Danfoss Fridge Hack: 23 Flaws, Fires Hit France [2026]

A cyberattack on supermarket refrigeration systems across France has turned a routine firmware gap into a national cybersecurity story, with reports of overheating fridges, spoiled stock and store-level disruption hitting retailers this week. The incident, first detailed by itnews.com.au, centres on refrigeration controllers made by Danish engineering firm Danfoss, and it has reignited a long-running warning from industrial cybersecurity researchers: operational technology (OT) that was never meant to face the public internet is doing exactly that, in thousands of stores, right now.

The affected device is the Danfoss AK-SM 800A, a supervisory controller used to monitor and manage cooling systems in supermarkets, cold-storage warehouses and distribution centres. According to Danfoss, the units involved in the French incidents were running outdated firmware, and the company says it has “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions,” a statement carried by The Straits Times. For an Australian retail and cold-chain sector that leans just as heavily on remotely managed refrigeration, the episode is a pointed reminder that firmware patching is not an IT back-office chore. It is a food-safety and business-continuity issue.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech Australia once in the Google app and our stories appear in your news suggestions.

Add Now

What Happened to the French Supermarket Fridges

French authorities confirmed this week that refrigeration management systems in supermarkets across the country were compromised, with a person close to French Prime Minister Sébastien Lecornu describing “a vulnerability in software supplied by a Danish company” that investigators had identified and reported to the vendor, according to AFP’s reporting on the incident. French broadcaster BFM TV reported that attackers “managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores,” per the same AFP account.

Several international outlets, including the Irish Times and ABC News, have reported that the disruption extended to hundreds of stores and that some sites experienced fires alongside spoiled food. Those figures have not been independently verified by Danfoss or by French cybersecurity agency ANSSI, and the precise scale, the identity of the attacker, and the exact technical path used to reach the controllers remain unconfirmed. What Danfoss has confirmed is narrower and more specific: the company says it is “aware of incidents in France affecting a limited number of refrigeration management systems,” a statement reported by the BBC.

That gap between “hundreds of stores on fire” and “a limited number of systems” is itself a story about how cybersecurity incidents get reported in the first 48 hours. Early claims, including a widely circulated figure that attackers forced temperatures up to 50°C, have appeared in some coverage but are not clearly established in the primary vendor and investigator statements available so far. Readers should treat the headline-grabbing numbers as developing, not settled.

The Danfoss AK-SM 800A Firmware Flaw, Explained

The Danfoss AK-SM 800A is not a consumer gadget. It is a supervisory controller that sits on a supermarket’s network and talks to compressors, display cases, cold rooms and alarm systems, giving store managers and remote maintenance contractors a single web dashboard to monitor temperatures and adjust settings. That convenience is exactly what makes it a target: a web-management interface, by design, is reachable over a network, and if that network path leads back to the open internet, an attacker doesn’t need to breach a corporate firewall first. They just need to find the controller.

Industrial cybersecurity firm Claroty, through its research arm Team82, had already flagged this exposure months before the French incidents made headlines. Team82 reported three separate vulnerabilities in the AK-SM 800A platform’s embedded web-management interface. Collectively, Danfoss has said, the flaws “could allow attackers to bypass authentication, execute code, and manipulate refrigeration systems,” as reported by itnews.com.au. In practical terms, that is the entire kill chain an attacker needs: get past the login screen, run arbitrary commands, and then do whatever the controller is capable of doing to the cooling hardware underneath it.

Danfoss has released firmware version R4.3.1 to close the reported vulnerabilities. Amir Zaltzman, a Claroty vulnerability researcher, has advised affected customers to upgrade Danfoss AK-SM 800A controllers to firmware R4.3.1 or later, a recommendation also detailed by itnews.com.au. The fix exists. The problem, as with most OT patching, is getting every exposed unit in every store actually updated before the next opportunistic scan finds it.

Why Refrigeration Controllers Became the Entry Point

Supermarket refrigeration sits in an unusual spot in the technology stack. It is industrial equipment with the same risk profile as a factory floor sensor, but it is frequently procured, installed and networked by refrigeration contractors rather than IT security teams. Many of these controllers are left reachable over the internet so that the manufacturer, a maintenance contractor or head office can check on temperatures from outside the building. Climate Control News, an Australian trade publication covering the refrigeration sector, described exactly this dynamic in its own coverage of the Danfoss and Copeland disclosures, warning operators that the supervisory controllers “responsible for cooling” in supermarkets, cold-storage facilities and warehouses were affected, as detailed on climatecontrolnews.com.au. That is a direct signal to the Australian cold-chain sector that this is not a France-only problem; it is an installed-base problem.

