Danfoss Refrigeration Hack 2026: UK OT Security Lessons

What happened across European supermarket chains

Hackers remotely took over refrigeration controllers made by Danish manufacturer Danfoss and reset target temperatures to 50°C (122°F), causing freezers and fridges to defrost overnight. The attack struck several major European retailers, including, according to Reuters, Auchan, Carrefour, E.Leclerc, Intermarché and Monoprix, with France bearing the brunt of the damage.

French broadcaster BFM TV reported more than 300 supermarket locations affected in France alone, with losses estimated to reach millions of euros. Belgium, Germany, the Netherlands, Poland, Portugal and Spain also reported disruption, making this one of the broadest retail-sector OT incidents seen in Europe to date.

Cooperative U, which operates the Hyper U, Super U, U Express and Utile brands, confirmed several of its stores were hit. In a machine-translated post on X, CEO Dominique Schelcher called the incident "of extreme gravity and unprecedented," adding it was "unacceptable" to target equipment essential to food preservation and supply.

How the attack unfolded inside the cold chain

According to security researcher Lukasz Olejnik, attackers remotely accessed refrigeration controllers and forced them into a defrost cycle with a target temperature of 50°C. In some locations the fault ran for roughly six hours overnight before staff opening up in the morning discovered a wave of hot air pouring from equipment meant to keep stock near freezing.

That delay is the crux of the problem for any retailer running unattended refrigeration overnight: there was no human in the loop to catch the change before it became unrecoverable stock loss.

The Danfoss AK-SM 800A disclosure and the patch gap

Roughly two months before the attack, industrial cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A refrigeration management platform. The flaws could allow an attacker to bypass authentication, remotely execute arbitrary code, and inject arbitrary configuration directives into the platform that centrally manages store refrigeration.

Claroty said it found thousands of AK-SM 800A management interfaces exposed directly to the public internet and urged customers to upgrade to firmware version R4.3.1, which contains the fix. Claroty warned that because the platform provides centralised management of refrigeration equipment, compromising it "can have significant operational consequences."

It remains unconfirmed whether this specific attack exploited the Claroty-disclosed flaws, but the timing and the method — remote manipulation of centralised refrigeration controls — line up closely with the risk the disclosure described.

Why UK supermarket and logistics buyers should care now

UK grocery chains, convenience retailers, wholesale cash-and-carry operators and cold-chain logistics firms run the same class of centralised refrigeration management platforms across hundreds of sites. Many of these systems were deployed for remote monitoring convenience, not internet-facing resilience, and patch cycles on OT equipment typically lag far behind IT estates.

This incident shows that a single exposed management interface, multiplied across a large store estate, can turn into a nationwide food-safety and financial event within a single overnight shift. For buyers, the exposure isn't just the fridge controller itself — it's every vendor, integrator and remote-access tool that touches it.

Boards should be asking procurement and facilities teams for a current inventory of every internet-reachable OT device, not just a list of IT assets covered by existing managed detection and response contracts.

Practical steps: patching, segmentation and vendor assurance

The immediate action for anyone running Danfoss AK-SM 800A or comparable refrigeration management platforms is to confirm firmware is upgraded to version R4.3.1 and that the management interface is not directly reachable from the public internet. Beyond that single fix, the wider lesson is structural.

Refrigeration controllers, HVAC systems and building management platforms typically sit outside conventional vulnerability management programmes built for servers and endpoints. UK operators should extend asset discovery and patch tracking into OT and IoT estates, apply network segmentation so a compromised controller cannot reach wider retail systems, and move toward a zero trust model for any remote access into store-level equipment.

Where refrigeration or facilities vendors manage remote access themselves, buyers should demand contractual assurance on patch SLAs, interface exposure and incident notification, treating these suppliers as part of the cyber security perimeter rather than outside it.

Supply chain and resilience questions to put to vendors

This is also a supply chain security story. A vulnerability disclosed by one research firm, affecting one manufacturer's platform, had the potential to disrupt food supply across seven countries. UK buyers sourcing refrigeration, EPOS, HVAC or warehouse automation systems should ask vendors directly how quickly disclosed CVEs are patched in the field, not just released in a firmware note.

Retailers unsure where to start should speak to a specialist before the next disclosure turns into the next overnight incident — talk to a Servnet engineer about auditing OT exposure across store and distribution estates.

• •Confirm Danfoss AK-SM 800A firmware is at version R4.3.1 or later
• •Remove direct public internet exposure of refrigeration management interfaces
• •Segment OT networks from store IT and point-of-sale systems
• •Require vendor SLAs on patch deployment and incident disclosure
• •Extend asset inventories and vulnerability scanning into OT and IoT estates