Someone Is Turning Supermarket Freezers Into Ovens

Attackers have been reaching refrigeration controllers over the internet and telling freezers to heat up, leaving supermarkets to throw away food. On 5 November 2026, CISA, the FBI and three other US agencies warned that this activity targets cold chain systems globally. Check every client's grocery, cold-storage and healthcare sites today.

TL;DR

• CISA, the FBI, HHS, USDA and DOT warned on 5 November 2026 that refrigeration controllers are being targeted globally; their fact sheet names no CVE.
• A client is exposed if a Danfoss AK-SM or AK-SC, or a Copeland or Dixell XWEB unit (France's CERT-FR list), answers from a public address; test it from outside.
• Remove internet exposure, review defrost schedules, update firmware, replace end-of-life units and change default passwords.
• Censys counted 3,124 controllers still reachable on 5 November; the latest wave hit more than 115 European stores.

What happened in the refrigeration controller attacks and who was hit?

The refrigeration controller attacks are remote changes to the settings of unpatched or internet-reachable cold-storage equipment, and CISA says attackers may use authentication bypass, code injection and weak configurations. Units can be forced into continuous heating or defrost, and staff can lose sight of current temperatures.

• 11 October 2026, France: French outlets put the toll at 250 to 350 stores, according to BleepingComputer. Intermarché blamed an attack "reportedly affecting a service provider" that manages its refrigeration.
• 2 November 2026, wider Europe: BleepingComputer reports more than 115 stores hit in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, with one Swedish store set to +50°C.
• 2 November 2026, blood storage: Three French Blood Establishment facilities were affected through a supplier; according to BleepingComputer, its alarms caught the change and it reported no loss of blood products.

According to SecurityWeek, attribution is unconfirmed. According to Cooling Post, Danfoss said the affected units were mostly legacy products or current ones on outdated firmware.

Which refrigeration controllers are affected?

CERT-FR lists Danfoss AK-SM and AK-SC plus Copeland XWEB and Dixell XWEB, but none of the sources we checked ties a specific CVE to the attacks.

The AK-SM 800A's authentication bypass, CVE-2025-41450, is rated 8.2 (CVSS). Copeland's XWEB PRO flaws had no known public exploitation when CISA published them.

How do I check if my clients are exposed to refrigeration controller attacks?

Checks 2 and 3 settle exposure; the rest look for tampering. These are appliances, so console steps run on the controller and commands run on your analysis machine, in one shell, with the client's permission. CERT-FR publishes no indicators, so a hash or IP search isn't possible. None of the sources we checked dates first access, so search the oldest retained SIEM or firewall logs; a clean result can't rule out a break-in.

1. Preserve evidence. Danfoss's user guide (BC337629891709en) lists USB exports for Audit Trail, Database and System Report. For XWEB, screenshot firmware, user and defrost screens, and request the export procedure from [email protected]. Add firewall logs. Pass: $D.sha256 lists all saved files.

   D="/srv/ir/cold-chain-$(date +%F)"; sudo mkdir -p "$D"
   # exports: one subfolder per controller, plus the firewall log export
   sudo cp -a ~/controller-exports ~/fw-logs "$D"/
   sudo find "$D" -type f -exec sha256sum {} + | sudo tee "$D.sha256"
   

2. Test outside reachability. This covers ports 80 and 443 on listed addresses only. Danfoss's HTTPS port is configurable and the name filter is our guess, so also ask the refrigeration contractor for all controller addresses and modems. Pass: ports filtered or closed, and all status lines end 000.

   while read -r H; do
     nmap -Pn -p 80,443 "$H"
     for U in "https://$H/" "http://$H/"; do
       curl -sk --max-time 10 -w "\n$U %{http_code}\n" "$U" |
         grep -Ei 'danfoss|storeview|xweb|dixell| [0-9]{3}$'
     done
   done < client-public-ips.txt
   

3. Read models and firmware. Get them from the controller screen or the contractor, then compare them with the table. Pass: all units meet their "Fixed in" build.

