Security firm warns on refrigeration asset security
13th October 2026
USA: Following Sunday night’s cyberattack on French supermarkets, security company Claroty has warned food retailers that they should not assume that their refrigeration controllers are isolated and secure.
In a comment on its website, Claroty warns that internet-facing operational assets present a formidable risk to organisations if they’re not properly secured. Weak or default passwords, insecure system configurations, or exploits of legacy communication protocols can open the door to access these assets.
In August, New-York-based Claroty’s Team82 dedicated research arm revealed major vulnerabilities in Danfoss and Copeland controllers that could allow bad actors to manipulate physical temperature systems. Both Danfoss and Copeland swiftly released patches to protect their systems.
However, Claroty has now revealed how publicly-available internet scanning tools such as Censys and Shodan can easily enumerate assets that are exposed online, providing attackers with a potential list of targets.
“Team82’s initial research into exposed Danfoss AK-SM800A devices turned up 2,765; it’s unknown how many of those assets have since deployed the updated firmware, and how many remain exposed to these particular vulnerabilities,” it says.
Since the French attacks, Danfoss has revealed that some he current AK-SM800A systems affected were running outdated firmware. The Danish manufacturer says that it has long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions.
Exposed assets, meanwhile, can also provide attackers with a way to move deeper onto operational and enterprise networks, Claroty warns. “Organisations that choose to make these assets accessible online must not only lock down credentials, but have complete visibility into these assets, the pathways they provide internally to other systems, and also properly segment them in order to limit the blast radius of a compromised system.”
Claroty is also concerned of the cascading impact of this incident moving forward with vulnerabilities in other refrigeration systems also being uncovered.
“With artificial intelligence reducing the time to scan systems for access control issues or vulnerabilities, coupled with geopolitical conflict spiking activity against critical infrastructure, these are issues that must be prioritised within operational environments,” Claroty says.
“For food and beverage retailers and manufacturers they should not assume that assets such as these controllers are isolated and secure. Supermarkets, cold-storage facilities, and other healthcare and commercial enterprises dependent on refrigeration should inventory assets, assess whether they’re directly internet-facing, and ensure administrative services are restricted to trusted network segments or secured behind VPNs or industrial remote access solutions.”
Related stories:
Danfoss moves to mitigate cyberattack – 12 October 2026
FRANCE: Danfoss has said it is in close contact with supermarket customers in France affected by a cyberattack on Sunday night on its refrigeration controllers. Read more…
French supermarkets hit by massive cyberattack – 12 October 2026
FRANCE: Cyberattackers are reported to have taken control of the refrigeration systems in hundreds of supermarkets in France, changing temperature settings and defrosting produce. Read more…
