Date-based Danfoss login is the entry point in the French fridge attack, Pen Test Partners says
Fridges and freezers in several hundred French supermarkets were warmed overnight on 11 October 2026, with losses in the tens of millions of euros. Pen Test Partners points to Danfoss AK-SM and AK-SC controllers and a login derived from the date.
The Watch · Security desk
Comparison of two case temperatures. Changing a case's target temperature lets it drift up to store ambient, around 20C to 25C. Forcing the defrost heaters to stay on across the store's cases reached 50C.
Case temperature by method, per Pen Test Partners
| Item | Value | Claim |
|---|---|---|
| Setpoint drift, around 20 to 25 | 20 °C | 9 |
| Defrost heaters forced on | 50 °C | 8 |
What happened
- Intermarché, Netto, the U cooperative, Carrefour Market and Monoprix stores all lost stock, and E.Leclerc was named in reports as well.
- Fires followed: the Paris prosecutor has reported them, and the post says some equipment reportedly caught fire.
- Spain, Portugal, Poland, Germany and Belgium have sent similar reports.
- On the AK-SM, a second login path reached through undocumented attributes in a request to xml.cgi returns an administrative session to anyone with the right code.
- Synacktiv recovered the code in 2023 on the SM800, SC255 and SC355, and Claroty's Team82 did so in 2026 on the AK-SM 800A, tracked as CVE-2025-41450.
Why it matters
- exposure The daily code is the same on every unit and has no per-device secret, so a retailer's risk depends on one thing: whether its managers answer from the internet.
- decision Retailers running AK-SM or AK-SC managers have to establish whether any is reachable from the internet, since Pen Test Partners names exposure hygiene as the control that would have stopped this.
- contradiction Pen Test Partners says many controllers are reachable from the internet, not all, so the hygiene argument covers exposed stores and the tens of millions in losses cannot be assigned to exposure alone.
The login is built in, so it is not a default password an operator forgot to change [1]. It sits beside the normal account form, and in our view changing account passwords would not touch it [3]. What an operator controls is whether the unit answers from the internet. Pen Test Partners says many do [1].
Entry still takes work. Neither Synacktiv nor Team82 released the algorithm or put out a working proof of concept, so for now there is no exploit an attacker can simply copy and paste [6]. Pen Test Partners calls the rebuild a modest reverse-engineering job once you hold the firmware [7]. The controller also reports its own date to anyone who asks, with no login [4]. Synacktiv's work is three years older than the attack [13].
The login is the first step. Changing a case's target temperature only lets it drift to store ambient, around 20C to 25C [9]. Reaching 50C meant forcing the defrost heaters to stay on across the store's cases and defeating the sensor and timer that end each defrost [8][10]. That is 25 to 30 degrees above ambient [14]. In normal use a defrost runs the heater for a few minutes [11]. One session can do this store-wide because the system manager pushes settings down to every controller [12].
Pen Test Partners wrote: "What stands out is how little it took." [21] Its post is titled "You don't need a nation state to warm up a fridge" [22], and it wrote that "No AI or insider access needed, and basic cyber hygiene would have prevented it." [20]
The post does not name an attacker or say how many of the stores had an exposed manager. Its nation-state point is therefore about skill. It says the login and the heater step each took some knowledge [8].
What to watch
- Whether the Paris prosecutor or Danfoss publishes an entry route for the 11 October attack.
- Whether anyone publishes the algorithm or a working proof of concept for CVE-2025-41450, which would make the exploit copy-paste.
- Whether the reports from Spain, Portugal, Poland, Germany and Belgium are tied to the same night and the same controllers.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+15
- Incentives40
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The controllers are Danfoss AK-SM and AK-SC system managers, common across European food retail, many reachable directly from the internet, with a built-in login derived from the current date.
- [2]
The login code is generated from the device's date by a fixed algorithm with no per-device secret, so the same code is valid on every unit for a given day.
- [3]
The AK-SM has a second login path that does not use the normal username and password form; it is reached by setting undocumented attributes in a request to xml.cgi, needs no valid account, and returns an administrative session if the right code is supplied.
- [4]
The controller will hand out its own date to anyone who asks, without logging in.
- [5]
Two teams have recovered the algorithm: Synacktiv in 2023 on the SM800, SC255 and SC355, and Claroty's Team82 on the current AK-SM 800A in 2026, where it is CVE-2025-41450.
- [6]
Neither Synacktiv nor Team82 published the algorithm or a working proof of concept, so it is not a copy-paste exploit today.
- [7]
With the firmware in hand, recovering the algorithm is a modest reverse-engineering job, and once recovered the same daily code opens every exposed unit and can be scripted.
- [8]
Reaching 50C meant forcing the defrost heaters to stay on across the store's cases, not just changing a setpoint; both the login and that step took some knowledge.
- [9]
Changing a case's target temperature lets it drift up to store ambient, around 20C to 25C, which is enough to ruin stock.
- [10]
To push past ambient, the defrost is forced to stay on and the sensor and timer that end it are defeated.
- [11]
In a normal defrost the controller stops cooling a case and switches on an electric heater on the coil for a few minutes, and a sensor or timer ends the defrost once the coil is clear.
- [12]
The system manager sits on top of the pack and case controllers and pushes settings down to every controller in the store.
- [13]
Synacktiv's 2023 research predates the 2026 attack by three years.
- [14]
A 50C target is 25 to 30 degrees above store ambient of 20C to 25C.
- [15]
Over the night of 11 October 2026, the fridges and freezers in several hundred French supermarkets were made to warm up.
- [16]
Losses from the French supermarket incident run into tens of millions of euros.
- [17]
Stock was spoiled across Intermarché, Netto, the U cooperative, Carrefour Market and Monoprix, with E.Leclerc also reported.
- [18]
The Paris prosecutor has reported fires, and the post says some equipment reportedly caught fire.
- [19]
There are similar reports from Spain, Portugal, Poland, Germany and Belgium.
- [20]
Pen Test Partners wrote: "No AI or insider access needed, and basic cyber hygiene would have prevented it."
- [21]
Pen Test Partners wrote: "What stands out is how little it took."
- [22]
The Pen Test Partners post is titled "You don't need a nation state to warm up a fridge".
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- pentestpartners.comYou don’t need a nation state to warm up a fridge
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Vulnerability DisclosureFollow
- Retail cyberattacksFollow
- Industrial Control System SecurityFollow