Glonce

Danfoss fridge dashboards sat open online before French supermarket attack

securityThe Glonce editorsHacker News🔥70Glonce rating70Impact62Novelty50Relevance65Surprise75Players45Credibility85
Danfoss fridge dashboards sat open online before French supermarket attack

On the night of October 11 to 12, 2026, fridges and freezers in hundreds of French supermarkets began to warm. Attackers had pushed the refrigeration systems into defrost mode, which heats the cooling parts to melt ice. Some units reached 50°C (122°F), some equipment caught fire according to the Paris prosecutor, and stores threw away fresh and frozen food. Reports pointed to one maker of refrigeration controllers, Danfoss, a Danish industrial company.

The damage count keeps growing. Futura-Sciences put the total at more than 400 stores, with losses that could reach several million euros. Carrefour said 80 of its stores were hit. Intermarché and Netto, both part of the retail group Les Mousquetaires, had more than 300 hit. Monoprix reported that about 5% of its stores were affected. Leclerc and Coopérative U also confirmed attacks; Coopérative U's CEO, Dominique Schelcher, told RTL that 80 of its 2,000 stores were hit, and that the stores do not buy from Danfoss directly but use a Danfoss system supplied by their refrigeration contractors.

Danfoss said most of the affected equipment was "legacy", naming the AK-SM 800 and AK-SC 355 controllers. CERT-FR, France's cybersecurity agency, said it knew of numerous compromises of AK-SM and AK-SC controllers and told operators to disconnect them or restrict who can reach them. On October 13 it updated its alert to add XWEB supervisors from Copeland, a US maker of cooling equipment, and its Italian brand Dixell. The alert says attack campaigns are probably still ongoing. Nobody has said who did it or how they got in, and the Paris prosecutor's office has opened an investigation.

IPinfo, which scans the IPv4 Internet weekly, looked at what these systems looked like beforehand. In the sweep of October 6 and 7, five days before the attack, 2,528 addresses showed a Danfoss StoreView dashboard, the web page stores and technicians use to watch and manage the controllers. France had 1,331 of them (53%), more than the other 72 countries and territories combined (1,197). Poland followed with 179, then the United States (101), Portugal (92) and Belgium (85). IPinfo cannot say why France has so many. French dashboards ran the same mix of software versions as elsewhere and connected in unremarkable ways: 98% sat on telecom providers' networks rather than in data centers or clouds, and about two-thirds went through one national provider.

The dashboards come in two generations. The older is a Flash page served by the AK-SM 800, which Danfoss declared end of life in 2023; that year the security firm Synacktiv published a login bypass for it, and Danfoss advised restricting network access. The newer runs on the AK-SM 800A, Danfoss's current model. Its dashboard shows a software build date, and 242 showed May 19, 2023, the build date of firmware 3.3. Controllers older than 3.3 miss three 2023 fixes, including one for a flaw rated critical; those older than 4.2 miss a fix for a 2025 login bypass, and those older than 4.3.1 miss two more 2025 fixes.

Overall, 85% of French dashboards (1,136 of 1,331) ran software with known security flaws, almost the same as the 84% elsewhere. That breaks down as 527 older controllers Danfoss no longer supports, 280 missing the 2023 fixes and 329 missing the 2025 fixes. Only 195 had every known fix.

The exposure was not new. Every weekly scan from late March 2026 until the attack found between 2,464 and 2,622 Danfoss dashboards open, roughly half of them in France. Of the 1,331 French dashboards found on October 6, 1,019 were open at the same address on March 30. Older unsupported controllers in France went from 519 at the end of March to 527 in October. The share of newer French controllers with every known fix rose from 14% to 24%, under two points a month.

After the attack most stores disconnected. In the October 14 scan, two days after the attack, only 316 of the 1,331 French dashboards were still online at the same address, a 76% drop; in August to early October scans only 3% to 7% vanished from one week to the next. Older unsupported controllers fell from 527 to 64. Fully updated ones also fell, from 195 to 54, which IPinfo says points to stores disconnecting them rather than updating them. Outside France, 25% disappeared, against a usual 9% to 12%. Censys, another scanning company, saw a similar 71% drop in France between October 11 and 14. On October 14 the technical director of Claroty, the firm that found the 2025 flaws, told Tom's Guide that exposed AK-SM 800 controllers were still online; IPinfo's scan that day still found 64.

France was not alone. Dashboards with known flaws were open in 69 other countries and territories, led by Poland (157), the United States (85) and Portugal (77). In some countries most of them were the unsupported older controllers: 80% in Iceland, 75% in Australia, 72% in Germany. Some reports suggest other European countries were hit too; one analyst quoted by Australia's ABC named Spain, Portugal, Poland, Germany and Belgium. IPinfo cannot say whether they were, only that all five had out-of-date Danfoss dashboards open five days before the attack.

