By Thomas Anderson in Security News — 12 Oct 2026

Attackers Heated French Supermarket Fridges to 50°C by Hijacking Danfoss Controllers — ANSSI Now Says Copeland and Dixell Systems Were Hit Too

On the night of October 11, attackers took remote control of the fridges and freezers at hundreds of French supermarkets, forced them into defrost mode, and heated them to as much as 50°C. The affected stores — including at least 300 Intermarché and Netto locations run by Les Mousquetaires, per AFP — had to throw away entire stocks of food, and the Paris prosecutor's cybercrime unit has opened an investigation after reports of fires and damaged equipment. At one chain, refrigeration units ran at 50 degrees for six hours and everything inside was discarded.

The attackers reached the equipment through the controllers that run a store's fridges and freezers — devices made by Danish vendor Danfoss that maintenance firms can manage remotely. CERT-FR, the incident response arm of France's ANSSI, said in an alert published on October 12 that it is aware of "numerous compromises" affecting two Danfoss controller series, the AK-SM and AK-SC, and told operators to disconnect the controllers from the internet or filter access to them tightly. ANSSI head Vincent Strubel said it was urgent to take the two series off the internet, AFP reported. A day later, the agency updated its alert to include Copeland XWEB and Dixell XWEB systems; Copeland initially declined to confirm the findings but has since acknowledged a vulnerability.

Danfoss said most of the compromised units were older products that no longer receive updates — the AK-SM 800, end-of-life since May 2021, and the AK-SC 355, phased out in 2016 — running outdated firmware. The company told Reuters it was "aware of incidents in France affecting a limited number of refrigeration management systems" and said it is working with customers on firmware updates where available, stronger network protections, and removing direct internet exposure. Neither Danfoss nor French authorities have said who is behind the attacks or exactly how the attackers got in.

The writing has been on the wall for this attack surface. In August, Claroty's Team82 detailed flaws in the newer AK-SM 800A controllers and found thousands of publicly accessible management interfaces through Shodan and Censys, warning that undocumented functionality and insecure command construction could combine into powerful attack chains against internet-accessible cyber-physical systems. SecurityWeek notes the same research covered 23 vulnerabilities in Copeland's XWEB Pro controller, which Copeland patched in a firmware update. Danfoss's own October 2025 newsletter recorded earlier attacks on the AK-SM 800: 16 Russian supermarkets and 40 Israeli stores, all in 2022, none with proper firewall or VPN protection.

What Should You Do?

Inventory and disconnect — find every refrigeration or building controller with an internet-exposed management interface and take it offline or place it behind strict access filtering. CERT-FR's first instruction covers every AK-SM and AK-SC controller.
Restrict and rotate — limit network access to the controllers to service providers only, and change device secrets such as passwords. CERT-FR lays out a six-step response for possibly compromised systems.
Treat end-of-life hardware as unfixable — the AK-SM 800 and AK-SC 355 will never receive patches for this; plan replacement, and isolate them until they are replaced. The current AK-SM 800A should run the latest 5.3.x firmware.
Widen the sweep — the updated ANSSI alert adds Copeland XWEB and Dixell XWEB systems; check those controllers too, and check whether your stores reach their controllers through contractors rather than your own network.

The WAF Angle

Nothing about this attack runs through a web application firewall — and that is exactly the point. The pattern is one this site keeps returning to: exposed device management planes are where the internet bites back. A refrigeration controller with a reachable web management interface is no different in kind from a router admin page or a phpMyAdmin panel on a VPS: it belongs behind a gateway that terminates, authenticates, and filters — never NAT'd straight onto the public internet. If you run WAFs for a living, the transferable lessons are segmentation (OT networks should not be reachable from the same flat network as the POS), egress discipline (a fridge controller calling out to the internet is an alarm, not a quirk), and lifecycle honesty (unpatchable EOL devices are either isolated or owned). The French stores learned all three the expensive way.

Attackers Heated French Supermarket Fridges to 50°C by Hijacking Danfoss Controllers — ANSSI Now Says Copeland and Dixell Systems Were Hit Too