OT Refrigeration Control Systems Attack
What is the Attack? On October 11–12, 2026, attackers compromised refrigeration control systems at supermarkets across France, remotely manipulating refrigeration settings and triggering defrost cycles. The attacks caused temperatures in some refrigeration units to rise to as high as 50°C, resulting in food spoilage and operational disruption. Affected retailers reportedly included Intermarché, Netto, Carrefour, Coopérative…
|
What is the Attack? |
On October 11–12, 2026, attackers compromised refrigeration control systems at supermarkets across France, remotely manipulating refrigeration settings and triggering defrost cycles. The attacks caused temperatures in some refrigeration units to rise to as high as 50°C, resulting in food spoilage and operational disruption. Affected retailers reportedly included Intermarché, Netto, Carrefour, Coopérative U, Monoprix, and E.Leclerc. France’s national cybersecurity agency, CERT-FR, reported compromises involving Danfoss AK-SM and AK-SC controllers, as well as Copeland and Dixell XWEB systems. These systems monitor and manage commercial refrigeration and related building operations. Their compromise can allow unauthorized changes to operating parameters, potentially disrupting temperature control and damaging perishable goods. Separate research by Claroty Team82 identified vulnerabilities affecting Danfoss AK-SM 8xxA controllers, including: Additional research by Claroty Team82 and CISA documented vulnerabilities affecting Copeland XWEB Pro controllers, including: |
|
What is the recommended Mitigation? |
On October 12, France’s national cybersecurity response team, CERT-FR, issued alert CERTFR-2026-ALE-012 warning of numerous compromises involving remote refrigeration controllers. Organizations should immediately remove direct internet exposure from refrigeration controllers and restrict remote administration to secure VPN connections or protected management networks. Review controller configurations, particularly temperature settings and defrost schedules, and apply available firmware updates and vendor-recommended security settings. Change default credentials and replace unsupported, end-of-life devices where necessary. If compromise is suspected, isolate affected equipment and follow vendor and CERT-FR recovery guidance before restoring operations. A factory reset alone is insufficient if the device remains vulnerable and exposed. Organizations should also segment OT networks from corporate IT environments, restrict access to authorized personnel, and monitor for unexpected changes to refrigeration settings. Danfoss identifies firmware R4.2 as the fix for CVE-2025-41450 and R4.3.1 as the fix for CVE-2025-41451 and CVE-2025-41452. Verify the correct release against the specific device model. |
|
What FortiGuard Coverage is available? |
• FortiGuard Operational Technology Security Service (OTSS) – Provides OT asset discovery, device identification, protocol-aware monitoring, and security visibility to help identify and assess refrigeration controllers and other OT assets within industrial environments. • FortiGate / FortiOS – Enforces network segmentation, access-control policies, and controlled connectivity between enterprise, DMZ, and OT networks, helping prevent unauthorized internet access to refrigeration management systems. • FortiGuard OT Vulnerability Protection – Detects and blocks network-based attacks targeting industrial services and protocols covered by available OT signatures. • FortiPAM – Provides privileged access management for administrative access to critical systems, helping enforce controlled access and stronger authentication for authorized personnel and remote maintenance. • FortiGuard Network Detection and Response (NDR) – Provides network visibility and behavioral detection to help identify anomalous communications and suspicious activity across OT and IT environments. • FortiGuard Incident Response – Supports investigation, containment, and recovery following suspected compromise of refrigeration controllers or other OT infrastructure. |