MDR
Solutions
Partners
About
Resources
Affected Environment
Remotely managed refrigeration controllers from Danfoss, Copeland and Dixell at European retailers and food-sector organisations.
Threat Overview
Coordinated attacks manipulate temperature setpoints and defrost schedules, disrupting cooling and causing loss of temperature-sensitive goods.
Exposure Timeline
First wave hit France 11 to 12 October 2026; renewed wave 1 to 2 November across multiple European countries.
Attack Surface
Internet-exposed refrigeration management interfaces and third-party remote access, particularly end-of-life Danfoss AK-SM 800 and AK-SC 355 devices.
Technical Root Cause
Weak or default credentials and known flaws, including CVE-2025-41450 and CVE-2026-25085 authentication bypasses; exploitation unconfirmed per incident.
Exploitation Pathway
Attackers reach exposed interfaces, gain controller access, then force defrosts or abnormal setpoints, triggering temperature excursions and spoiled inventory.
Operational Impact
Temperature excursions, spoiled or withdrawn stock, and refrigeration-service disruption across hundreds of French retail locations and beyond.
Strategic Impact
Cyber-physical attacks hit Europe's food supply chain; ENISA and Europol are coordinating the response, with no attribution yet.
Required Mitigation
Remove internet exposure, replace default credentials, enforce MFA, update firmware, segment OT networks, and replace end-of-life controllers.
Incident Response Guidance
Audit setpoints and defrost schedules, review access logs, preserve evidence, and coordinate containment with refrigeration contractors.
References
CERT-FR alert CERTFR-2026-ALE-012, Danfoss security advisories, Claroty Team82, Reuters, Euronews, European Commission, ITV News.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)