Danfoss Flaw Sat Unpatched 63 Days Before Hack [2026]

Sixty-three days. That is roughly how long passed between the day a cybersecurity research firm published detailed findings on flaws in a widely used refrigeration controller and the night those same flaws were apparently used to knock out cooling systems across hundreds of French supermarkets. The gap is now the center of a different kind of scrutiny than the one aimed at whoever carried out the attack: why a known, publicly documented vulnerability in industrial equipment sat unpatched in the field long enough for someone to exploit it.

The equipment in question comes from Danfoss, the Danish industrial technology group whose controllers run refrigeration systems in supermarkets, convenience stores and cold-storage warehouses across Europe. French cybersecurity agency CERT-FR confirmed on October 12, 2026 that it was aware of “numerous compromises” tied to Danfoss remote-control modules, kicking off a story that outlets from Le Monde to Industrial Cyber have been tracking since. What has not gotten as much attention is the timeline sitting underneath the headline numbers: a vulnerability disclosed in broad daylight, an attack that arrived afterward, and a patching gap that industrial security researchers have been warning about for years.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What Happened at French Supermarkets Overnight

According to the Associated Press, France’s cybersecurity agency said it was aware of “numerous compromises” affecting refrigeration system remote-control modules made by Danfoss. The affected equipment manages the commercial refrigeration systems that keep food cold at supermarkets, convenience stores and cold-storage facilities, meaning any disruption has a physical, perishable consequence rather than just a data one. Reports on the scale of the disruption vary: some put the number of affected stores at roughly 250 to 350, while others describe “several hundred” locations, and no single official total has been confirmed by the French government or by Danfoss itself.

What is established is the mechanism. Attackers reportedly gained remote control over the controllers that regulate a store’s fridges and freezers, rather than breaching each store’s network individually. That detail matters because it points to a single point of failure sitting inside a shared piece of industrial equipment, a pattern this site covered when it first reported on the French supermarket fridges hacked to 50 degrees story and later in its look at the broader investigation into the cyberattack across roughly 700 stores. This piece focuses on a narrower but arguably more consequential thread: the known flaw that predated the attack by two months, and what that says about how industrial refrigeration equipment gets patched, or does not.

Inside the Danfoss AK-SM and AK-SC Controllers

The product families named in CERT-FR’s reporting are the AK-SM and AK-SC series, Danfoss controllers built to centralize monitoring and control of refrigeration racks, compressors and temperature sensors across a retail site. The specific model named most often is the AK-SM 800A, a controller that gives technicians and store managers a single interface for the entire cooling system rather than having to manage each unit separately. That centralization is exactly why the equipment is attractive to attackers: compromise one controller and you can reach every fridge and freezer wired into it.

Danfoss has said the affected systems were running outdated firmware, and in some cases were older products that are no longer receiving software or security updates at all. That is a distinction worth sitting with. This was not, by the company’s own account, a case of a brand-new controller failing on day one. It was older hardware, in many cases past the point where the manufacturer still ships patches, continuing to run in production inside stores that depend on it every day.

Claroty’s August Warning: The Vulnerability Nobody Patched in Time

The part of this story that has drawn less coverage is its origin point. Industrial cybersecurity firm Claroty published research on August 9, 2026 describing vulnerabilities in the Danfoss AK-SM 800A controller. That research reported that “numerous controllers” running the Danfoss system were directly accessible from the public internet, a configuration that effectively hands a remote attacker a door into the equipment without needing to breach a corporate network first.

That disclosure sat in the public record for more than two months before CERT-FR’s October 12 alert confirmed active exploitation. The research was not buried in an obscure forum. Claroty is a known name in operational technology security, and findings about internet-exposed industrial controllers tend to circulate quickly among the people responsible for defending that equipment. The question industrial security teams are now asking is less “how did attackers find this” and more “why were these controllers still reachable from the open internet two months after someone said so publicly.”

