On the night of 11 to 12 October, refrigeration at a large number of French supermarkets was driven to temperatures that spoiled stock, with reports of fires at some stores and losses estimated in the tens of millions. CERT-FR published alert CERTFR-2026-ALE-012 on 12 October, updated on the 16th.

Almost every account has told this as a story about Danfoss controllers, exploited through vulnerabilities that Claroty published in August. Both halves of that are reasonable guesses. Neither is in the documents.

What CERT-FR actually says

The alert lists four affected product families, from three vendors: Copeland xweb, Danfoss AK-SC, Danfoss AK-SM and Dixell xweb. A 13 October update added that other equipment was also targeted, without naming it.

It says "Le CERT-FR a connaissance de nombreuses compromissions" — it is aware of numerous compromises. It gives no count, no victim names and no methods.

It names no CVE. It identifies no attack path. The nearest it comes to a cause is a statement of practice: exposing a management interface to the internet is "contraire aux bonnes pratiques".

So the one official document in this story describes an incident affecting several vendors' controllers and declines to say how.

What Claroty actually published

Claroty's Team82 released "Freeze the Controller, Defrost the Food" on 9 August 2026, two months before the attacks. It covers the Danfoss AK-SM 800A platform and three flaws:

CVE-2025-41450, scored 8.2, an improper authentication issue producing an authentication bypass. CVE-2025-41451, scored 7.6, a command injection in alarm-to-mail configuration fields leading to post-authenticated code execution. CVE-2025-41452, scored 5.4, a post-authenticated denial of service.

The first is the one that travelled. Team82 found what it calls a hidden mechanism, "likely intended for vendor support or maintenance", in which the device "generates a daily authentication password based solely on the device's current date". Reproduce the algorithm and, in Team82's words, "anyone capable of reproducing the algorithm could generate valid authentication credentials without knowing the administrator's password".

Team82 reconstructed that algorithm and did not publish it.

Which brings us to the claim that has spread furthest: that the password is simply today's date. That is not what the research says. The password is generated from the date by a routine Team82 deliberately withheld. The difference between those two sentences is the difference between a bug anyone can use and a bug someone has to do work to use.

And the article does not mention France, or any attack, anywhere. It could not: it was published two months earlier.

The join nobody has made

So we have an alert that names four product families and no cause, and research that names one product family and three causes but no incident.

Connecting them is plausible. The AK-SM is in both. An authentication bypass on an internet-exposed controller is exactly the kind of thing that would produce this outcome, and Team82 counted 2,765 AK-SM 800A management interfaces reachable from the public internet in its August scan.

But plausible is not established, and the inference has a hole in it the size of two other vendors. Copeland and Dixell appear in CERT-FR's list. Claroty's research has nothing to do with either. Whatever happened to those devices was not CVE-2025-41450.

Danfoss has said most of the affected units were older models it no longer updates, which points at something simpler than any of the three CVEs: equipment reachable from the internet, running software nobody patches, with credentials that were never changed.

We have made this point in a smaller way before, about a ransomware crew that skipped a CVSS 10.0 bypass and logged in through a hard-coded password scored 5.3. The most interesting vulnerability in the room is frequently not the one that was used.

The most useful paragraph in the alert

CERT-FR's advice on end-of-life equipment is the part worth reading twice. For kit that no longer receives security patches, it says keeping it exposed to the internet carries "une très forte probabilité de compromission", and then: "N'effectuer qu'un Reset Factory est dans ce cas insuffisant" — a factory reset alone is not enough, because the device goes back to being exactly as vulnerable as it was.

That is the whole lifecycle problem in two sentences. You cannot restore your way out of unsupported hardware on a public address.

What to do

  • Take refrigeration and building-management controllers off public addresses. CERT-FR says to check your insurance conditions before cutting the data uplink your refrigeration contractor relies on, which is the kind of practical caveat most advisories skip.
  • Restore access through a VPN or a protected network. CERT-FR accepts IP-source filtering on a firewall as an emergency measure only, and says it "ne doit pas être considérée comme pérenne".
  • Review the whole configuration, not just the setpoints, and CERT-FR singles out defrost schedules.
  • On Danfoss AK-SM equipment, update the firmware, set the security level to Strict and change default passwords. Team82's fixes are in firmware 4.3.1, with the authentication bypass entry pointing at 4.2.
  • If a device was compromised, restart or factory-reset it, then reconfigure and harden it before putting it back. On end-of-life kit, do not stop at the reset.
  • Assume this is not over. CERT-FR says the campaigns are "probablement toujours en cours".

What is not established

  • How the attackers got in. CERT-FR names no vulnerability and no path, and Claroty's Team82 has not said its flaws were the route.
  • Which of the four product families were hit, and in what proportion. The alert gives one list and no breakdown.
  • The number of affected stores. Reported figures of 250 to 350 come from press accounts, not from CERT-FR, which says only "numerous".
  • Who did it, or why. Nobody has offered attribution.
  • Whether the "other targeted equipment" added on 13 October is from the same vendors.
  • Whether the AK-SM 800A authentication bypass is fixed in firmware 4.2 or 4.3.1. Claroty's own page says both in different places.