Threat reportICS/SCADATL-2026-3667
Refrigeration controller attack in France: internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers forced into defrost cycles at hundreds of grocery stores (CVE-2025-41450)
Refrigeration controller attack in France (TL-2026-3667), also tracked as French supermarket refrigerator hack, is a high-severity ICS/SCADA threat scored CVSS 8.2, first published 2026-10-15. It has no confirmed attribution, affects Danfoss AK-SM 8xxA / AK-SM800A refrigeration system manager, references 6 CVEs (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452), maps to 5 MITRE ATT&CK techniques (T1059.004, T1078.001, T1190), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 8.2/10High
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3667
- Threat ID
- TL-2026-3667
- Also known as
- French supermarket refrigerator hack, FROMAGEGATE, Danfoss refrigeration attack
- Severity
- HIGH
- CVSS
- 8.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H)
- Status
- ACTIVE
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- retail, food-and-beverage, grocery, cold-chain, industrial-control-systems
- Target regions
- france, Europe, portugal, belgium, poland, spain, netherlands, sweden, united states of america
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Refrigeration controller attack in France
Malware and tooling: Unidentified 123 (Go Infostealer), Copeland XWEB 300D PRO / 500D PRO / 500B PRO, Danfoss AK-SC355, Danfoss AK-SM 8xxA / AK-SM800A
How Refrigeration controller attack in France works
Overnight on 11-12 October 2026, an unknown party logged into internet-exposed commercial refrigeration controllers at hundreds of French grocery stores and forced defrost cycles, with cabinets reaching about 50°C and stock destroyed. CERT-FR confirmed compromises of Danfoss AK-SM/AK-SC controllers and Copeland/Dixell XWEB consoles. Press reports describe an admin login whose password is the current date (the hidden 'code of the day', CVE-2025-41450).
Between the night of 11 October and 12 October 2026, refrigeration controllers at hundreds of French supermarkets (reported banners include Intermarché/Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc; the French government put the total at about 700 retailers) were remotely driven into continuous defrost mode while stock was still inside. Cabinets reportedly climbed to about 50°C (122°F) within roughly six hours, some equipment caught fire or melted, and the food loss is estimated at €10M or more (estimates vary by outlet). CERT-FR issued alert CERTFR-2026-ALE-012 on 12 October and updated it on 13 October to list Danfoss AK-SM and AK-SC series devices and Copeland and Dixell XWEB consoles. No threat actor has been attributed, and the initial access method has not been officially established.
The mechanism most widely reported is the Danfoss AK-SM 8xxA 'code of the day' authentication bypass, CVE-2025-41450 (CWE-287, CVSS v3.1 8.2). The embedded web interface accepts a password derived from the device's current date and time, so anyone who reconstructs the algorithm can compute the accepted code for any day and obtain an administrative session. Press accounts describe the username 'admin' with the current date as the password. Danfoss fixed it in release R4.2. Two post-authentication flaws from the same Claroty Team82 research are fixed in R4.3.1: CVE-2025-41451 (CWE-77), an OS shell command injection through the alarm-to-mail configuration fields that can lead to post-authenticated RCE (CVSS v3.1 7.6), and CVE-2025-41452 (CWE-15), arbitrary nginx configuration directive injection through an authenticated upload that rewrites headers.conf and reloads the web server, giving DoS or traffic manipulation (CVSS v3.1 5.4). Claroty's architecture notes describe layered reverse proxies (external nginx, sm_fcgi_app, internal nginx, sm_app/Task_Web) with requests routed through xml.cgi. Claroty published 'Freeze the Controller, Defrost the Food' on 9 August 2026, about two months before the attack.
A second vendor family is also in scope. Copeland/Dixell XWEB Pro 300D/500D/500B (version 1.12.1 and earlier) has unauthenticated arbitrary file read CVE-2026-22877 (CWE-22, CVSS 3.7), authentication bypass CVE-2026-25085, and pre-authentication code execution via authentication bypass CVE-2026-21718 (CISA ICSA-26-057-10, reported by Claroty Team82). These match the 2026 'competing vendor' issues in Flare's analysis. Flare notes that CERT-FR added the Copeland/Dixell products on 13 October.