What Claroty’s Research Actually Found

Per Cybersecurity Dive’s reporting, thousands of refrigerator-related devices remained exposed to the internet even after the October attack became public, highlighting that the August disclosure did not trigger a wholesale cleanup. Internet-facing industrial controllers are a long-running problem in operational technology circles: unlike a laptop or a phone, a refrigeration controller is rarely patched on a predictable schedule, and taking one offline even briefly can mean spoiled inventory, which gives operators a real incentive to leave an aging but functioning system alone.

The 63-Day Window Between Disclosure and Attack

Lay the two confirmed dates side by side and the window becomes clear. Claroty’s research went public on August 9, 2026. The attack that disabled refrigeration at French stores struck overnight, with CERT-FR’s confirmation following on October 12, 2026. That stretch, a little over nine weeks, is the gap in which a patch, a firewall rule, or simply pulling an exposed controller off the public internet could have closed the door that attackers eventually walked through.

Nine weeks is not an unusually short window by industrial patching standards, which is itself the uncomfortable part of this story. Operational technology environments, unlike office IT, often measure patch cycles in months or quarters rather than days, because a cooling system failure has a physical cost that a delayed software update to a laptop does not. That same caution, reasonable on its own terms, is what left a documented hole open long enough for someone to use it.

CERT-FR and ANSSI Sound the Alarm

CERT-FR, operated under France’s national cybersecurity agency ANSSI, published its alert on October 12, 2026, describing “numerous compromises” tied to the Danfoss controllers. That alert function exists specifically to give operators of critical infrastructure and retail systems a clear, timestamped warning once an active exploitation campaign is confirmed, rather than leaving companies to piece together scattered incident reports on their own.

According to CBC News, a source close to French Prime Minister Sebastien Lecornu’s office said the government had identified a vulnerability in software supplied by the Danish company and had contacted the vendor directly. That level of direct government-to-vendor contact is not a routine step, and signals that French authorities viewed the incident as serious enough to escalate outside normal reporting channels.

Danfoss’s Official Response

Danfoss has issued several statements since the attack became public, and they are worth reading closely because they draw a specific line around what the company is and is not taking responsibility for. The company said it was “aware of incidents in France affecting a limited number of refrigeration management systems,” according to Deutsche Welle, describing the affected units as “running outdated firmware.”

Danfoss also said it had “long advised customers to keep supported systems updated with the latest firmware, as well as to operate behind a firewall,” a statement that puts the responsibility for patching and network isolation on the operators running the equipment, not on the manufacturer. Separately, the company has said that some of the exposed units had “reached end of life and no longer receive software or security updates,” which is a different and arguably more difficult problem than a missed patch: there is no patch to apply, because the manufacturer has stopped making one.

That distinction, between hardware that is unpatched and hardware that is unpatchable, is the crux of why this incident is getting attention beyond the immediate disruption. This site’s earlier coverage of the operational technology risk spread across multiple vendors touched on how widespread the end-of-life equipment problem is across the refrigeration and building-controls industry; the Danfoss timeline adds a concrete before-and-after data point to that broader pattern.

Which Supermarket Chains Reported Disruption

French retailer E.Leclerc confirmed that a cyberattack affected one of its refrigeration equipment suppliers. The company said the incident was “triggering repercussions on the operation of refrigeration systems in several stores,” a carefully worded statement that acknowledges disruption without specifying a store count or financial figure.

French media reports have also named Intermarché, Coopérative U, Carrefour Market, Monoprix and Super U alongside Leclerc as chains dealing with refrigeration disruptions, though it has not been independently confirmed that every one of those retailers was affected specifically through compromised Danfoss equipment as opposed to other refrigeration suppliers. That caveat matters for anyone trying to size the blast radius of this specific vulnerability versus the broader wave of refrigeration incidents French retailers have reported in October.

