# Refrigeration controller attack in France: internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers forced into defrost cycles at hundreds of grocery stores (CVE-2025-41450)

> Overnight on 11-12 October 2026, an unknown party logged into internet-exposed commercial refrigeration controllers at hundreds of French grocery stores and forced defrost cycles, with cabinets reaching about 50°C and stock destroyed. CERT-FR confirmed compromises of Danfoss AK-SM/AK-SC controllers and Copeland/Dixell XWEB consoles. Press reports describe an admin login whose password is the current date (the hidden 'code of the day', CVE-2025-41450).

- **Published:** 2026-10-15T21:18:14Z
- **Last reviewed:** 2026-10-15T21:18:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3667
- **ID:** TL-2026-3667
- **Severity:** HIGH (CVSS 8.2)
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-41450, CVE-2025-41451, CVE-2025-41452, CVE-2026-22877, CVE-2026-25085, CVE-2026-21718

## Description

Between the night of 11 October and 12 October 2026, refrigeration controllers at hundreds of French supermarkets (reported banners include Intermarché/Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc; the French government put the total at about 700 retailers) were remotely driven into continuous defrost mode while stock was still inside. Cabinets reportedly climbed to about 50°C (122°F) within roughly six hours, some equipment caught fire or melted, and the food loss is estimated at €10M or more (estimates vary by outlet). CERT-FR issued alert CERTFR-2026-ALE-012 on 12 October and updated it on 13 October to list Danfoss AK-SM and AK-SC series devices and Copeland and Dixell XWEB consoles. No threat actor has been attributed, and the initial access method has not been officially established.

The mechanism most widely reported is the Danfoss AK-SM 8xxA 'code of the day' authentication bypass, CVE-2025-41450 (CWE-287, CVSS v3.1 8.2). The embedded web interface accepts a password derived from the device's current date and time, so anyone who reconstructs the algorithm can compute the accepted code for any day and obtain an administrative session. Press accounts describe the username 'admin' with the current date as the password. Danfoss fixed it in release R4.2. Two post-authentication flaws from the same Claroty Team82 research are fixed in R4.3.1: CVE-2025-41451 (CWE-77), an OS shell command injection through the alarm-to-mail configuration fields that can lead to post-authenticated RCE (CVSS v3.1 7.6), and CVE-2025-41452 (CWE-15), arbitrary nginx configuration directive injection through an authenticated upload that rewrites headers.conf and reloads the web server, giving DoS or traffic manipulation (CVSS v3.1 5.4). Claroty's architecture notes describe layered reverse proxies (external nginx, sm_fcgi_app, internal nginx, sm_app/Task_Web) with requests routed through xml.cgi. Claroty published 'Freeze the Controller, Defrost the Food' on 9 August 2026, about two months before the attack.

A second vendor family is also in scope. Copeland/Dixell XWEB Pro 300D/500D/500B (version 1.12.1 and earlier) has unauthenticated arbitrary file read CVE-2026-22877 (CWE-22, CVSS 3.7), authentication bypass CVE-2026-25085, and pre-authentication code execution via authentication bypass CVE-2026-21718 (CISA ICSA-26-057-10, reported by Claroty Team82). These match the 2026 'competing vendor' issues in Flare's analysis. Flare notes that CERT-FR added the Copeland/Dixell products on 13 October.

Flare's passive, scan-data-only analysis (published 15 October 2026) sized the exposure. It found 2,667 unique exposed controller addresses as a floor figure (France 1,293, 56.3%; rest of world 1,009). Among 786 hosts with readable build dates, 604 (76.8%) served front-end builds that predate the 2025 authentication fix. 65% of confirmed hosts (356 of 547) share a public address with at least one other service: 72 with remote desktop, 42 with cameras and 78 with VPN concentrators (IPsec, OpenVPN, L2TP). Of 1,026 responses carrying a CORS policy, 1,024 returned a wildcard origin and allowed the device's own authentication header cross-origin. Flare also found one Windows host (southern Europe) compromised by an infostealer in May 2025 with 92 saved credentials, including logins to bare IP literals on non-standard ports. One of those IPs still served the controller management interface 16 months later. Flare stresses that this is a different port on the same address, with no proof the credential was valid or used in the October incident. Separately, cybersecuritynews reported 4,980 exposed Danfoss hosts found via Shodan (France 2,911), and Claroty cited about 2,765 devices on Censys. The counts differ by method and date.

Defender takeaways: remove controllers of this class from direct internet reachability, enumerate the full port range on each public address (not just documented ports), upgrade to the fixed releases, rotate maintenance credentials, put remote maintenance behind a logged, authenticated gateway instead of a port forward, and alert on the date-derived credential pattern. A researcher published a detection-engineering repository on 13 October 2026 (device emulator, network and host detection rules, replay harness) that uses a deliberately altered authentication algorithm. Attribution is unresolved: one expert suggested the simplicity of the exploit is consistent with low-skill actors, but this is an opinion and not an attribution.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1059.004 Unix Shell
- T1555.003 Credentials from Web Browsers
- T1565.001 Stored Data Manipulation

## Sources

- [Flare: Analysis After the Refrigeration System Attack in France - Two Thirds of Exposed Refrigeration Controllers Share an Address with Cameras, Remote Desktop, and VPNs](https://flare.io/learn/resources/blog/after-refrigeration-system-attack-france-exposed-refrigeration-controllers)
- [CISA ICSA-25-140-03: Danfoss AK-SM 8xxA Series](https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03)
- [Claroty Team82: Freeze the Controller, Defrost the Food - Uncovering Vulnerabilities in Danfoss Refrigeration Controllers](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers)
- [CVE-2026-22877: Copeland XWEB Pro arbitrary file read (CISA ICSA-26-057-10)](https://vulnerability.circl.lu/vuln/CVE-2026-22877)
- [Wikipedia: 2026 French supermarket refrigerator hack](https://en.wikipedia.org/wiki/2026_French_supermarket_refrigerator_hack)
- [Cyber Security News: Danfoss Refrigeration Hack Update - 4,980 Hosts Found Exposed to Internet](https://cybersecuritynews.com/danfoss-refrigeration-hack-exposed-hosts/)
- [CNBC: French supermarket fridges get hacked, heating to 122°F and sparking fires](https://www.cnbc.com/2026/10/13/france-supermarket-hack-cyberattack-fridges-fires.html)
- [Al Jazeera: Hundreds of supermarkets in France hit by 'unprecedented' cyberattack](https://www.aljazeera.com/news/2026/10/13/unprecedented-cyberattack-hits-french-supermarkets-causing-food-losses)
- [Bloomberg: Hundreds of French Supermarkets Lose Refrigeration in Weekend Cyberattack](https://www.bloomberg.com/news/articles/2026-10-12/french-supermarket-refrigeration-sites-hit-by-cyberattacks)
- [CNN: What to know about the cyberattack that targeted supermarket refrigeration systems in France](https://www.cnn.com/2026/10/14/europe/france-cyberattack-supermarket-fridges-intl)
- [ComplexDiscovery: Refrigeration hack affected about 700 French supermarkets, government says, as Danfoss interfaces stay online](https://complexdiscovery.com/refrigeration-hack-affected-about-700-french-supermarkets-government-says-as-danfoss-interfaces-stay-online/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3667