Claroty’s Team82 Also Found 23 Flaws in Copeland XWEB Pro

The Danfoss disclosure was not an isolated finding. Claroty’s Team82 identified 23 vulnerabilities in Copeland XWEB Pro, a rival supervisory refrigeration platform used in similar commercial settings, with 21 of them classified as high severity. Copeland has released firmware version 1.13 for affected devices to address the issues. There is no confirmed link between the Copeland vulnerabilities and the French supermarket incidents specifically, but the two disclosures landed close together and describe the same underlying category of risk: web-facing management interfaces on refrigeration hardware that were never hardened for direct internet exposure.

Twenty-three vulnerabilities, more than 90 percent of them high severity, in a single refrigeration platform is a large number for any OT product line. It suggests the web-management layer on these controllers was built for convenience and local-network use cases, not for the adversarial conditions of being reachable from anywhere. That is a familiar story in industrial cybersecurity: vendors in mechanical and electrical engineering fields, like Danfoss and Copeland’s parent company, added networked control well before internet-facing security hardening became a standard part of the design brief.

Danfoss and Copeland’s Official Response

Danfoss’s public line has been consistent since the incidents came to light: the affected units were running outdated firmware, not current, patched versions. Danfoss has said the units involved “were running outdated firmware,” per reporting carried by CNN. That framing puts responsibility partly on patch management practices at the store or contractor level, rather than solely on the existence of the flaw itself, though it does not change the fact that the vulnerabilities existed in shipped firmware until Team82 reported them.

Copeland, for its part, has not been linked by name to the French incidents in the reporting available so far, and its fix, firmware 1.13, was issued as part of the standard coordinated disclosure process with Claroty rather than in response to an active attack. Both vendors’ response follows a now-familiar industrial disclosure pattern: a security research firm privately reports flaws, the vendor builds and ships a fix, and the firmware update is publicised well before any live incident forces the issue into the news.

France’s ANSSI and the Government Response

The involvement of a government-level source close to the Prime Minister’s office signals that French authorities are treating the refrigeration incidents as more than a retail IT headache. Investigators identified the software vulnerability and contacted Danfoss directly, according to the AFP report cited above, a step typically reserved for incidents that touch supply chains, food safety or critical commercial infrastructure. France’s national cybersecurity agency, ANSSI, has a long history of engaging on industrial control system incidents, and its apparent involvement here places the fridge hack in the same institutional lane as previous OT security escalations in the country, even though the exact scope of ANSSI’s investigation has not been detailed publicly.

What Remains Unconfirmed About the Attack

It is worth being precise about what this story is, and is not, at this stage. Confirmed: Danfoss AK-SM 800A controllers running outdated firmware were involved in incidents affecting French supermarkets, Danfoss has acknowledged this, and firmware R4.3.1 exists to fix the vulnerabilities Team82 found. Unconfirmed: the identity of the attacker or attackers, the exact technical exploit chain used against the French stores, whether the incidents are directly tied to any specific CVE number, whether temperatures were driven to a specific figure such as 50°C, whether fires were a widespread consequence rather than an isolated one, and the total number of stores or the financial scale of any food loss. No Australian supermarket chain or company has been identified as a victim in any of the reporting reviewed.

That distinction matters for anyone running refrigeration infrastructure. The actionable lesson, patch the AK-SM 800A and audit any internet-facing refrigeration controller, does not depend on resolving every unconfirmed detail of the French incident. The vulnerability existed and was reported months before this week’s headlines; the patch has existed since then too.

Danfoss AK-SM 800A vs Copeland XWEB Pro: The Two Disclosures Compared

Both platforms serve the same market, supermarket and cold-storage refrigeration supervision, but the scale of the two disclosures differs sharply. The table below lays out what Claroty’s Team82 reported for each.

Detail	Danfoss AK-SM 800A	Copeland XWEB Pro
Vendor	Danfoss (Denmark)	Copeland
Vulnerabilities reported by Team82	3	23
High-severity flaws	Not separately broken out	21
Fixed firmware version	R4.3.1	1.13
Reported impact of flaws	Authentication bypass, code execution, system manipulation	Authentication bypass, code execution (per Claroty’s disclosure)
Linked to confirmed live attack	Yes – French supermarket incidents (Danfoss acknowledged)	No confirmed live incident reported
Deployment context	Supermarkets, cold storage, warehouses	Supermarkets, cold storage, commercial refrigeration

How This Compares to Past OT and ICS Attacks

The French refrigeration incidents sit inside a well-established pattern of attacks on operational technology, even though each case has a different motive, method and outcome. Security researchers have warned for years that OT, the physical control systems running factories, pipelines, power grids and now supermarket cooling, carries more real-world consequence per compromised device than a typical IT breach, because the device controls something physical rather than just data.

