When multiple supermarket chains across France opened their doors in the morning, staff discovered that their cold-storage refrigeration units had warmed to room temperature. Seafood had spoiled, and frozen meats had completely thawed. There had been no power outages or mechanical breakdowns. Instead, refrigeration temperature parameters had been silently increased overnight via external network commands, forcing tons of perishable groceries into the disposal bin.
The attack affected retail locations nationwide. Scanning data from ipinfo.io revealed that 1,331 Danfoss refrigeration controllers in France were directly exposed to the public internet. Control panels intended solely for secure internal networks were left completely open to the world.
Figure: Network exposure and remote defrosting incident involving French supermarket refrigeration controllers. Source: ipinfo.io (Technical Analysis Report).
Leaving physical temperature control dashboards openly accessible online acted as the catalyst for these massive inventory losses. Industrial controllers are inherently designed for closed, trusted environments and lack baseline network defenses. Operational convenience trumped network segregation, allowing remote external requests from thousands of miles away to directly interfere with physical industrial hardware.
1,331 Controllers Exposed in One Country: France Accounts for Over Half Globally
Internet-wide scans revealed a glaring geographical imbalance. Of the 2,528 exposed Danfoss controllers detected globally, France alone accounted for 1,331—representing over 52% of the worldwide total. The remaining 72 countries combined totaled just 1,197 devices. For a single nation to exceed the rest of the world combined highlights widespread security lapses in regional engineering and installation standards.
Figure: Global public internet exposure distribution of Danfoss refrigeration controllers, with France exceeding all other nations combined. Source: ipinfo.io (Internet Scanning Report).
The primary model affected was the Danfoss AK-SM 800 series store controller. These devices manage complete supermarket refrigeration systems, reading sensor telemetry in real time to regulate compressors and defrost valves. With embedded web servers, operators could modify cold-storage setpoints with simple web browser clicks.
Public exposure counts and actual victim counts represent two distinct metrics. Internet-wide scans reveal the potential attack surface, whereas actual casualties were targets selectively chosen by the threat actors. Attackers did not need to tamper with every unit; altering temperature settings across just a few dozen stores was enough to incite industry-wide food safety panic.
Integrators Prioritize Convenience: Port Forwarding Pushes Consoles Online
The presence of these controllers on the public internet stems from HVAC maintenance habits. To diagnose issues without onsite visits, maintenance contractors routinely asked store managers to configure port forwarding on local routers. Mapping port 80 or 443 directly to public IPs allowed anyone with a web browser to access the management interface.
While eliminating travel costs for routine maintenance, this practice completely dismantled network perimeters. Industrial security standards mandate that remote maintenance route through secure VPN tunnels or dedicated jump hosts with strict authentication. To bypass dedicated private network connections, integrators simply exposed internal OT controllers directly to public internet scanners.
This vulnerability had lingered in France for over six months. As early as early October 2026, technical communities had documented unauthorized access into 433 French refrigeration controllers. Despite months of awareness, exposed device numbers barely budged, illustrating the sluggish response typical of commercial retail maintenance pipelines.
Bypassing Auth by Calculating Today’s Date: Aging Flaws Exploited in Bulk
Infiltrating these refrigeration units required minimal technical sophistication and zero zero-day exploits. Among the 1,331 exposed French controllers, roughly 85% ran outdated firmware harboring well-known vulnerabilities. Cybersecurity firm Synacktiv had already disclosed authentication bypass vulnerabilities in the AK-SM 800 series back in 2023, allowing unauthenticated actors to modify operational setpoints.
Beyond known CVEs, certain legacy firmware builds relied on crude authentication logic. Community reverse engineering uncovered a function named check_code_of_the_day. This mechanism generated dynamic daily passwords calculated strictly from the current calendar date. Anyone familiar with the algorithm could deduce valid administrative credentials on any given day, rendering access protection obsolete.
Claroty’s Team82 detailed the exploitation path for refrigeration controllers in a 2025 research publication. Combining internet search engines with lightweight automation scripts, attackers could alter temperature thresholds within minutes. Once unauthenticated industrial dashboards hit the open web, physical temperature controls become easy prey for automated scripts.
Exposure Drops 76% in One Week: Network Isolation Proves the Only Cure
The immediate financial and logistical burden of widespread food spoilage compelled operational teams to act. Within a week of the attacks, the number of publicly exposed Danfoss controllers in France plummeted by 76%. Store managers urgently unplugged public Ethernet uplinks and stripped port forwarding rules from gateway routers. By severing public internet paths, engineering teams halted further unauthorized temperature tampering at minimal operational cost.
Figure: Survival curve of exposed refrigeration controllers in France following the attacks, with over 70% taken offline within one week. Source: ipinfo.io (Network Observability Data).
The swiftness of physical cable-pulling contrasted sharply with the sluggishness of firmware patching. Danfoss’s official security advisories were explicit: isolate network access and place devices behind enterprise firewalls. Upgrading firmware across hundreds of distributed retail sites is time-consuming and labor-intensive; severing WAN routing proved to be the fastest and most dependable defense.
This incident underscores the operational reality of OT/ICS security. In the face of automated scans across the public web, network-level isolation is vastly more effective than protracted firmware rollout cycles. As long as port forwarding is closed, legacy firmware flaws cannot be triggered remotely over the open internet.
Ten-Year Lifecycle Meets Internet Exposure: Liability Blurred Between Store and Vendor
Danfoss AK-SM 800 controllers are engineered for operational lifespans exceeding a decade. With official vendor end-of-service slated for January 2027, the underlying hardware was still well within its expected operational deployment. The extended operational longevity of physical machinery stands in stark contrast to the rapid cadence of software vulnerability discovery.
Debates across the engineering community reflect split perspectives on liability. One group argues that early architectural neglect—such as hardcoded date-based passwords and fragile authentication—created long-term latent hazards. Others counter that these controllers were never intended for internet-facing roles, placing primary blame on third-party integrators who carelessly enabled port forwarding.
Similar exposure risks permeate industrial control systems across sectors, from electrical demand-response endpoints to commercial HVAC controllers. As demand for remote diagnostics escalates, failing to harden access controls turns remote connectivity into an open gateway for physical disruption.
The remote thawing of supermarket refrigerators exposes the high stakes of operational neglect in industrial settings. Leaving legacy OT firmware exposed to the open web reduces physical food safety defenses to a few lines of vulnerable code. Removing industrial controllers from the public internet and enforcing strict LAN perimeters remains the only reliable defense against physical sabotage.
Reference Links:
- ipinfo.io Investigation Report
- Hacker News Community Technical Discussion
- Claroty Team82 Research Report
- Synacktiv Vulnerability Disclosure Advisory