Industry Reaction to the Danfoss Incident

Danfoss’s public statements, repeated across multiple outlets covering the story, have converged on a consistent message. The company told reporters that affected systems were “running outdated firmware,” language used by both Deutsche Welle and separately confirmed in company statements to other outlets, reinforcing that Danfoss views firmware currency, not a flaw in its current product line, as the central issue.

Danfoss has also stated that systems reaching end of life “no longer receive software or security updates,” a point the company has made in response to questions about why some controllers could not simply be patched after Claroty’s August research became public. And the company has reiterated that it has “long advised customers to keep supported systems updated with the latest firmware, as well as to operate behind a firewall,” placing the operational burden of segmentation and patch management on the retailers and integrators running the equipment day to day.

Retailer E.Leclerc, for its part, has stuck to narrower language, confirming only that “a cyberattack affected one of its refrigeration equipment suppliers” and that the incident was “triggering repercussions on the operation of refrigeration systems in several stores.” Taken together, the statements from both sides describe a supply chain where the manufacturer points to firmware currency and network hygiene, and the retailer points to a supplier-side compromise, with neither side yet publishing a full technical post-mortem.

Why Refrigeration Controllers Ended Up Exposed to the Internet

Industrial controllers like the AK-SM 800A are typically installed by refrigeration contractors, not IT departments, which helps explain how so many ended up reachable from the open internet in the first place. A technician who wants to check on a store’s cooling system remotely, without driving to the site, has an obvious incentive to expose a management interface to the internet. What that technician often does not have is a security team reviewing whether that exposure is safe, whether the controller is on its latest firmware, or whether a firewall rule should be sitting in front of it.

Internet-Facing Industrial Equipment Is a Known Pattern

This is not a Danfoss-specific design flaw so much as an industry-wide habit. Building management systems, HVAC controllers and refrigeration units across the retail and logistics sector have repeatedly turned up in internet-scanning research as reachable from the public web, often with default credentials or no authentication at all. Claroty’s August findings on the AK-SM 800A fit squarely inside that pattern rather than representing a new category of risk, which is part of why the October attack has struck industrial security researchers less as a surprise and more as a predictable outcome of a known, documented exposure.

Market Impact: Operational Technology Security Gets a Harder Look

For the operational technology security sector, incidents like this tend to translate into procurement conversations rather than stock swings. Retailers running refrigeration, HVAC and building-automation equipment across hundreds of stores are now the obvious audience for OT-specific monitoring tools, the kind of asset-discovery and network-segmentation products that firms like Claroty build and sell. An incident with a documented two-month gap between public disclosure and exploitation is close to a textbook argument for continuous vulnerability monitoring rather than periodic manual audits, and vendors in that space are likely to use the Danfoss timeline directly in sales conversations over the coming months.

For Danfoss and comparable industrial equipment makers, the reputational cost is less about this single incident and more about the end-of-life question it raises. A manufacturer that stops shipping security updates for older hardware still installed in thousands of active sites is making an implicit bet that those operators will either upgrade promptly or accept the risk. When that bet is wrong at scale, as it appears to have been here, the resulting coverage puts pressure on vendors across the sector to rethink how long they support legacy controllers, not just on Danfoss to fix this specific model.

Historical Context: A Decade of Industrial Control System Attacks

Attacks on industrial control systems are not new, even if a refrigeration controller is an unusually mundane target compared to past examples. The Stuxnet worm, discovered in 2010, demonstrated that software could physically damage industrial equipment by manipulating centrifuge controllers in a nuclear facility. The 2015 attack on Ukraine’s power grid showed that attackers could remotely operate circuit breakers and cut electricity to hundreds of thousands of customers. The 2021 Colonial Pipeline ransomware incident, while technically an IT-side compromise rather than a direct OT breach, still forced a major fuel pipeline offline for days out of caution about its control systems.

