When hackers "warm up" freezers: Nearly 5,000 Danfoss refrigeration systems exposed on the Internet following attacks on French supermarkets
Recently, an incident involving the remote disabling of freezers across a series of supermarkets in France sent shockwaves through the retail sector. Even more alarming, following this attack on Danfoss systems, cybersecurity organizations conducted wide-scale scans and discovered that thousands of similar temperature control devices remain publicly exposed on the Internet without protective filtering.
Thousands of temperature controllers "exposed" in cyberspace
According to the latest statistics from the International Cyber Digest organization, a cyberspace scan revealed that as many as 4,980 Danfoss refrigeration control devices have direct, open connections to the Internet. France – where the damage was recently sustained – accounts for more than half of this figure, with 2,911 systems. The next positions are occupied by South Africa (517), Germany (171), Portugal (158), and the United States (141). Overall, 8 out of every 10 exposed devices are located in Europe.
Experts also emphasized that the presence of devices on online search engines does not mean all of them have been hacked. Nevertheless, leaving industrial control systems directly exposed to the network environment is akin to building a warehouse filled with expensive goods but forgetting to lock the front door, creating a golden opportunity for unauthorized intruders to snoop around.
Overview of the Danfoss system attack sending supermarkets reeling
The incident began unfolding in the early hours of October 11 and 12, when multiple supermarkets in France unexpectedly recorded anomalous activity. Rather than stealing customer data as in conventional data breaches, the hackers targeted freezer and chiller systems this time. They infiltrated the systems and remotely triggered the defrost function, causing the temperature of certain freezers to soar to 50°C. As a consequence, all refrigerated food and perishable inventory were severely spoiled.
The Computer Emergency Response Team of France (CERT-FR) swiftly intervened, issuing an urgent warning on October 12. They confirmed that the targeted units were the AK-SM and AK-SC management device lines. These serve as central control hubs, allowing operators to monitor and regulate temperatures, schedules, and alarms across numerous refrigeration units through a single web interface. Due to this centralized convenience, once the administrator account falls, physical damage to merchandise follows immediately.
Invisible technical vulnerabilities opening the door for bad actors
There had previously been widespread online speculation that the supermarkets were hacked due to human negligence, specifically the use of default passwords or setting the current date as the password. However, behind the Danfoss system attack lay far more complex software flaws.
The Claroty Team82 security research team identified a critical vulnerability (designated CVE-2025-41450) on legacy AK-SM 800A platforms. Specifically, this system automatically establishes a hidden daily authentication token based on a date algorithm. If adversaries analyze and reverse-engineer this algorithm, they can independently generate valid tokens to breach the system with the highest privileges without needing to know the supermarket's actual password.
Additionally, experts uncovered two other vulnerabilities related to server configuration settings and the risk of malicious code injection into the email alerting mechanism. Combined, these weaknesses enabled threat actors to easily and completely bypass the device's defenses.
Remediation solutions and protecting critical systems
On the manufacturer side, Danfoss confirmed that all compromised systems were running outdated software (firmware) versions. To prevent a repeat catastrophe, the vendor and CERT-FR recommended that stores immediately isolate refrigeration systems and sever their direct Internet connections.
If tampering is suspected, technical personnel must restore systems to factory settings, install the latest security patches, change all passwords, and review access privileges. A key secure network design principle emphasized is that facility control networks (temperature, electrical power) must be completely isolated from enterprise business networks (where staff browse the web and send emails). If remote management is mandatory, the systems must be encapsulated within strictly encrypted private channels.
The story of "warmed-up" freezers serves as a vivid reminder that modern cybersecurity risks are no longer confined to numbers on a screen; they can directly destroy a company's physical assets. Promptly updating systems and strictly controlling network connections are the only shields that can help the retail industry protect itself against increasingly unpredictable digital threats.
Reference: Cyber Security News - Danfoss Refrigeration Hack Update – 4,980 Hosts Found Exposed to Internet
