Fridges at 50°C: Hackers Hijack 700 Supermarkets via Legacy Danfoss OT Controllers — What India Must Do

On the night of 11–12 October 2026, attackers remotely commanded refrigeration controllers across France to run continuous defrost cycles, pushing cold-room temperatures as high as 50 °C — with at least one store reportedly reaching 80 °C. By dawn, roughly 700 French supermarkets had lost all their fresh and frozen inventory. France’s Finance Minister confirmed the figure; subsequent reporting showed the wave had also reached stores in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain. No ransom demand arrived. No group has claimed responsibility. And the investigation by the Paris Prosecutor’s cybercrime unit is still open.

This was not a breach of an IT database. It was an attack on Operational Technology (OT) — industrial control systems that govern the physical world — and it is the most consequential OT cyberattack against civilian retail infrastructure ever recorded. For every CIO and CISO in India’s booming cold-chain sector, this is a fire drill you cannot afford to ignore.

What Happened Overnight on 11–12 October

Investigations are ongoing and the precise initial access vector has not been confirmed by Danfoss or French authorities. What forensic evidence does show: the attackers sent legitimate-looking management commands to the refrigeration units. They did not smash a window or cut a cable; they logged in and turned a dial.

The targeted equipment — Danfoss AK-SM 800 series and AK-SC 355 central managers — sits at the heart of supermarket cold-chain management across Europe. Each unit monitors and controls dozens of individual refrigerator and freezer cabinets from a single TCP/IP interface. In large stores, one controller governs every open-fronted display cabinet in the entire fresh-food aisle. Compromise one, and you own the whole cold room.

Copeland XWEB and its Dixell-branded variant were drawn into the same wave. France’s national cybersecurity agency ANSSI issued an urgent CERT-FR alert on the morning of October 12, ordering operators to “immediately disconnect refrigeration controllers from the internet or apply strict network filtering.” The alert was revised on October 13 to extend guidance to Copeland and Dixell systems. Store-count estimates vary: BleepingComputer’s initial reporting said 250–350 stores; SecurityWeek later cited Finance Minister Roland Lescure’s statement of roughly 700 affected French outlets.

Technical Breakdown: How CVE-2025-41450 and CVE-2025-41451 Work

Claroty’s Team82 disclosed a cluster of vulnerabilities in the Danfoss AK-SM 800A platform in August 2025 — more than a year before attackers appear to have exploited them at scale.

CVE	Type	Impact	Fix
CVE-2025-41450	Authentication bypass	Admin session without credentials	Firmware R4.3.1 (AK-SM 800A only)
CVE-2025-41451	Command injection (SMTP field)	Unauthenticated RCE	Firmware R4.3.1 (AK-SM 800A only)
CVE-2025-41452	Routing manipulation / DoS	Management interface crash	Firmware R4.3.1 (AK-SM 800A only)

CVE-2025-41450 — the “code of the day” bypass: The AK-SM controller generates a time-based login code derived from its internal clock. Team82 found that an attacker who can query the device’s time (trivially, over HTTP) can reproduce the algorithm and compute today’s valid admin code without ever knowing the configured password. The result is an authenticated admin session with a single API call.

CVE-2025-41451 — SMTP command injection → root: The controller inserts the administrator’s SMTP email-server password directly into an OS shell command without sanitisation. By setting a crafted password string, an authenticated attacker can inject arbitrary OS commands executed as root. Chain CVE-2025-41450 with CVE-2025-41451 and an unauthenticated remote attacker has root access to a device managing dozens of refrigeration units.

The critical complication: the AK-SC 355 reached end-of-life in 2016 and the original AK-SM 800 in 2021. Danfoss will not issue new firmware for either. Stores running those models cannot patch their way out of this; network isolation is the only available control.

Sources: BleepingComputer · The Hacker News · SecurityWeek · RefIndustry (CVE summary) · Wikipedia incident article

The Scope Keeps Growing: Europe and Beyond

What started as a French story is now a European one. SecurityWeek’s follow-up report confirmed retailer disruptions in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain. The attacker — or attackers — appear to have run automated scans for internet-exposed Danfoss interfaces. Predicta Lab CEO Clément Domingo counted 2,752 devices exposed online; Censys put its own scan at 2,765. These are management consoles governing refrigeration in live stores — not test equipment, not development rigs. They are production systems, and they have been sitting on the public internet.

The geography of exposure maps almost exactly onto the geography of victims. France alone accounted for 1,590 exposed devices — roughly 58 percent of the global total. That asymmetry explains why French stores suffered the most, but it also means every country on that Censys scan is at ongoing risk.

The absence of a ransom demand is notable. This attack disrupted supply chains and caused significant financial damage — the cost of spoiled inventory across 700-plus stores runs into tens of millions of euros — without the attacker extracting any obvious financial gain. That profile is consistent with either a nation-state actor testing OT disruption capabilities, a hacktivist campaign, or a criminal group that decided sabotage over extortion. Investigators have not ruled out any of these.

