French refrigeration attacks expose the physical cost of remote access
CERT-FR warns of compromised refrigeration controllers and urges operators to remove direct internet exposure.
France’s CERT-FR issued an alert on 12 October about numerous compromises of remote refrigeration controllers. Its 13 October revision listed Danfoss AK-SM and AK-SC controllers alongside Copeland and Dixell xweb equipment.[1]
The alert warned that attack campaigns were probably continuing. It advised operators to remove direct internet exposure, check configuration settings including defrost schedules, and restore remote access through a secure VPN or protected network. It also stressed firmware updates and manufacturer security settings.[1]
Independent reporting described supermarket disruption and spoiled stock after refrigeration settings were manipulated. The public evidence supports a serious operational incident, but does not justify attributing every affected installation to one vulnerability, attacker or access route.[2]
CERT-FR also warned that resetting an unsupported, exposed device would leave it vulnerable to another compromise. Recovery therefore involves the way equipment is connected and maintained, as well as restoring its configuration.[1]
Practical lesson: inventory the systems that control physical processes
Our analysis
An external exposure review should include building controls, refrigeration and other operational equipment. Record the owner, support status, remote maintenance route and consequence of a changed setting for each device.
Access changes and restoration should be coordinated with the operator and maintenance provider. A controller that is reachable again is not enough: teams also need to verify safe settings and an appropriate protected access path.
What remains uncertain. No definitive aggregate victim count, loss estimate or attacker attribution is asserted. The primary alert concerns several controller families and does not assign one exploit to every incident.
Sources & dates.
- CERT-FR: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigérationNational cybersecurity authority alert · Published 12 October 2026 · Updated 13 October 2026
- Danfoss moves to mitigate cyberattackTrade reporting including manufacturer statement · Published 12 October 2026
This briefing summarises linked public sources. It does not represent original incident reporting or an investigation by Dark Horizon Labs. Practical lessons are editorial analysis.