Hackers turn up the heat – in French food freezers

Internet-connected refrigeration

Freezers full of food are meant to keep it at a steady, low temperature well below freezing point (32°F, 0°C, 273.15K), to prevent it spoiling.

Everyone knows that, over time, moisture in the air builds up steadily as ice crystals inside any freezer, and occasionally needs removing so the freezer can be thoroughly cleaned out, a process known simply as defrosting.

At home, you can usually do this simply by emptying the freezer, turning it off for few hours, and waiting for the “frost” to melt and drain out.

But commercial freezers typically include heating circuits – as contradictory as that sounds – that can be turned on to speed up the defrosting process, allowing the units to be cleaned and returned to profitable use as quickly as possible.

As you can probably imagine, many freezer brands have, for many years, included network connectivity that allows them to be monitored, configured, and controlled remotely – Software Defined Freezers, if you like.

You can tell where this is going.

Vulnerabilities, bugs, missed patches, poor passwords, or other misconfigurations in a Freezer Area Network could, in theory and in practice, leave them at the mercy of hackers and cybercriminals.

The French connection

Sadly, that’s what seems to have happened to freezers in several French supermarket chains over the weekend.

Reports suggest that as-yet unknown hackers, for unknown reasons, in unknown ways, didn’t just turn off rows of freezers so the food in them would spoil, but actively turned on their defrosters, even though they were full of food at the time.

This seems to have turned the freezers into surprisingly effective slow cookers instead.

Not only did this cause significant waste and economic loss, but some reports even claim that freezers “reached 50°C” (that’s about 120°F), and that “in some places there were small fires.”

At the time of writing [2026-10-12T22:30:00Z], we can’t confirm those details, as dramatic as they sound. You’d expect commercial equipment of this sort to have physical protections in place to prevent dangerous overheating of any sort, whether caused by a short circuit triggered by water damage, blocked vents, or software failure. However, commercial freezers are typically well-insulated to prevent heat leaking in when they’re cold, and insulation that keeps heat out during freezing obviously keeps heat in during heating.

A common cause of failure?

Some reporters suggest that a possible common factor at the companies affected is that they all used the same refrigeration systems and software, from Danish company Danfoss.

Researchers at cybersecurity company Claroty published a deep dive back in August 2026 into bugs they found in the Danfoss AK-SM 800A refrigeration controller software.

The bugs included a way to generate a password that could allow anyone to log in with Administrator privileges (CVE-2025-41450), and another bug giving RCE, or remote code execution (CVE-2025-41451).

Those bugs were almost comically bad.

The researchers discovered back-end code that created one-off, random looking short-lived passwords, intended for administrators to grant short-term access to trusted technicians without creating a long-lived accounts.

A password created in this way was was known as code of the day, and automatically expired at the end of the day.

Auto-expiry of passwords for temporary accounts is a great idea if it’s implemented properly, for example by generating decent-quality, random text strings that can’t be predicted.

But Danfoss generated this password deterministically, based entirely on the date – the “secret” was entirely in the algorithm used, which the researchers extracted from the device, effectively turning the code of the day into a trivial, hard-wired password.

The RCE hole was a command injection vulnerability, where instead of entering an email address to which the device would send alerts, you could enter a system command.

The device didn’t validate that the input really was a valid email address, but would accept an injected command, and automatically run that command in the background, on the device itself.

So anyone could generate that day’s password, log in remotely, and then tell the system to run any command they liked, under the innocent guise of setting an address for email notifications.

Ironically, a feature intended to improve safety and security, by ensuring that alerts and alarms would be sent promptly to the right people, could be abused to take over the system entirely.

What to do?

Danfoss, to its credit, patched these holes more than a year ago [2025-08-01], so it’s not clear whether these vulnerabilities are associated with this defrosting attack.

We’ll have to wait for the post-incident analysis, but if the attackers did indeed find and exploit these old holes, this is yet another reminder to Patch Early, Patch Often.

Don’t just patch your Windows laptops, your Macs, and your Linux servers.

Patch your fridges and freezers, too!

And if you’re a programmer․․․

․․․Don’t Hardwire Passwords, and Validate Thine Inputs!

Ask how SolCyber can help you do cybersecurity in the most human-friendly way. Don’t get stuck behind an ever-expanding convoy of security tools that leave you at the whim of policies and procedures that are dictated by the tools, even though they don’t suit you or your business!

More About Duck

Paul Ducklin is a respected expert with more than 30 years of experience as a programmer, reverser, researcher and educator in the cybersecurity industry. Duck, as he is known, is also a globally respected writer, presenter and podcaster with an unmatched knack for explaining even the most complex technical issues in plain English. Read, learn, enjoy!

Featured image of freezer cabinet by Mick Haupt via Unsplash.