What You Should Do Now: Sanjay’s Expert Angle on OT Security

India’s cold chain is not hypothetically vulnerable. It is actually vulnerable. Supermarkets, pharma warehouses, hospital blood banks, data-centre cooling plants, and food-processing facilities across the country run the same generation of OT controllers — some of which are no longer supported. The lessons from France apply directly.

Here are the concrete actions every Indian organisation running OT refrigeration or HVAC control should take this week:

1. Audit your internet-facing OT: Run a Shodan search for your organisation’s IP ranges. Any Danfoss AK-SM, AK-SC, Copeland XWEB, or Dixell XWEB interface reachable from the internet must be taken offline immediately. A management console for a refrigeration plant has no legitimate reason to be internet-routable.
2. Patch what can be patched: If you run Danfoss AK-SM 800A controllers, apply firmware R4.3.1 now. This addresses CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452. If you run AK-SC 355 or the original AK-SM 800, there is no patch — move to step 3.
3. Apply OT network segmentation immediately: Place every OT controller behind a firewall that enforces a strict allow-list. Only designated engineering workstations, on-site, should be able to reach the management interface — and only over an encrypted, authenticated channel. A zero-trust campus architecture with FortiGate achieves exactly this: per-device policy, micro-segmented VLAN, and hardware-enforced east-west controls. OT devices belong in their own dedicated VLAN, isolated from the corporate LAN and with no internet path whatsoever.
4. Change all default and weak credentials: The “code of the day” bypass exploits the algorithm, not a default password — but many OT controllers that survive network audits have factory-default credentials intact. Rotate all passwords on every OT device this week.
5. Enable anomaly detection on OT traffic: A refrigeration controller that normally sends telemetry at a sedate cadence should not suddenly be receiving defrost commands at 2 AM. Deploy OT-aware monitoring — whether via Fortinet’s OT Security solution, Claroty, or a similar platform — to alert on command-pattern anomalies in real time.
6. Test your OT incident-response plan: The French stores had no plan for a simultaneous, multi-site refrigeration failure. Their staff discovered the damage when morning shift arrived. Indian enterprises should have an out-of-band notification channel (SMS, not email) that triggers as soon as OT controller access is attempted outside business hours.

This story also illustrates a theme I have written about before: third-party access and zero-trust enforcement matter as much in OT environments as in IT ones. Refrigeration service contractors often have remote-access credentials to manage these units. Every such vendor account is an attack surface. Enforce multi-factor authentication, session recording, and just-in-time access for every third party with OT reach.

For organisations that deploy FortiGate for network security, it is worth noting that the same NGFW segmentation capabilities that protect your server LAN can be extended to OT VLANs. FortiGate devices have themselves been targeted by ransomware operators this year — the lesson is consistent: the firewall must be current, the OT segment must be isolated, and neither can be treated as “set and forget.”

Frequently Asked Questions

Which refrigeration controller brands are confirmed affected?

CERT-FR’s updated alert covers Danfoss AK-SM and AK-SC series, Copeland XWEB, and Dixell XWEB units. Trane also issued guidance following the incident. Other brands using similar internet-exposed management architectures should be treated with equivalent caution until their vendors confirm their status.

Is there a patch I can apply right now?

For Danfoss AK-SM 800A hardware, firmware R4.3.1 (released August 2025) addresses CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452. The AK-SC 355 (EOL 2016) and the original AK-SM 800 (EOL 2021) will receive no further patches from Danfoss. For those end-of-life models, the only available mitigation is strict network isolation: no internet path, no unrestricted LAN access, and ideally a firewall that whitelists only the specific engineering workstations authorised to manage the unit.

Should Indian organisations be worried right now?

Yes. The same Censys and Shodan scan that mapped exposed Danfoss interfaces in Europe will find any similarly exposed device in India. CERT-In has not issued a specific advisory for India, but the vulnerability is global. Any Indian organisation running Danfoss, Copeland, or Dixell refrigeration management systems should treat this as an active threat and complete a network-exposure audit before the end of this week. Pharma cold chains, hospital blood banks, and data-centre cooling systems deserve particular urgency.

What does “no attribution” actually mean for defenders?

Attribution matters for law enforcement and geopolitical response; it does not change what defenders need to do. Whether this was a nation-state, a hacktivist, or a cybercriminal group, the attack vector — internet-exposed legacy OT with unpatched credentials and no network segmentation — is the same. Defenders should focus on closing those gaps, not on waiting for an attribution conclusion that may never come.

Book a Security Assessment

OT and IT security can no longer be managed as separate disciplines. If your organisation operates cold-chain infrastructure, manufacturing plant, or any facility where a cyber intrusion could cause physical damage, you need an integrated security posture — not a patchwork of IT tools bolted onto OT networks that were designed for isolation.

P J Networks, led by Sanjay Seth, has spent three decades building network security architectures for Indian enterprises — from zero-trust campus deployments and FortiGate NGFW rollouts to NOC/SOC design and OT segmentation. Book a security assessment today and let us map your exposure before an attacker does it for you.