Hackers turned French supermarket freezers into heaters

A supermarket freezer is supposed to keep food cold. But one night, a manager finds melting ice cream and temperatures climbing, even though the machine is still running. The controller is following every command. It is just no longer following the owner's orders, but someone else's.That is roughly what hundreds of French supermarkets faced overnight on October 11-12. Attackers remotely forced refrigeration systems to heat up, with temperatures reported as high as 50°C, the kind of heat Delhi sees in a bad May. Food spoiled. Fires were reported.The unsettling part is that the weakness was no secret. An illustrative attack chain shows how an exposed controller could be compromised, from bypassing authentication to disrupting cooling. Investigators have not confirmed this was the method used in France “We disclosed, to Danfoss, more than a year ago, a vulnerability that actually enables an attacker to bypass the authentication,” Amir Preminger, CTO and head of Team82 at Israeli cybersecurity firm Claroty, told India Today. “Danfoss fixed and released it.” But a fix is not a cure. “That said, a lot of the devices that we do see exposed on the internet were still vulnerable at that point in time,” he said.India Today OSINT team reviewed the French CERT alert, Danfoss’s security advisories and Claroty’s research. The risks of internet-facing refrigeration controllers were documented before the attack. However, one of them proves what happened in France. Publicly exposed interfaces, the Danfoss login page and security flaws documented by researchers show how refrigeration controllers could be vulnerable to remote attacks. The method used in the French attacks remains unconfirmed What the documents showDanfoss’s own advisory describes a security flaw that could let attackers bypass the password protection on its refrigeration controllers. The flaw was rated 8.2 out of 10. The advisory warned that attackers could also access information such as internal IP addresses, usernames and store names.These controllers allow operators to change temperatures and schedules remotely. If attackers gain access, they could potentially interfere with the systems keeping food cold. France’s cybersecurity alert names four refrigeration controller families: Danfoss AK-SM, Danfoss AK-SC, Copeland XWEB and Dixell XWEB Claroty found 2,765 Danfoss controllers exposed online in an earlier scan. Reuters later found at least 4,500 Danfoss interfaces on Shodan. These are separate scans, not counts of hacked devices.As Amir Preminger explained, Censys and Shodan “only scan and report.” They can identify a controller exposed online, but cannot confirm whether it is vulnerable. Still, the more devices left exposed, the more potential entry points attackers can look for. French scanning firm Onyphe told Reuters that only a small minority of the interfaces it examined appeared to be running the latest software.How they got in is unknown“We don’t have any facts regarding how the attackers got in and were able to actually initiate the defrost process,” Preminger said.He offered two theories, both unconfirmed. One is a default password shared across devices, cracked or leaked. The other is the Claroty flaw, which attackers may have recreated, since full technical details were never published. He also pointed to a Claroty blog post claiming AI can find that flaw for about $6 in 28 minutes. That claim is his, and India Today has not verified it.Danfoss says many affected units had “reached end of life and no longer receive software or security updates,” or ran outdated firmware. Preminger could not confirm it. “I cannot confirm that, because they never shared an official statement regarding how the attacker got in,” he said. But reports of mostly legacy devices fit the old-firmware theory.Patching is not simple either. “Patching of critical devices is not as easy,” he said.Why exposure is the real risk Internet-connected industrial systems, from water utilities and manufacturing to HVAC and healthcare, can face cyber risks when controllers are exposed or poorly secured. The vulnerabilities and attack evidence vary by sector “Leaving those devices on the internet poses a huge risk for asset owners” without secure remote access, Preminger said. He warned that a single exposed device can provide a route into a building’s internal network, potentially putting other connected systems at risk. “From the internal network, you can do a lot of things,” he said.The risk is not limited to refrigeration. In July 2026, the FBI and EPA reported cyberattacks targeting internet-exposed controllers at water and wastewater utilities in at least seven US states. “Attackers changed device settings and passwords, disrupting monitoring and control,” said the FBI. Reported consequences included pressure loss and flooding.Speaking to India Today, Preminger also warned that the threat extends beyond refrigeration systems, citing cyberattacks on US water facilities. “We can see the recent publication that came, like, a few months ago from the CISA, the U.S. authority, that talked about the hacking of water facilities, and even interacting with Siemens internet-exposed devices,” he said.Not overCERT-FR’s alert now covers four controller families: Danfoss AK-SC and AK-SM, and Copeland and Dixell xweb. It warns that “attack campaigns are probably still underway.” A factory reset alone is not enough, it says. The device stays vulnerable and can be hacked again.Preminger’s advice: “First of all, know what you have. Secure the way you access it, and last, if possible, patch.”No group has claimed the French attacks, and no ransom demand has been reported.- Ends