The 2013 Target breach remains the textbook cautionary tale: attackers got into the retailer’s network through credentials belonging to a third-party HVAC and refrigeration contractor, then moved laterally to point-of-sale systems and stole tens of millions of customers’ payment card details. It wasn’t a refrigeration-manipulation attack, but it established the template of refrigeration and building-management vendors as a soft entry point into retail networks, a theme that echoes directly into this week’s Danfoss story. Ukraine’s power grid was twice knocked offline by remote attackers, in 2015 and again in 2016, demonstrating that industrial control systems could be manipulated to cause real, physical disruption at national scale. The Triton (also known as Trisis) malware, uncovered in 2017, went further still, targeting the safety-instrumented systems at a Middle Eastern industrial facility, systems whose entire purpose is to prevent catastrophic failure. And the 2021 Colonial Pipeline ransomware incident showed that even an attack confined to corporate IT systems could force a physical shutdown of fuel delivery across the US East Coast, because operators couldn’t be sure the IT and OT environments weren’t entangled.

Year	Incident	Sector	Attack Vector	Outcome
2013	Target data breach	Retail	Compromised HVAC/refrigeration contractor credentials	Tens of millions of payment cards stolen
2015–2016	Ukraine power grid attacks	Energy	Remote access to grid control systems	Widespread, temporary power outages
2017	Triton/Trisis malware	Industrial/energy	Malware targeting safety-instrumented systems	Attempted sabotage of plant safety controls
2021	Colonial Pipeline ransomware	Energy/fuel	Ransomware on corporate IT network	Multi-day shutdown of pipeline deliveries
2026	French supermarket fridge incidents	Retail/cold chain	Danfoss AK-SM 800A web interface (reported)	Refrigeration disruption, food loss reported

What makes the French incidents distinct from most of this history is the target: not power, not fuel, not payment data, but the humble supermarket fridge. If confirmed in full, it would mark one of the more visible examples yet of an OT attack aimed squarely at a retail cold chain rather than at critical national infrastructure in the traditional sense.

Market Impact: Vendors, Retailers and Insurers

For Danfoss and Copeland, the immediate commercial impact is reputational rather than financial in any confirmed sense, since both companies had already shipped fixes before this week’s reporting. But the broader refrigeration-controls market, which includes rivals and adjacent building-management vendors, now faces renewed customer pressure to demonstrate that their own web-management interfaces aren’t carrying similar flaws. Expect procurement teams at major retail chains to start asking refrigeration vendors for a security disclosure history and a patch cadence commitment as a condition of contract renewal, not just an energy-efficiency spec sheet.

Insurers are the other quiet mover here. Cyber insurance policies for retail and food-service businesses have historically focused on data breach and ransomware scenarios. An incident that spoils stock and potentially damages equipment through a firmware exploit sits closer to a property and business-interruption claim than a typical cyber claim, and insurers will likely start asking pointed questions about refrigeration network segmentation during underwriting, the same way they already ask about point-of-sale network isolation after the Target-era lessons.

Why Internet-Exposed OT Keeps Happening

The recurring theme across the Danfoss, Copeland, Target, Ukraine grid and Colonial Pipeline cases is not that any single vendor built catastrophically bad software. It’s that operational technology, by its nature, outlives the IT security assumptions it was designed under. A refrigeration controller installed a decade ago to let a maintenance contractor dial in from head office wasn’t designed against today’s internet-wide scanning tools that can find exposed management interfaces in minutes. Climate Control News’ warning to Australian operators to check and update their controllers reflects exactly this lag between device lifespan and security expectations.

Segmentation, the practice of keeping OT devices on a separate network from corporate IT and the open internet, remains the most reliable mitigation, but it is also the hardest one to retrofit across thousands of existing store sites without a forklift upgrade of networking hardware. That tension between “patch everything” (slow, expensive, store-by-store) and “the vulnerability is already public” (fast-moving, scanner-driven) is exactly what plays out in the weeks after any coordinated OT disclosure like this one.

What Australian Retailers and Cold Chain Operators Should Do Now

No Australian supermarket chain has been named as a victim in the reporting on this incident, but the Danfoss AK-SM 800A and Copeland XWEB Pro are both sold and installed in the Australian commercial refrigeration market, and Climate Control News’ warning was itself directed at exactly that local audience. The practical response for any retailer, cold-storage operator or refrigeration contractor here is straightforward and doesn’t require waiting for more details out of France.