Flare's passive, scan-data-only analysis (published 15 October 2026) sized the exposure. It found 2,667 unique exposed controller addresses as a floor figure (France 1,293, 56.3%; rest of world 1,009). Among 786 hosts with readable build dates, 604 (76.8%) served front-end builds that predate the 2025 authentication fix. 65% of confirmed hosts (356 of 547) share a public address with at least one other service: 72 with remote desktop, 42 with cameras and 78 with VPN concentrators (IPsec, OpenVPN, L2TP). Of 1,026 responses carrying a CORS policy, 1,024 returned a wildcard origin and allowed the device's own authentication header cross-origin. Flare also found one Windows host (southern Europe) compromised by an infostealer in May 2025 with 92 saved credentials, including logins to bare IP literals on non-standard ports. One of those IPs still served the controller management interface 16 months later. Flare stresses that this is a different port on the same address, with no proof the credential was valid or used in the October incident. Separately, cybersecuritynews reported 4,980 exposed Danfoss hosts found via Shodan (France 2,911), and Claroty cited about 2,765 devices on Censys. The counts differ by method and date.
Defender takeaways: remove controllers of this class from direct internet reachability, enumerate the full port range on each public address (not just documented ports), upgrade to the fixed releases, rotate maintenance credentials, put remote maintenance behind a logged, authenticated gateway instead of a port forward, and alert on the date-derived credential pattern. A researcher published a detection-engineering repository on 13 October 2026 (device emulator, network and host detection rules, replay harness) that uses a deliberately altered authentication algorithm. Attribution is unresolved: one expert suggested the simplicity of the exploit is consistent with low-skill actors, but this is an opinion and not an attribution.
MITRE ATT&CK techniques used in TL-2026-3667
Execution
Initial Access
T1078.001 Default Accounts; T1190 Exploit Public-Facing Application
Credential Access
T1555.003 Credentials from Web Browsers
Impact
Affected products and versions in Refrigeration controller attack in France
- Danfoss — AK-SM 8xxA / AK-SM800A refrigeration system manager
Vulnerable versions: before R4.2 (CVE-2025-41450); before R4.3.1 (CVE-2025-41451, CVE-2025-41452)
Fixed in: R4.2; R4.3.1 - Danfoss — AK-SM800 and AK-SC355 (older/end-of-life models named in press reports; CERT-FR lists AK-SM and AK-SC series as compromised)
Vulnerable versions: legacy builds - Copeland / Dixell — XWEB 300D PRO, XWEB 500D PRO, XWEB 500B PRO
Vulnerable versions: 1.12.1 and earlier
Fixed in: later than 1.12.1 per vendor
Remediation for Refrigeration controller attack in France
Patches
- Danfoss AK-SM 8xxA: upgrade to R4.2 or later for CVE-2025-41450, and to R4.3.1 for CVE-2025-41451 and CVE-2025-41452 (AK-SM 800A Software Upgrade Process)
- Copeland XWEB 300D PRO / 500D PRO / 500B PRO: update beyond 1.12.1 per Copeland software updates (CISA ICSA-26-057-10)
Immediate actions
- Remove Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers from direct internet reachability; delete port forwards to controller interfaces
- Enumerate the full port range on every public address that hosts a controller, not only documented ports, and scope the review to everything forwarded to that address (cameras, remote desktop, VPN)
- Hunt web and proxy logs for logins as 'admin' whose password equals the current date (code-of-the-day pattern) and for unexpected defrost or setpoint changes
- Rotate maintenance credentials for every internet-reachable control interface on the assumption they are already in infostealer datasets
- Restrict or disable wildcard cross-origin (Access-Control-Allow-Origin: *) responses on operational technology interfaces where the product allows it
Workarounds
- Isolate controllers on a dedicated network segment and reach them only through VPN, per CISA and Danfoss guidance
- Block inbound access to controller web interfaces at the perimeter until patched
Longer-term hardening
- Place remote maintenance behind an authenticated, logged gateway/VPN rather than a port forward, and remove access after maintenance ends
- Review credential storage on contractor and maintenance machines; deploy EDR to prevent infostealer infections
- Add network and host detection for the 2025 Danfoss issues and the XWEB 2026 issues; monitor temperature and defrost telemetry for out-of-schedule cycles
- Replace end-of-life controllers that can no longer receive fixes
CVEs associated with Refrigeration controller attack in France
CVE-2025-41450, CVE-2025-41451, CVE-2025-41452, CVE-2026-22877, CVE-2026-25085, CVE-2026-21718
Weaknesses (CWE) in Refrigeration controller attack in France
Timeline of Refrigeration controller attack in France
- Flare-reviewed infostealer data shows a Windows host in southern Europe compromised in May 2025 (month precision) with 92 saved credentials, including logins to bare IP literals on non-standard ports; one IP still served the controller interface 16 months later. No link to the October attack is proven.
