A refrigeration controller can change the conditions that keep food safe. The attacks on French supermarkets show why its remote access, firmware and support status belong in the security inventory.
On the night of October 11 to 12, 2026, attackers disrupted refrigeration at French supermarkets. Finance Minister Roland Lescure subsequently put the number affected at about 700. Reporting described continuous defrost cycles and settings as high as 50°C, with spoiled food and reported fires under investigation. These were not uniform outcomes across every store. Coopérative U said most of its affected locations maintained refrigeration. [1]
CERT-FR’s October 13 update lists Danfoss AK-SM and AK-SC controllers alongside Copeland and Dixell XWeb equipment. It calls for removing public internet exposure and restoring remote access through a secure VPN or protected network. [2]
How a controller becomes a cold-chain risk
The controller’s web interface is an operational control surface. A technician uses it to adjust refrigeration schedules and review alarms. If an unauthorized user gains equivalent control, legitimate maintenance functions can become a way to disrupt the process. No ransomware screen is required for the store to lose stock.
One controller. Several refrigerated cabinets.
Access to the controls
An exposed or compromised management path can put operational settings within reach.
Settings change
Temperature targets, defrost schedules and alarm configuration affect how the installation runs.
Stock at risk
Loss of temperature control can mean discarded food, interrupted sales and recovery work.
Still running does not mean still supported
Danfoss’s October 2025 product notice records the AK-SM 800 as end of life since May 2021 and the AK-SC 355 as phased out in 2016. It advises customers to arrange replacements as services for legacy products end. A controller can continue operating after that support window closes. Its ability to cool a cabinet says nothing about whether the vendor will fix its next security flaw. [3]
Supported equipment needs a different decision. Claroty Team82’s August 2026 research examined the newer AK-SM 800A, disclosed three vulnerabilities and documented a scan showing 2,765 exposed devices. Danfoss addressed the reported flaws in firmware R4.3.1. That research demonstrates a management-interface risk, but it does not establish which vulnerability, if any, was used in France. The scan is also a historical observation, not a current count of compromised systems. [4]
Schedule a verified update
Confirm the exact model and installed version. Agree a maintenance window, recovery plan and post-update checks with the technician.
Fund a replacement
Record an owner and target date. Restrict access while it remains in service. A factory reset does not restore vendor support.
Build an inventory that someone can act on
For a retailer, the equipment may belong to the store while a contractor manages it. Put the operational owner and the service provider in the same review. Start with purchase records, maintenance records, network configuration and existing monitoring. Resolve discrepancies with the site technician before considering active discovery against live equipment.
- Identity
- Site, cabinet or process served, vendor and exact model.
- Lifecycle
- Installed firmware, vendor support status and the document used to verify it.
- Reachability
- Management address, permitted networks and the route used for remote maintenance.
- Authority
- Named owner, provider accounts, privileges and the person who can revoke access.
- Next action
- Access restriction, update or replacement, with an accountable owner and due date.
Treat “unknown” as a task to resolve. An inventory entry without a site contact or maintenance owner cannot drive an urgent change. For a multisite business, reconcile the list against every location, including franchises and installations maintained under older contracts.
Separate maintenance access from temperature assurance
Danfoss’s security guidance recommends segmented networks, restricted remote access and monitoring for unauthorized activity. It also recommends a managed entry point for remote users. [5] The following design adds an operational question: would the store still receive a temperature warning if the controller’s own alarms were changed?
Two paths with different responsibilities
What to ask your team and supplier this week
- Prove the access restriction. Have the network owner and contractor document the permitted maintenance route. Check that ordinary internet access cannot reach the management interface and that approved support still works.
- Review the configuration, not just the login. Compare setpoints, defrost schedules and alarms with the approved baseline. Record unexpected changes and who authorized them.
- Test revocation across sites. Select a test provider account. Disable it and confirm that it loses access to every installation in scope. Replace default credentials and avoid one shared secret for the entire fleet.
- Exercise the alarm response. Agree a safe simulation with operations. Confirm who receives the alert after hours, how they acknowledge it and who can make the food-safety decision. Do not change live refrigeration temperatures to test cybersecurity.
- Make replacement a budget item. Give unsupported devices an interim access policy, a replacement date and a named business owner. Keep the exception visible until the equipment is retired.
If compromise is suspected, involve the operational team and incident responders before resetting equipment. Preserve available logs and configuration evidence where safe. CERT-FR distinguishes recovery from simple prevention and warns that resetting an exposed, unsupported controller alone leaves it open to renewed compromise. Its current alert should guide the equipment-specific response. [2]
For a small operator, the useful deliverable can be one verified equipment register and a provider contact who can act after hours. A large chain also needs checks for shared credentials, common remote gateways and contractors whose access spans multiple sites. The number of stores matters less than whether one account or configuration mistake can affect them all.
Use AI to assist inventory review, not to guess device safety
An AI assistant can help reconcile equipment lists, extract model names from service documents and prepare a list of vendor notices for review. Keep the source, date and model match beside each suggested finding. A similar product name is not proof that the same firmware advisory applies.
For this workflow, give the assistant read-only copies of records. Have a person verify support status and approve any network or device change. Do not connect an autonomous agent to live refrigeration controls to discover what they do. As discussed in our research on AI reverse engineering, understanding an interface and having authority to act through it are separate questions.
The lesson for defenders is practical: identify the device, verify who can reach it and assign the next maintenance decision. The French investigation may establish a specific entry method later. These checks are useful without assuming one today.
Sources and scope
This is an analysis of public reporting and vendor guidance reviewed on October 14, 2026. Oktsec has not investigated the affected stores. The diagrams and operational checklist are our explanatory analysis, not claims about a tested deployment or the attackers’ exact sequence.
- Associated Press: refrigeration attacks and the French government’s estimate, October 13, 2026.
- CERT-FR alert CERTFR-2026-ALE-012, published October 12 and updated October 13, 2026.
- Danfoss: Tech Insider October 2025, legacy product end-of-service notice.
- Claroty Team82: Freeze the Controller, Defrost the Food, August 9, 2026.
- Danfoss: controller cybersecurity recommendations, network segmentation and remote access guidance.