Inventory every Danfoss AK-SM 800A (and related AK-SM800/AK-SC355) and Copeland XWEB Pro controller across every site, including ones installed by third-party refrigeration contractors.
Confirm each unit is running Danfoss firmware R4.3.1 or later, or Copeland firmware 1.13 or later, and schedule updates for anything behind.
Check whether any refrigeration management interface is directly reachable from the public internet, and move it behind a VPN or segmented remote-access gateway if it is.
Rotate default or long-unchanged credentials on controller web interfaces as part of the firmware update process.
Ask refrigeration maintenance contractors directly whether remote access to store controllers is authenticated, logged and restricted to specific source addresses.

None of this requires exotic tooling. It is the same segmentation and patch-hygiene discipline that OT security specialists have been recommending since well before this week, and it is the exact fix Danfoss itself is pointing customers toward.

The Three Danfoss Vulnerability Classes, in Brief

Danfoss has not published a granular public breakdown of each of the three AK-SM 800A flaws Team82 reported, but the company’s own description of the combined risk gives a reasonably clear picture of what firmware R4.3.1 was built to close.

Reported risk category          | Potential consequence
---------------------------------|----------------------------------
Authentication bypass            | Attacker reaches controller
                                  | without valid credentials
Remote code execution            | Attacker runs commands on
                                  | the controller itself
Refrigeration system manipulation | Attacker alters temperature
                                  | or operational settings

That progression, get in, run code, change settings, is the standard shape of an OT compromise. It is also exactly why firmware R4.3.1 and Copeland’s 1.13 release matter more than their version numbers suggest: each closes off a stage of that chain rather than a single cosmetic bug.

Predictions: Where Retail OT Security Goes From Here

A handful of consequences look likely to follow from the French refrigeration incidents, based on how comparable OT disclosures have played out historically.

Expect a wave of firmware-update announcements from other refrigeration and building-management vendors in the coming months, as customers start asking proactively rather than waiting for a disclosure.
Expect regulators, including bodies overseeing critical infrastructure obligations, to debate whether commercial cold-chain and food-retail refrigeration should be treated as critical infrastructure for cybersecurity reporting purposes, a question Australia’s Security of Critical Infrastructure framework may eventually have to confront as cold-chain disruption risk becomes more visible.
Expect cyber insurers serving the retail and food-service sector to begin explicitly underwriting OT and refrigeration network segmentation, rather than treating it as a generic IT control.
Expect copycat scanning activity targeting other internet-exposed refrigeration and building-management web interfaces, since public disclosure of a vulnerability class reliably increases opportunistic probing even when the original flaw is patched.
Expect Claroty and other OT security researchers to publish further refrigeration and building-management research, given how much attention this disclosure pairing has already generated.

Frequently Asked Questions

What is the Danfoss AK-SM 800A?
It is a supervisory refrigeration controller made by Danish company Danfoss, used in supermarkets, cold-storage facilities and warehouses to monitor and manage cooling systems through a web-based management interface.

Did hackers actually heat French supermarket fridges to 50°C?
Some media reports have cited a 50°C figure, but this detail has not been clearly confirmed by Danfoss or French investigators in the primary statements available. Treat it as a reported claim, not an established fact.

Has Danfoss fixed the vulnerability?
Yes. Danfoss has released firmware version R4.3.1, which addresses the three vulnerabilities Claroty’s Team82 reported in the AK-SM 800A’s web-management interface.

Were any Australian supermarkets affected?
No Australian company or supermarket chain has been identified as a victim in the reporting reviewed. The confirmed incidents are in France. However, both affected controller platforms are sold in the Australian market, which is why local trade publication Climate Control News urged operators to update their systems.

What is Claroty’s Team82?
Team82 is the vulnerability research division of industrial cybersecurity firm Claroty. It reported the three Danfoss AK-SM 800A vulnerabilities and the 23 vulnerabilities in Copeland XWEB Pro that prompted both vendors’ firmware fixes.

What vulnerabilities were found in Copeland XWEB Pro?
Claroty identified 23 vulnerabilities in the platform, 21 of which were classified as high severity. Copeland has released firmware version 1.13 to address them. No confirmed live attack has been publicly linked to the Copeland flaws specifically.

Is this attack linked to a specific CVE?
A direct link between the French incidents and any specific CVE identifier has not been established in the available reporting. The vulnerability categories, authentication bypass, code execution and system manipulation, have been described by Danfoss and Claroty, but a confirmed CVE tie to the live attack itself remains unconfirmed.

How can a business protect its refrigeration systems from a similar attack?
Inventory every internet-connected refrigeration controller, confirm firmware is current (R4.3.1 or later for Danfoss AK-SM 800A, 1.13 or later for Copeland XWEB Pro), remove direct internet exposure of management interfaces, and rotate credentials as part of the update process.