4. Review defrost schedules and setpoints. CERT-FR asks for a full configuration review, especially defrost schedules. Compare them with the contractor's records. Pass: all values match.

5. Review security settings and accounts. On AK-SM 800A, open Configuration > Security, then review users with the contractor. Pass: session control reads Strict and only expected accounts exist.

6. Search firewall logs. This finds outside addresses that reached the controllers; a hit needs review. Pass: no output.

   # put controller addresses in C; add the contractor's ranges to the filter
   # change src= to your firewall's source-address field
   C='203\.0\.113\.10|203\.0\.113\.11'
   sudo find "$D/fw-logs" -type f -exec zgrep -EaH "$C" {} + |
     grep -Ev 'src=(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)'
   

How do I fix exposed refrigeration controllers on client sites?

Cutting remote access can stop contractor monitoring, so CERT-FR says to check insurance terms first, and arrange on-site temperature checks.

1. Remove internet exposure. Block inbound access at the client's firewall and restore it only through a VPN or protected network; CERT-FR accepts contractor IP filtering only in an emergency. Pass: check 2's status lines all end 000.

2. Remove footholds. After a failed check 4 or 6, follow CERT-FR's order: restart the Danfoss device, factory-reset if needed, then reconfigure. For XWEB, open a Copeland support case quoting CERTFR-2026-ALE-012. Pass: check 4 values match.

3. Update or replace. Install the table's build, or replace units with no fix. According to The Hacker News, AK-SM 800A units on 3.x must move to 4.x first. CISA lists XWEB's update path. Pass: check 3 passes.

4. Rotate credentials. Change default and shared passwords and set AK-SM 800A session control to Strict; third-party XML integrations then need session tokens. Pass: the old password fails and Security reads Strict.

5. Hardening (agree with the client first). Set setpoint limits and deviation alerts, so tampering reaches a person quickly. Pass: a test deviation alert reaches the on-call contact.

6. Rerun the checks. Export fresh logs and rerun checks 2 to 6. Pass: all five checks meet their Pass lines.

Where KinoSec fits

KinoSec's autonomous external network pentest checks whether each client's refrigeration controller login page answers from the internet, and tests what an attacker could reach from the outside. That matters here because the contractor who installed the controller may not be the person watching the client's perimeter, and a contractor's modem or port forward may be missing from the IT inventory. Each run ends in findings and remediation you can hand your client, so a cold-storage risk becomes a dated item with an owner. Defrost schedules, firmware screens and user lists stay on your manual list, because they sit on the controller itself.

Frequently Asked Questions

Did CVE-2025-41450 cause the supermarket attacks?

That link is unconfirmed. According to The Hacker News, neither French authorities nor Danfoss had tied CVE-2025-41450 or its sibling flaws to the French attacks as of 13 October 2026. The same report says Claroty's tests were lab work on the newer AK-SM 800A, and that it described no attacks. Treat the CVE as a reason to patch, not as the confirmed cause.

How do I check if my clients' refrigeration controllers were hit?

First hash saved exports with sudo find "$D" -type f -exec sha256sum {} +. Then test outside reachability with nmap -Pn -p 80,443 <controller-ip>. Finally search firewall exports with zgrep -Ea '<controller-ip>' <firewall-log> and compare defrost schedules with the contractor's records. CERT-FR publishes no indicators, so a clean result can't rule out a break-in.

What if a client can't replace an end-of-life controller today?

Take it off the internet today, because CERT-FR warns that keeping an unpatched end-of-life device exposed carries a very high risk of compromise. Restore remote access only through a VPN or protected network, and treat contractor IP filtering as an emergency measure. Then get a dated replacement quote for the AK-SM 800 or AK-SC 355.

Does this affect clients that aren't supermarkets?

Yes. CISA's fact sheet says healthcare, chemical, food and agriculture, and transportation organisations widely use these systems, including refrigerated transport. Ask clients in those sectors who maintains their temperature monitoring, and add that contractor's remote access to your review.