1 hour ago
A supermarket freezer is supposed to keep food cold. But one night, a manager finds melting ice cream and temperatures climbing, even though the machine is still running. The controller is following every command. It is just no longer following the owner's orders, but someone else's.
That is roughly what hundreds of French supermarkets faced overnight on October 11-12. Attackers remotely forced refrigeration systems to heat up, with temperatures reported as high as 50°C, the kind of heat Delhi sees in a bad May. Food spoiled. Fires were reported.
The unsettling part is that the weakness was no secret.
“We disclosed, to Danfoss, more than a year ago, a vulnerability that actually enables an attacker to bypass the authentication,” Amir Preminger, CTO and head of Team82 at Israeli cybersecurity firm Claroty, told India Today. “Danfoss fixed and released it.”
But a fix is not a cure. “That said, a lot of the devices that we do see exposed on the internet were still vulnerable at that point in time,” he said.
India Today OSINT team reviewed the French CERT alert, Danfoss’s security advisories and Claroty’s research. The risks of internet-facing refrigeration controllers were documented before the attack. However, one of them proves what happened in France.
What the documents show
Danfoss’s own advisory describes a security flaw that could let attackers bypass the password protection on its refrigeration controllers. The flaw was rated 8.2 out of 10. The advisory warned that attackers could also access information such as internal IP addresses, usernames and store names.
These controllers allow operators to change temperatures and schedules remotely. If attackers gain access, they could potentially interfere with the systems keeping food cold.
Claroty found 2,765 Danfoss controllers exposed online in an earlier scan. Reuters later found at least 4,500 Danfoss interfaces on Shodan. These are separate scans, not counts of hacked devices.
As Amir Preminger explained, Censys and Shodan “only scan and report.” They can identify a controller exposed online, but cannot confirm whether it is vulnerable. Still, the more devices left exposed, the more potential entry points attackers can look for. French scanning firm Onyphe told Reuters that only a small minority of the interfaces it examined appeared to be running the latest software.
How they got in is unknown
“We don’t have any facts regarding how the attackers got in and were able to actually initiate the defrost process,” Preminger said.
He offered two theories, both unconfirmed. One is a default password shared across devices, cracked or leaked. The other is the Claroty flaw, which attackers may have recreated, since full technical details were never published. He also pointed to a Claroty blog post claiming AI can find that flaw for about $6 in 28 minutes. That claim is his, and India Today has not verified it.
Danfoss says many affected units had “reached end of life and no longer receive software or security updates,” or ran outdated firmware. Preminger could not confirm it. “I cannot confirm that, because they never shared an official statement regarding how the attacker got in,” he said. But reports of mostly legacy devices fit the old-firmware theory.
Patching is not simple either. “Patching of critical devices is not as easy,” he said.
Why exposure is the real risk
“Leaving those devices on the internet poses a huge risk for asset owners” without secure remote access, Preminger said. He warned that a single exposed device can provide a route into a building’s internal network, potentially putting other connected systems at risk. “From the internal network, you can do a lot of things,” he said.
The risk is not limited to refrigeration. In July 2026, the FBI and EPA reported cyberattacks targeting internet-exposed controllers at water and wastewater utilities in at least seven US states. “Attackers changed device settings and passwords, disrupting monitoring and control,” said the FBI. Reported consequences included pressure loss and flooding.
Speaking to India Today, Preminger also warned that the threat extends beyond refrigeration systems, citing cyberattacks on US water facilities. “We can see the recent publication that came, like, a few months ago from the CISA, the U.S. authority, that talked about the hacking of water facilities, and even interacting with Siemens internet-exposed devices,” he said.
Not over
CERT-FR’s alert now covers four controller families: Danfoss AK-SC and AK-SM, and Copeland and Dixell xweb. It warns that “attack campaigns are probably still underway.” A factory reset alone is not enough, it says. The device stays vulnerable and can be hacked again.
Preminger’s advice: “First of all, know what you have. Secure the way you access it, and last, if possible, patch.”
No group has claimed the French attacks, and no ransom demand has been reported.
- Ends