For the XWEB supervisors added to the CERT-FR alert, the same scan found 1,611 dashboards in 66 countries but only 70 in France; Italy, where Dixell is based, had 467. Judging by build date, only 180 of 752 newer XWEB PRO units had the February 2026 fixes, and the other 859 were older models with no Copeland software update since 2018. French operators unplugged these too: 20 of the 70 were still online on October 14, a 71% drop, when a normal week loses 2% to 9%. Elsewhere, including Italy, the numbers fell at the usual rate.

IPinfo identified the dashboards with two fingerprints built by its data team, and removed sixteen non-Danfoss devices that share the older web server, plus two addresses that look like honeypots. AK-SC 355 controllers may not be in the count. An independent count by security researcher Baptiste Robert, posted on X, found 2,752 Danfoss systems online, 1,590 in France. Censys found 1,825 of the newer dashboards in France on October 11, 61% of its worldwide total. IPinfo calls its numbers a minimum: IPv4 only, only the ports it scans, and an address is not always one store. It is not publishing any addresses. CERT-FR told IPinfo it had already identified the affected systems, and IPinfo is in contact with CERT-EU.

CERT-FR's advice is to take the controllers off the public Internet and, where a contractor needs remote access, provide it through a secure VPN. Allowing only the contractor's addresses is a stopgap, not a fix. A factory reset alone is not enough, since an exposed controller that no longer gets updates will likely be compromised again. For Danfoss systems it also says to update the firmware, set the security level to Strict and change the default passwords. IPinfo adds that it cannot tell from scans how the attackers got in or who they were, and nobody has said whether any of the flaws above were used.

Key facts

  • Attackers pushed supermarket refrigeration into defrost mode on the night of October 11 to 12, 2026; some units reached 50°C, some equipment caught fire per the Paris prosecutor, and food was thrown away. Futura-Sciences counts more than 400 stores hit.
  • IPinfo's October 6 and 7 scan found 2,528 Danfoss StoreView dashboards open to the Internet, 1,331 (53%) in France, more than the other 72 countries and territories combined (1,197).
  • 85% of French dashboards (1,136 of 1,331) ran software with known flaws, including 527 older controllers Danfoss no longer supports; only 195 had every known fix.
  • The exposure was long-standing: 1,019 of the 1,331 French dashboards were open at the same address on March 30. After the attack only 316 were still online on October 14, a 76% drop.
  • Nobody has said who the attackers were, how they got in, or whether any known flaw was used; CERT-FR advises taking the controllers off the public Internet or limiting access through a secure VPN.

Why it matters

This is a physical-world attack with a visible bill: warm fridges, fires on some equipment per the Paris prosecutor, discarded food, and losses that could reach several million euros. IPinfo's scans add the context that the targets were not hidden. Control panels for the refrigeration controllers had been reachable from the open Internet at roughly the same numbers (2,464 to 2,622 per weekly scan) since late March, and many were the same devices six months on. France held more of them than the rest of the world combined.

Who it affects

French supermarket chains first: Carrefour (80 stores), Intermarché and Netto (more than 300 together), Monoprix (about 5% of stores), Coopérative U (80 of 2,000) and Leclerc, which also confirmed attacks. Beyond France, Danfoss dashboards with known flaws were open in 69 other countries and territories, led by Poland, the United States and Portugal, and 1,611 Copeland and Dixell XWEB dashboards sat in 66 countries, 467 of them in Italy. Reports of attacks in other European countries are unconfirmed in the source.

How to use it

Operators of these systems can follow CERT-FR's advice: take the controllers off the public Internet; if a contractor needs remote access, give it through a secure VPN rather than only allowing the contractor's addresses, which is a stopgap. Do not rely on a factory reset alone, because an exposed controller that no longer gets updates will likely be compromised again. For Danfoss systems, update the firmware, set the security level to Strict and change the default passwords. CERT-FR also tells operators to check their insurance terms before cutting the data their controllers send to refrigeration contractors.

How solid is it

The attack itself is backed by the Paris prosecutor, CERT-FR, Danfoss and the chains' own figures, though the store totals come from different sources (the 400-plus figure is Futura-Sciences). The exposure numbers are IPinfo's own measurements and fairly well cross-checked: Baptiste Robert counted 2,752 Danfoss systems online, 1,590 in France, and Censys saw a similar 71% drop in France between October 11 and 14. The figures are described by IPinfo as a minimum. What no one has established is the attackers' identity, their method, or which flaws, if any, were used.

Risks and caveats

An open dashboard is not proof of a break-in route: IPinfo says being able to open one does not mean anyone can break in through it. The data cannot say why France had so many exposed dashboards, which stores were hit, or whether other European countries were attacked. Counts cover IPv4 and scanned ports only, and an address is not always one store. AK-SC 355 controllers, which Danfoss also named, may be missing from the count. CERT-FR's alert says campaigns are probably still ongoing, and 316 French dashboards were still online on October 14. The drop in fully updated controllers (195 to 54) suggests stores unplugged devices rather than patched them.

“Being able to open a dashboard from the Internet doesn't mean anyone can break in through it”

— IPinfo data story by João Tomé