Exposed refrigeration controllers, NIS2, CRA, Starlink

On 12 October 2026 (after plenty of alerts, press coverage and what have you), CERT-FR published, cold, an alert about “numerous compromises” of remote controllers for refrigeration installations. It first covered Danfoss AK-SC and AK-SM units, and an update on 13 October added Copeland xweb and Dixell xweb controllers [1]. The attacks date from the night of 11 to 12 October (attacking at night and over the weekend is, after all, the most damaging pattern). The alert points - surprise - to administration interfaces exposed directly on the Internet. CERT-FR asks (what ANSSI has been recommending for years) that exposure be removed, that equipment be reached only through a VPN (Virtual Private Network) or a protected network, that equipment be updated (well, often it is end-of-life…) and that default passwords be changed.

The press spoke of several hundred stores (counts vary from 250 to 700), because, as usual, the counts do not count the same thing: stores for some, systems for others.

Vulnerabilities known since 2025

The three flaws in the Danfoss AK-SM 800A carry CVE (Common Vulnerabilities and Exposures) numbers from… 2025, and Danfoss published two advisories in 2025: DSA-2025-03-01 in March for the first (fix 4.2), then DSA-2025-08-01 in August for the other two (fix 4.3.1) [2]. The first (CVE-2025-41450) bypasses authentication through an administrator password computed from the date. The second (CVE-2025-41451) allows command execution through the mail configuration. The third (CVE-2025-41452) causes a denial of service. The fix is firmware R4.3.1. On 9 August 2026, Claroty’s Team82 published the full technical analysis and counted 2,765 interfaces visible on the Internet [3].

Onyphe, a French search engine for exposed devices, measured the exposure over less than a week and published on 13 October [4]. It counts 6,212 public IP addresses serving the AK-SM 800 and 800A interface, spread over 558 autonomous systems and 95 countries and territories. France accounts for nearly half, ahead of Belgium, Poland, the United States, the Netherlands and Spain. Fewer than half of the interfaces use a usual web port (80, 443 or 8080), and a significant share answer in unencrypted HTTP. The most common version of the interface software, 01.0.168, runs on about half of them, and more than half run an older version. This count is therefore not comparable with Claroty’s, which is older and limited to a single model (thanks, Onyphe).

For the Copeland XWEB Pro, another article lists 23 vulnerabilities, 21 of them severe, with the same type of flaw: deterministic credentials and possible command injection [5].

In a statement to Cooling Post on 12 October, Danfoss says that most of the affected devices are end-of-life products (AK-SM 800 since 2021, AK-SC 355 discontinued in 2016) or AK-SM 800A units running old firmware [6].

Onyphe states that neither the attackers’ intentions nor the exact intrusion vector have been publicly confirmed. None of the three CVEs is established as the entry point, and the forced defrost is reported only in the conditional. No source says whether the stores’ controllers were reached over a fixed line or the mobile network. My own measurements on exposure search platforms show that mobile subscriptions with a public address exist, so mobile does not imply CGNAT.

But there were recent precursors…

The summer offers another case (with no established link for now). From 26 August 2026, a few weeks after the technical analysis was published (again without saying there is a direct link), refrigerators and freezers at US bases went into defrost mode, and stores opened with dry goods only. The Department of Defense acknowledged on 28 August a possible refrigeration disruption. The Army Criminal Investigation Division, the Air Force Office of Special Investigations and the Defense Criminal Investigative Service are investigating [7].

Three of these stores are on naval installations: Naval Station Newport, Naval Air Station Lemoore and Naval Base Ventura County. At the end of September, no cause and no cyber origin had been announced. No common controller, firmware or contractor has been published.

A marine range from the same manufacturers

Danfoss sells drives for marine refrigeration compressors, the iC7-Marine family. Copeland offers monitoring of refrigerated containers and ships, with its REFCON system. Refrigerated container cooling is already part of the inventory of port and shipboard information systems.

The drives have their own security advisory: in September, Danfoss published CVE-2026-15203, rated 9.3 out of 10, which opens debugging and engineering interfaces by default on iC7-Marine units older than version 2025.8.19 [8]. These are motor drives, a different family from the refrigeration controllers.

Starlink and industrial system monitoring (aka smart shipping)

A priori, quite a few managers of small, medium and large stores have discovered that saying “you monitor your installation from your smartphone” also meant “your installation is connected directly to the Internet”. Well, for ships (and some ports with cold stores), a few years ago, monitoring cold rooms remotely was no picnic. Monitoring a ship’s fridges from ashore means reaching them from land. And at a time when VSAT and Inmarsat were the only IP links available on board, that was not easy. But the arrival of LEO constellations, and Starlink in particular, may well change the game. Now yes, by default Starlink puts the subscriber behind CGNAT (Carrier-Grade NAT, address sharing at operator scale) and no inbound connection reaches them. A public IPv4 address is offered as an option on some plans (…including the maritime plan). It is assigned by DHCP (Dynamic Host Configuration Protocol), so it may change (or not).