- CISA publishes ICSA-25-140-03 for Danfoss AK-SM 8xxA: CVE-2025-41450 (date-based authentication bypass), CVE-2025-41451 (alarm-mail command injection), CVE-2025-41452 (nginx configuration injection/DoS); reported by Claroty Team82.
- CISA updates ICSA-25-140-03 (Update A); Danfoss R4.2 fixes CVE-2025-41450 and R4.3.1 fixes CVE-2025-41451 and CVE-2025-41452.
- CVE-2026-22877 (unauthenticated arbitrary file read, XWEB Pro 1.12.1 and prior) published via CISA ICSA-26-057-10 alongside authentication bypass CVE-2026-25085 and CVE-2026-21718; reported by Claroty Team82.
- Claroty Team82 publishes 'Freeze the Controller, Defrost the Food', detailing the AK-SM 800A attack surface and code-of-the-day authentication bypass, citing about 2,765 exposed devices on Censys.
- Overnight attack begins: refrigeration controllers at hundreds of French grocery stores are forced into defrost cycles with stock inside; cabinets reportedly reach about 50°C after about six hours, with some equipment fires.
- CERT-FR issues alert CERTFR-2026-ALE-012 on numerous compromised refrigeration remote controllers; Bloomberg and Reuters report the attack.
- CERT-FR updates its alert to list Danfoss AK-SM and AK-SC series plus Copeland and Dixell XWEB consoles; a researcher publishes a detection-engineering repository (emulator, network and host rules, replay harness); Shodan-based exposure counts of 4,980 Danfoss hosts circulate.
- French government says about 700 retailers were affected; Danfoss management interfaces remain reachable online; no attribution published.
- Flare publishes passive exposure analysis: 2,667 exposed controller addresses (France 1,293), 76.8% of 786 sampled hosts on builds predating the 2025 authentication fix, 65% of confirmed hosts co-hosting cameras, remote desktop or VPN.
Sources cited for Refrigeration controller attack in France
- Flare: Analysis After the Refrigeration System Attack in France - Two Thirds of Exposed Refrigeration Controllers Share an Address with Cameras, Remote Desktop, and VPNs
- CISA ICSA-25-140-03: Danfoss AK-SM 8xxA Series
- Claroty Team82: Freeze the Controller, Defrost the Food - Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
- CVE-2026-22877: Copeland XWEB Pro arbitrary file read (CISA ICSA-26-057-10)
- Wikipedia: 2026 French supermarket refrigerator hack
- Cyber Security News: Danfoss Refrigeration Hack Update - 4,980 Hosts Found Exposed to Internet
- CNBC: French supermarket fridges get hacked, heating to 122°F and sparking fires
- Al Jazeera: Hundreds of supermarkets in France hit by 'unprecedented' cyberattack
- Bloomberg: Hundreds of French Supermarkets Lose Refrigeration in Weekend Cyberattack
- CNN: What to know about the cyberattack that targeted supermarket refrigeration systems in France
- ComplexDiscovery: Refrigeration hack affected about 700 French supermarkets, government says, as Danfoss interfaces stay online
Detection coverage for TL-2026-3667
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3667 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.