Should Security Managers Worry About IoT Attacks After French Fridge Breach?
Should Security Managers Worry About IoT Attacks – Should security managers be concerned about IoT attacks in the wake of the French fridge controller breach? We’d say yes but not for the reasons you’d think.
For anyone who has not been following the story, between October 11 and 12 central refrigeration units of 700 French supermarkets were remotely attacked by unconfirmed parties. France has accused Shahid Kaveh, a cyber unit linked to the IRGC of the attack, but this has been denied by Iran.
What’s so interesting about the attack is that it wasn’t a worm or an IoT botnet malware like Okiru or Satori – instead the attack was activation of a config command already programmed into the controllers – that was it.
As benign as this sounds, the triggered defrost action raised fridge temperatures by up to 50 degrees – from -20 to 30C – causing food to spoil and starting 15 fires.
While initial reports focused on Danfoss the latest CERT-FR alerts name the Danfoss AK-SM controller, the AK-SC controller, and the XWEB consoles of Copeland and Dixell.
Controllers of the type manipulated by the attack are designed to remotely manage typical fridge operations – temperature settings, alarm thresholds and alarm event signalling – and those defrost schedules, which need to be planned with local staff so fridges can be emptied.
The key element in all this is that management interfaces were open to the internet – many management interfaces.
According to cybersecurity firm, Claroty, more that 2700 AK-SM 800A admin interfaces were exposed, while SOCRadar found 4481 Shodan results for Danfoss’ web interface globally, with nearly 3000 in France. Meanwhile another cyber security firm Synacktiv flagged the issue in 2023 and Danfoss released patches.
There’s been a bunch of moaning about why these interfaces had internet connectivity but everyone in automation and BMS knows it’s so temperatures can be tweaked by maintenance firms remotely to eliminate the cost of maintenance logistics.
The point of interest for security and facilities managers is that this attack was the global triggering of an existing and legitimate configuration change that had not been adequately password protected despite warnings from cyber security experts.
So, what was the mechanism of penetration across so many controllers in such a short space of time?
There are couple of theories floating around – the first is an exploit chain. Note that in the common vulnerabilities and exposures pantheon – heaven forbid how this will expand with the help of AI – there are several CVEs that are relevant to the AK-SM 8xxA family of controllers.
Of these, CVE-2025-41450 is a authentication bypass rated CVSS 8.2 and considered a severe risk – Claroty described it as a code-of-the-day mechanism. Meanwhile, CVE-2025-41451 is remote code execution injected by alarm-to-mail command.
Next comes CVE-2025-41452, which is a web server config injection after login. Each of these vulnerabilities has a fix – as long as the fix has been applied.
Alongside these potential vectors of attack is something much simpler and more pathetic. The director of France’s national cybersecurity organisation has told the press that refrigerators were connected directly to the internet and had no cybersecurity protection beyond basic passwords.
Regardless of how the attackers triggered the defrost events, the lesson seems to be one of lifecycle failure and a lack of procedures around patching internet connected devices. Further, there seems to have been a complete lack of risk awareness around the importance of refrigerators in terms of business continuity.
There are controller design failures, too. Consider that the system controlling the process of fridge management also managed alarms – there was no independent situational awareness that might have led to an earlier response to elevating temperatures.
If you think that electronic security controllers don’t have similar potential vulnerabilities, think again.
What are the solutions? Well, you cannot simply air gap everything – it’s untenable. Not only would all connected systems still need to be managed independently, vulnerabilities from USB ports would not be eliminated.
Instead, we’d be thinking about eliminating inbound exposure by denying port forwards and putting vendor and maintenance access via a VPN or ZTNA with multifactor authentication and a hardened host jump. IT teams need to scan their public IP ranges checking Shodan and Censys on the regular.
Something security techs will get – protecting systems within system zones protected by firewall rules between subsystems. You want traffic limited to necessary protocols and trusted hosts and nothing more. For telemetry, we’d be thinking about a unidirectional gateway.
We’d harden authentication and eliminate default and shared passwords. As part of this, you’d want to restrict access to permissions impacting business continuity, including defrost. You’d be hunting for and removing hidden backdoors like code-of-the-day.
Security people are much more across this than fridge people, but your maintenance procedures need to manage product lifecycle all the way to the point the product is thrown away, and you’d have a living asset inventory that logged firmware versions. Anything end of life that could not be patched would be plugged into AC only or replaced.
You also need to monitor config changes using an external controller alerting on variables like setpoint alterations, alarm event changes, defrost schedule changes, defrost event triggers and weird login attempts.
As part of your security and automation system you’d be monitoring fridge temperatures via a completely independent pathway, with relevant programmed thresholds set as organisation alarm events at the monitoring station.
You can scare yourself to death with CheckPoint’s live threat map here or read more SEN news here.
“Should Security Managers Worry About IoT Attacks After French Fridge Breach?”