What connects those incidents to the Danfoss case is not scale or sophistication, since overheating supermarket fridges is a far smaller consequence than a national power outage. It is the recurring theme of industrial equipment, originally built for reliability rather than security, being connected to networks and the internet faster than the security practices around it could catch up. A refrigeration controller is a much lower-stakes target than a power grid, but the underlying failure mode, an internet-reachable industrial system running old software, is identical.

Competitive Comparison: How Industrial Equipment Vendors Handle Disclosed Flaws

Danfoss is far from alone in facing this kind of gap between disclosure and exploitation. The pattern across the industrial equipment sector generally looks the same: a security researcher publishes findings, the vendor issues a statement pointing customers toward existing update guidance, and a meaningful share of the installed base does not act on it within weeks, because doing so means scheduling downtime on equipment that is, by design, supposed to run continuously. Refrigeration, HVAC and building-automation vendors share this structural problem regardless of brand, since their customers are retailers and facility managers rather than IT security teams.

Where vendors tend to differ is in how aggressively they cut off support for older hardware versus how long they keep issuing patches for legacy product lines. A vendor that extends security support further into a product’s lifecycle gives operators more time to plan an upgrade without being exposed in the meantime. A vendor that moves end-of-life dates earlier pushes customers toward newer hardware faster, but also creates a larger population of unsupported, unpatched devices still running in the field, which is the exact condition Danfoss has described for some of the controllers implicated in this incident.

Predictions: Where This Story Likely Goes Next

Expect CERT-FR and ANSSI to publish a more detailed technical advisory in the coming weeks, once the investigation into the specific exploitation method is further along, following the pattern set by the October 12 alert.
Danfoss will likely face pressure to publish a concrete firmware update timeline or an extended-support program for AK-SM and AK-SC controllers that have reached end of life, rather than relying on general guidance to upgrade.
Other refrigeration and building-automation vendors will probably see a short-term spike in customer requests for internet-exposure audits, as retailers check whether their own controllers are reachable the way the affected Danfoss units were.
Operational technology security vendors, including firms like Claroty that already study this equipment category, are likely to see increased interest from retail and logistics companies evaluating continuous monitoring tools over the next two quarters.
French regulators may use this incident as a reference point in future discussions about mandatory vulnerability disclosure timelines for critical retail infrastructure, given the clean two-month gap between Claroty’s research and the confirmed attack.

Danfoss Attack Timeline

Date	Event	Source
August 9, 2026	Claroty publishes research describing vulnerabilities in the Danfoss AK-SM 800A controller, including internet-exposed units	Claroty research
Night of October 11, 2026	Refrigeration systems at hundreds of French supermarkets reportedly begin failing after remote-control compromise	Multiple outlets
October 12, 2026	CERT-FR publishes an alert confirming “numerous compromises” tied to Danfoss remote-control modules	CERT-FR
October 12 to 13, 2026	Danfoss and retailer E.Leclerc issue public statements; French government confirms it contacted the vendor directly	DW, CBC News
October 13 to 14, 2026	Reports emerge of additional refrigeration systems from other suppliers also affected in subsequent incidents	Le Monde
October 14 and after	Reporting indicates thousands of refrigerator-related devices remain exposed to the internet despite the public attention	Cybersecurity Dive

Confirmed vs Unconfirmed Details in the Danfoss Case

Detail	Status	Notes
Danfoss AK-SM and AK-SC controllers affected	Confirmed	Named directly in CERT-FR reporting
AK-SM 800A among vulnerable models	Confirmed	Named in Claroty research and subsequent coverage
Affected systems running outdated or end-of-life firmware	Confirmed	Stated directly by Danfoss
Claroty disclosure predates attack by about two months	Confirmed	Based on August 9 and October 12 dates
Exact number of affected stores	Unconfirmed	Estimates range from roughly 250 to 350 to “several hundred”
Refrigeration units reaching 50 degrees Celsius	Unconfirmed	Figure attributed to trade group SNEFCCA, not officially verified
Identity and motive of the attackers	Unconfirmed	No attribution has been made public
All named retail chains affected via Danfoss specifically	Unconfirmed	Some disruptions may trace to other refrigeration suppliers

