Overnight on 11 October, somebody reached the refrigeration controllers at hundreds of French food retailers and told them to defrost. Staff arrived to warm display cases, stock that had to be discarded and, in some stores, equipment that had started to catch fire, though the causes and extent of the reported fires are not established. No exploit has been publicly identified. The controllers did what they were asked.
The detail worth taking back to your own plant is narrower than the headlines. According to Nozomi Networks, relaying Le Monde's reporting via TIME, some defrost cycles were extended from one hour to eight, reportedly in order to delay the alarms that would normally alert staff (Nozomi Networks, a vendor blog, 13 October). Defrost is a normal function, and controllers usually delay temperature alarms while it runs. The method on display was to issue a legitimate command in an abnormal way and let the equipment's own alarm logic cover for it.
What the official alert actually says
CERT-FR published CERTFR-2026-ALE-012 on 12 October and revised it on 13 and 16 October. It reports numerous compromises of Copeland xweb, Danfoss AK-SC series, Danfoss AK-SM series and Dixell xweb remote controllers, says exposing a management interface to the internet runs against good practice, and warns that attack campaigns are probably still ongoing.
What is absent from that alert is the point. It names no vulnerability, no firmware version and no indicator of compromise, and lists product families rather than versions. As of 13 October neither any French authority nor Danfoss had said who carried out the attack or how the attackers got in (The Hacker News, 13 October).
What it does carry is blunt remediation advice. Remove internet exposure from any affected unit and any unit reachable on a public IP address. Verify the full configuration, especially the defrost schedules. Restore access only through a secure VPN or a protected network, with source IP filtering treated as an emergency measure and not a lasting solution. And it warns that a factory reset alone is insufficient, because it removes persistence while leaving the device vulnerable and likely to be compromised again.
The warning was published, with dates
Claroty's Team82 published a write-up titled "Freeze the Controller, Defrost the Food" on 9 August 2026, covering three flaws in the Danfoss AK-SM 800A: an authentication bypass through a hidden code of the day mechanism (CVE-2025-41450, CVSS v3 8.2), command injection through the alarm-to-mail configuration fields giving post-authentication remote code execution (CVE-2025-41451, 7.6) and configuration injection enabling denial of service (CVE-2025-41452, 5.4). A Censys scan in that research counted 2,765 internet-exposed AK-SM 800A devices.
The vendor fixes predate that write-up. CISA's advisory ICSA-25-140-03, published 20 May 2025 and last revised 26 August 2025, confirms R4.2 for CVE-2025-41450 and R4.3.1 for the other two. Copeland's XWEB Pro line had its own advisory, ICSA-26-057-10 of 26 February 2026: 23 CVEs at 1.12.1 and earlier, one of them a 10.0 critical authentication bypass, with a fix provided.
Much of the commentary has skipped the next part: no source has established that any of those CVEs was used in this attack. Tiago Henriques of the insurer Coalition told The Register the timeline is "particularly striking", the attacks coming two months after Claroty's research and after Danfoss's firmware update (The Register, 15 October). Striking is not causal. What is established is that Danfoss said most affected units were older models no longer receiving updates, the AK-SM 800, end of life since May 2021, and the AK-SC 355, phased out in 2016 (The Hacker News).
Exposure counts are not victim counts
On 12 October, Predicta Lab's Baptiste Robert found 2,752 Danfoss systems exposed online, 1,590 of them in France (BleepingComputer, 12 October). Coalition's scanning between 7 September and 6 October found at least 2,624 refrigeration controllers with internet-facing login pages (The Register). Shadowserver counted around 350 AK-SM 800A instances still exposed by the middle of last week, down from more than 550 earlier that week (Cybersecurity Dive, 15 October).
A visible login page is not a compromised store, and those figures count different products. The useful reading is the direction of travel: that one count fell by about 200 devices in days, which tells you the exposure was never necessary.
The device was somebody else's to manage
The attacks went through controllers that maintenance firms manage remotely (The Hacker News). That generalises well beyond food retail.
Honeywell Technologies opens its 2026 OT Cybersecurity Benchmark with exactly this scenario, under the heading "The threat came through the cooling system": a plant whose data centre depends on chillers, with the chiller controls on a facility network behind a remote access path left open for the maintenance team. In the same 603-respondent survey, 35 percent report using manual or procedural controls as part of how they secure third-party access to OT and facility systems, and only 21 percent report a complete asset inventory (Honeywell report). We wrote about that inventory gap here, and about facility systems as an attack path here.
Refrigeration, HVAC, chillers and building controls are rarely in the OT programme or the inventory, often reachable from the internet because a service contract wanted it that way, and almost never monitored for behaviour. That combination turned a defrost command into national news.
The bill lands where the policy may not
French finance minister Roland Lescure told parliament on 13 October that around 700 supermarkets were affected, and Les Mousquetaires president Thierry Cotillard put the nationwide cost at potentially tens of millions of euros, per Reuters. Insurance brokers told Reuters that cyber policies typically exclude physical losses, and Intermarché initially told AFP its insurance did not cover this type of incident (Retail Insight Network, 19 October).
CERT-FR's own guidance carries a line that should stop any asset owner reading it quickly: check your insurance contract conditions before cutting the data uploads to your refrigeration service provider. The feed that created the exposure may also be the evidence your policy requires. That is a contract problem before it is an engineering one, and the sort of thing a cyber insurance readiness review exists to find before an incident, not during one.
What to do this week
- Inventory the controllers nobody calls OT. Refrigeration, HVAC, chillers, building management, cold storage. Record model, firmware version, end of life status and who dials in.
- Find the ones on a public IP. Remove the exposure as CERT-FR instructs, checking your insurance conditions before you cut a service provider's feed, and restore access only through a VPN or protected network.
- Verify the configuration, not just the connection. CERT-FR says to check the full configuration including defrost schedules. A controller reachable only by VPN but still holding an eight hour defrost schedule is not remediated.
- Alarm on setpoint and schedule writes, not only on temperature. The attack worked because the equipment suppressed its own temperature alarm during a legitimate function. Configuration writes, unusually long defrost cycles and new remote logins would have fired first.
- Patch what has a patch, and budget replacement for what does not. R4.2 and R4.3.1 for AK-SM 8xxA, the Copeland XWEB Pro fix at or below 1.12.1. The AK-SM 800 and AK-SC 355 are past support, so there only segmentation and monitoring remain.
- Rewrite the maintenance contract. Who owns firmware, who holds credentials, how remote access is brokered, what gets logged and who sees it.
Where MBCTG fits
Every control in that list depends on two things most industrial programmes do not have: knowing what is connected, and seeing what it does. Passive asset visibility produces both without touching a controller, and it finds the refrigeration panel nobody put on the register. That is the foundation of our OT security services.
Detection is the part this incident really tested. An alarm the equipment itself delays by hours is only caught by someone watching the network around it, which is what our 24/7 SOC is for. The rest is governance: third-party access that is brokered rather than standing, segmentation you can evidence against IEC 62443, and contract and insurance terms that survive a physical loss triggered by a logical command. That is compliance and GRC work.
If you cannot name every connected controller in your facilities estate, or say who can reach it tonight, talk to an MBCTG expert. The attackers in France needed no zero day. They needed a controller on the internet and an alarm that waits.
