch 4.2, which contradicts the text. Anyone checking which version closes which flaw should read Danfoss's advisory. On reach, Claroty names "thousands" of reachable management interfaces and a Censys count of 2,765 AK-SM 800A. The number shows reachable interfaces and says nothing about how many run vulnerable firmware.
The same research block had a second family. For Copeland XWEB Pro, Claroty names 23 vulnerabilities, 21 of them rated high, among them the login bypass CVE-2026-25085, predictable administrator passwords (CVE-2026-21718) and 19 command injections up to root. Copeland fixed them in firmware 1.13. According to Refindustry's report the researchers showed on a field controller how the displayed temperature can be set anywhere between -50 and 110 degrees and fans switched off while the real probe keeps reading normally. Claroty's own Danfoss page contains no such demonstration. For Trane Tracer SC+ Claroty published five flaws in June, fixed from version 6.3 of 1 March 2026.
What forums suspect
Tom's Hardware's report ran on Hacker News with 911 points and 1,005 comments (thread). We read the first good 100,000 characters of the comments. The technical contributions there are mostly guesses, and we mark them as such.
Suggestions include access through the server side of a Modbus system, refrigeration units sitting on an internal network that may have been compromised for some time, or a target in building management systems attached to the refrigeration and owned by other organisations. One comment quotes the Claroty report with the 2,765 reachable controllers, and that one is documented. Practical contributions ask to separate monitoring from control, to monitor only where remote control is not needed and to provide a hardware interlock for remote defrost. One comment points to the EU Cyber Resilience Act, under which manufacturers might become liable for missing security updates. That is one commenter's reading and no legal advice.
What operators of refrigeration systems can take from it
The following points come from the recommendations of Danfoss and Claroty and from the practical contributions. They are recommendations, and no measurement of ours.
- Build an inventory of controllers and management systems, with manufacturer, type and firmware. For Danfoss AK-SM 800A R4.3.1 or newer applies, for Copeland XWEB Pro 1.13, for Trane Tracer SC+ 6.3.
- Check whether a management interface is reachable from the internet, for example with a Censys or Shodan query for your own public address. Danfoss explicitly advises against exposing management interfaces directly to the internet.
- Allow access only through a VPN or a separate management network, with segmentation between refrigeration and office network.
- Set up an alarm chain that does not run through the same controller: a temperature logger of its own with its own notification path, so that a falsified display gets noticed.
- If a service provider maintains the system remotely, settle the access and the responsibility in writing, because such systems often belong to building services and not to IT.
How we checked
On 16 October 2026 we read the Claroty publication, the reports of Help Net Security, Refindustry and ITWire, and the Hacker News thread. Discrepancies between the sources: ITWire dates the publication to 11 August and Claroty to 9 August, and ITWire writes that effects on the cooling are possible while Refindustry writes that the researchers showed them. By Refindustry the demonstration concerns the Copeland controller, and Claroty's Danfoss page has none. We did not read Danfoss's advisory. There is no measurement of ours for this case.
Further reading
Primary sources
- Claroty Team82, Freeze the Controller, Defrost the Food: Danfoss refrigeration controllers, 9 August 2026
Independent reports
- Help Net Security, Cyberattacks hit European grocers: French supermarket freezers hijacked, 12 October 2026
- Refindustry, Danfoss, Copeland and Trane address controller security vulnerabilities
- ITWire, Chilling discoveries: Claroty finds multiple security vulnerabilities in Danfoss and Copeland refrigeration controllers, 11 August 2026
Community
- Hacker News, 911 points and 1,005 comments on the Tom's Hardware report: news.ycombinator.com/item?id=50055304
Is it proven that the Claroty flaws were used in the attack in France?+
No. Help Net Security writes that neither the entry point nor a link to the flaws published in August is confirmed. In the sources we read Danfoss itself has not commented on the attack path, and an internal note from a retailer only names the place of the attack.
Which firmware closes the known flaws in the AK-SM 800A?+
According to Claroty and Danfoss, R4.3.1 or newer. On Claroty's page a dashboard entry for CVE-2025-41450 points to a patch 4.2, though, which contradicts R4.3.1 in the text. Which version fixes which CVE is in Danfoss's advisory.
Does this concern supermarkets only?+
According to Claroty the AK-SM 800A is used in supermarkets, cold stores, warehouses and other commercial settings. Anyone who stores or transports frozen goods, for example in logistics and catering, has the same class of controller, even if the manufacturers differ.