What Retailers and IT Teams Should Watch For

For any organization running Danfoss AK-SM or AK-SC equipment, or comparable refrigeration controllers from other manufacturers, the immediate action items coming out of this incident are straightforward even if they are not easy to execute quickly. First, confirm whether any refrigeration or building-automation controller is directly reachable from the public internet, since that single condition is what Claroty’s August research flagged and what appears to have enabled the October attack. Second, check firmware versions against the vendor’s current support list, since equipment that has reached end of life will not receive a patch no matter how urgently one is requested.

Teams managing CVE remediation more broadly may find it useful to compare how this incident fits into standard vulnerability triage workflows, including the kind of patch pipelines built around CISA’s Known Exploited Vulnerabilities catalog that this site covered in its guide to building a CVE patch pipeline. The same logic that applies to chaining vulnerabilities in enterprise software, discussed in this site’s coverage of an Ivanti zero-day that let attackers chain multiple bugs for root access, applies here too: a known flaw left unaddressed for weeks or months becomes someone else’s opportunity eventually.

The Broader Lesson for Operational Technology Security

The Danfoss case will likely be remembered less for the specific inconvenience it caused shoppers in France and more as a reference point in the argument that disclosed vulnerabilities in operational technology need faster remediation paths than they currently get. A software vulnerability in a web application can often be patched within hours through an automated deployment pipeline. A vulnerability in a refrigeration controller requires a technician, a maintenance window, and in some cases replacement hardware the operator has not budgeted for. That mismatch between how fast vulnerabilities become public and how slowly industrial equipment gets fixed is the real story sitting underneath the headlines about spoiled food and overheated freezers.

Readers following the wider cybersecurity field can track how this incident compares with other recent operational technology and industrial security coverage on this site’s cybersecurity section, where the ongoing investigation into the French supermarket attacks is likely to generate further updates as CERT-FR and Danfoss release more details.

Frequently Asked Questions

What company’s equipment was targeted in the French refrigeration cyberattack?
Danfoss, a Danish industrial technology company, makes the AK-SM and AK-SC refrigeration-management controllers named in CERT-FR’s alert, including the AK-SM 800A model specifically identified in security research.

When was the Danfoss vulnerability first disclosed?
Cybersecurity firm Claroty published research describing vulnerabilities in the Danfoss AK-SM 800A controller on August 9, 2026, roughly two months before the attack was confirmed.

When did the French supermarket cyberattack happen?
Refrigeration systems reportedly began failing overnight around October 11, 2026, with France’s CERT-FR confirming “numerous compromises” in an alert published October 12, 2026.

How many stores were affected by the Danfoss cyberattack?
Reports vary, with figures ranging from roughly 250 to 350 stores to broader descriptions of “several hundred” locations. No single official total has been confirmed by French authorities or Danfoss.

Did refrigeration temperatures really reach 50 degrees Celsius?
That figure has been attributed to French trade group SNEFCCA in media reports, but it has not been officially confirmed by CERT-FR or by Danfoss.

Why were the Danfoss controllers vulnerable in the first place?
Danfoss has said the affected systems were running outdated firmware, and that some older units had reached end of life and no longer receive software or security updates. Separately, researchers found that many controllers were directly reachable from the public internet.

Which supermarket chains reported problems?
E.Leclerc confirmed disruption tied to a refrigeration equipment supplier. French media have also named Intermarché, Coopérative U, Carrefour Market, Monoprix and Super U, though it has not been confirmed that every chain’s disruption traced specifically to the Danfoss vulnerability.

Has anyone been identified as responsible for the attack?
No. The identity, motive and exact method of the attackers have not been publicly confirmed as of this writing.

Danfoss Bug Sat Exposed 63 Days Before French Hack [2026]