How a Refrigeration Controller's Web Interface Becomes a Physical-Damage Attack Surface

The October 2026 attack on French supermarkets, in which hundreds of stores lost their fresh and frozen stock to a forced six-hour defrost, surprised people who think of refrigeration as plumbing. It should not have. A modern supermarket's cold chain is run by a supervisory controller that is, underneath its industrial casing, a general-purpose computer with a web server, an operating system shell and a network port. This article explains what that device does, what an attacker can do with it, and why the usual IT mental model of a breach fits it badly.

What a supervisory controller actually controls

Walk into any mid-size food retailer and the refrigeration is a hierarchy. At the bottom are case controllers, one per display case or cold room, each running its own compressor relay, evaporator fan and defrost heater. Above them sits a site-level system manager such as the Danfoss AK-SM series, the Copeland xweb or the Dixell xweb named in CERT-FR's alert. The manager polls every case controller, holds the master schedule for defrost cycles, stores the temperature thresholds that trigger alarms, logs readings for food-safety compliance and sends email or SMS when something drifts.

That is a lot of authority in one box. Claroty's Team82, in its August 2026 research on the Danfoss AK-SM 800A, summarised the capability set as the ability to monitor refrigeration circuits, configure temperature thresholds and adjust operating schedules. Each of those is a legitimate function, which is exactly the problem. An attacker with the web interface does not need an exploit to do damage. Setting every case to defrost, raising the set point and silencing the alarm threshold is a few clicks in the vendor's own UI. The French attackers reportedly did precisely that, with a 50°C set point.

Why these devices end up on the internet

The honest answer is logistics. A refrigeration contractor servicing several hundred stores cannot send a technician to each one to adjust a schedule. Remote access to the site manager is the product's selling point, and the cheapest way to provide it is a public IP or a port-forward on the store router, often through a cellular modem the contractor installed without involving the retailer's IT team. Intermarché's statement after the attack pointed directly at a service provider that manages refrigeration systems in its stores.

The result is a population of devices with a browser-accessible login page on the open internet. Team82 counted 2,765 exposed AK-SM 800A controllers using Censys in August 2026. After the attack, Predicta Lab counted 2,752 Danfoss systems reachable, 1,590 in France, and Shodan put the broader Danfoss figure above 4,500. CERT-FR's response was blunt: exposing a management interface to the internet contradicts established security practice. How to Inventory the OT Controllers Your Facilities Contractors Put Online describes how to find the ones you own.

The three ways in

Once a controller's web interface is reachable, there are three paths to control, and the French incident could plausibly have used any of them.

The first is credentials. Legacy units like the Danfoss AK-SM800, end of life since 2021, and the AK-SC355, phased out in 2016, run whatever password the installer set, which in a contractor-managed fleet tends to be the same password at every site. Danfoss said most affected units were these legacy models. A device from 2016 on a public IP does not need a vulnerability.

The second is a hidden authentication path. Team82's headline finding, CVE-2025-41450, was that the AK-SM 800A accepted a password generated internally from the device's current date and time, a code-of-the-day mechanism meant for vendor support. Anyone who worked out the algorithm could log in as an administrator on any unpatched unit. Danfoss fixed it in firmware R4.2 in March 2025. Vendor backdoors of this kind are common in embedded equipment because they solve a real support problem, and they are catastrophic in the field for the same reason: one secret unlocks the whole installed base.

The third is post-authentication code execution. CVE-2025-41451 was an OS command injection in the controller's alarm-to-mail configuration: the SMTP password field was passed into a shell command without sanitisation. With a valid login, an attacker gets a root shell on the controller's Linux system, which means persistence, the ability to pivot into the store network and, as Team82 pointed out, the ability to falsify temperature readings so the display shows a cold case while the compressor is off. CVE-2025-41452 added the ability to rewrite the device's Nginx configuration and crash the web service, a neat way to lock out the legitimate operator while the damage runs.

None of these has been confirmed as the vector in France; CERT-FR named no CVE and the CISA KEV catalog has no Danfoss entry. But together they describe the attack surface completely: weak or shared credentials, a vendor backdoor, and a shell behind the login.

Why the IT breach model fits badly

Security teams instinctively reach for the confidentiality-integrity-availability triad and ask what data was taken. For this class of device the answer is usually nothing, and the question misses the point. The asset is not data. It is a physical process with a tolerance window, and the attacker's goal is to push the process outside it faster than anyone notices.

That changes three things. Detection has to come from the physical world, not the logs: an independent temperature probe that reports to a system the controller cannot touch would have raised an alarm within the first hour in France. Recovery is not a restore from backup; it is a factory reset, a configuration rebuild, and a bin full of inventory. And the blast radius is bounded by the controller's authority rather than by network segmentation. A site manager that can command every case in the store is a single point of physical failure regardless of how well the store VLAN is carved up.

What good looks like

The mitigations are the ones CISA listed in its 2025 advisory on the AK-SM 8xxA series and that CERT-FR repeated after the attack: no direct internet exposure, access only through a VPN or protected network, current firmware where the vendor still ships it, strict security mode enabled, default credentials changed. For end-of-life hardware there is no firmware path, so isolation and replacement are the only options.

The strategic issue is who owns that work. The device belongs to the retailer, the access belongs to the contractor, and in most contracts nobody owns the security of the join between them. Why 'Our Contractor Manages That' Is Not a Security Boundary for OT takes up that question. The technical lesson of this article is narrower: a refrigeration controller is a server with a hand on the compressor relay, and it deserves the same scrutiny you would give any other server that can set fire to the building.