A shipowner who asks for this public address to reach a controller’s web interface gets exactly what CERT-FR describes: an administration interface directly on the Internet, with passwords that never change. A 2024 measurement finds only about 27,000 Starlink subscriber addresses visible from the Internet, because CGNAT limits observation [9]. I found no measurement of industrial equipment behind Starlink. A query in Onyphe would make it possible. I leave it to you if you want to spend part of the night scaring yourself.

Monitoring could also run through an outbound connection from the ship to a supervision service, or through a VPN tunnel set up from the ship. Well, more complicated, but at least Starlink makes this VPN option easier than over VSAT (latency, etc.). The administration interface would then stay on the local network. Well, that does not change the fact that default passwords must be changed at installation, before the first sailing, that updates must be applied and obsolescence watched, that networks must be segmented and monitored, etc….

“NIS 2 would have saved us”

Well, we have read it many times: if the transposition of the NIS2 directive into French law had been passed in October, we would not be here. Of course, things are much more nuanced than that. The National Assembly did withdraw the Résilience bill from its agenda on 6 October, with no new date [10].

However, even if passed before 12 October, the law would have imposed no obligation on the attacked controllers, because retail is not a sector of the directive. Its Annex II covers, for food, wholesale distribution and industrial production or processing companies [11]. A retail store (super / hypermarket) therefore probably does not fall within it, whereas a logistics platform or a purchasing hub of the same group does. That said, the French bill leaves the list of sectors to an implementing decree, within the limits of the directive, and a nominal designation outside the annexes remains possible (Article 2, paragraph 2). Let us hope that, for these food retailers as (one can dream) for other sectors now excluded and yet essential (we find out during a cyber incident, or during a pandemic), these orders are sensibly revised accordingly. Otherwise, we will have to rely on Article 40 of the directive, which provides for a review by the Commission, sectors and thresholds included, by 17 October 2027 at the latest, then every 36 months. Well, and let us remember that a text being passed does not mean cyberattacks stop. It sounds silly, but seeing some comments in the media and on social networks, saying so may be necessary.

So, soon a CISO in every supermarket? (just for the story) The affected retail brands complicate the picture further. Intermarché, Coopérative U and Leclerc are groupings of independent merchants, and the word “franchisees” would be inaccurate for most of their stores. Each store is a separate company, and the group’s CISO (Chief Information Security Officer) does not necessarily see what its operator has connected to the Internet. The groupings often already pool part of the central IT, checkout and management. Nothing would prevent (cost aside) adding an inventory of exposed refrigeration equipment, or even a shared Security Operations Center (SOC) for the members. Perhaps this incident will lead to that kind of change (which, I imagine, the CISO has long been wishing for).

The CRA (Cyber Resilience Act, the European regulation on cyber resilience) is addressed to manufacturers and already applies in part. Since 11 September 2026, these manufacturers must report actively exploited vulnerabilities to ENISA (the European Union Agency for Cybersecurity) and to the national CSIRT (Computer Security Incident Response Team). The early warning goes out within 24 hours, the full notification within 72 hours, and the final report at the latest 14 days after a fix becomes available. Notifications go through the single platform that ENISA opened the same day [12].

This reporting obligation also applies to products already on the market before that date, including those no longer supported. A controller manufacturer that finds a vulnerability being exploited in its installed base, end-of-life devices included, would therefore have to report it, without having to go back to exploitations it knew about before 11 September. The design requirements, for their part, apply only to products placed on the market from December 2027, barring substantial modification. The end-of-life devices mentioned by Danfoss will therefore never have to meet them.

Finally, on board, the IACS (International Association of Classification Societies) unified requirements E26 and E27 apply to ships of 500 gross tonnage and above, with construction contracts signed since 1 July 2024. They cover first the systems essential to safety. A provisions cold room controller is probably not one of them (worth thinking about, though, since it can bear on the crew’s survival on long ocean passages), and so nobody is required to check its configuration… (even if I have no doubt that some shipowners do things seriously).

Sources

• [1] CERT-FR, CERTFR-2026-ALE-012, October 2026.
• [2] Danfoss, security advisories DSA-2025-03-01 and DSA-2025-08-01.
• [3] Claroty Team82, “Freeze the Controller, Defrost the Food”, 9 August 2026.
• [4] Onyphe, “Refrigeration as Critical Infrastructure: Analyzing the Cyberattack on French Supermarkets”, 13 October 2026.
• [5] Claroty Team82, “Chilling Discoveries: Unpacking Vulnerabilities in Copeland XWEB Pro Controllers”.
• [6] Cooling Post, “Danfoss moves to mitigate cyberattack”, 12 October 2026.
• [7] Stars and Stripes, 1 September 2026.
• [8] Danfoss, advisory DSA-2026-08-01.
• [9] Starlink address measurement, arXiv 2412.18243.
• [10] NosParlementaires, withdrawal from the agenda on 6 October 2026.
• [11] Directive (EU) 2022/2555, Annex II and Article 40.
• [12] European Commission, CRA reporting obligations.