Back to the trend of the day: Hackers switched off the cold in hundreds of French supermarket fridges
Poly Rating · from the trend of the day

Supermarket refrigerator cyber vulnerabilities 2026: top 10

The Danfoss fridge controllers hijacked in October 2026 to heat French supermarket chillers to about 50C had flaws public since 2025, yet none were on CISA's exploited list, and 2,752 were still online the next day.

  • No. 1: Supermarket refrigeration controllers (Danfoss AK-SM / AK-SC)
  • 10 places

01Final list

The leading AIs each built their own list of ten independently. Here is one result that is easy to check: every place has a reason, a source, and the list of AIs that included it.

Order: from most to least AI agreement.

A bright badge means this AI put the entry on its list. A dim badge means it did not.

  1. 1

    Supermarket refrigeration controllers (Danfoss AK-SM / AK-SC)

    Attacked in October 2026: about 2,750 online the next day (Shodan: over 4,500), mostly old unsupported models. They were not on CISA's exploited list, and the fridges were heated to about 50C.

    Included it: Gemini, Claude. Did not include: Meta, ChatGPT, Grok, Kimi.

    In their lists: Gemini: 1 · Claude: 1

    What each AI noted 2
    • Geminiplace 1

      A remote command turned cooling units into ovens at 50°C (122°F), spoiling millions of euros of food in under eight hours.

    • Claudeplace 1

      About 2,750 Danfoss systems were reachable online the day after the attack, 1,590 of them in France, and none of the flaws were on CISA's exploited list.

      Source ↗
    2 AIs put it here
    Source ↗
  2. 2

    Vaccine and pharmacy cold storage with remote monitoring

    Harm in hours once vaccines leave their safe range. A walkie-talkie could fake sensor readings, but no public exposure count or KEV entry exists.

    Included it: Gemini, Claude. Did not include: Meta, ChatGPT, Grok, Kimi.

    In their lists: Gemini: 5 · Claude: 5

    What each AI noted 2
    • Geminiplace 5

      A four-hour defrost override degrades sensitive mRNA vaccines and biologics, destroying clinic supplies before alarms trigger shifts.

    • Claudeplace 5

      A University of Michigan team showed that a walkie-talkie near a freezer could make its sensor report false temperatures.

      Source ↗
    2 AIs put it here
    Source ↗
  3. 3

    Traffic signal controllers

    Harm comes in seconds. A vendor admitted the exposed units it was shown had been end-of-life 'for many years', and a 2024 controller had a web interface with no login. Zero KEV entries.

    Included it: Gemini, Claude. Did not include: Meta, ChatGPT, Grok, Kimi.

    In their lists: Gemini: 6 · Claude: 6

    What each AI noted 2
    • Geminiplace 6

      Directly accessible cellular modems on roadside cabinets allow remote tampering that can cause simultaneous green conflicts in seconds.

    • Claudeplace 6

      One vendor, Econolite, said the exposed controllers it was shown had been end-of-life 'for many years'.

      Source ↗
    2 AIs put it here
    Source ↗
  4. More about the top three ↓
  5. 4

    Refrigerated trucks and reefer containers (telematics)

    Remote setpoint control comes standard on 4G units, but no public cyber advisory, exposure count or KEV entry exists yet. The place rests on judgment.

    Included it: Gemini, Claude. Did not include: Meta, ChatGPT, Grok, Kimi.

    In their lists: Gemini: 9 · Claude: 8

    What each AI noted 2
    • Geminiplace 9

      Cellular telematics dongles allow fleet managers—and remote intruders—to alter cargo setpoints from -20°C to +20°C mid-transit.

    • Claudeplace 8

      Remote setpoint control comes standard on 4G units, yet I found no public cyber advisory, only thieves who pull the battery or antenna.

      Source ↗
    2 AIs put it here
    Source ↗
  6. 5

    Water treatment and well-pump PLCs (Unitronics, Rockwell MicroLogix)

    The only class here with several KEV entries and repeat real attacks: the Unitronics default '1111' password in 2023, and 2026 lockouts across 4,407 exposed Rockwell PLCs (one Forescout scan).

    Included it: Gemini, Claude. Did not include: Meta, ChatGPT, Grok, Kimi.

    In their lists: Gemini: 2 · Claude: 4

    What each AI noted 2
    • Geminiplace 2

      Factory-preset '1111' passcodes on open ports allowed attackers to shut down drinking-water booster pumps across multiple utility districts.

      Source ↗
    • Claudeplace 4

      In 2026 attackers locked operators out of water controllers just by changing IP addresses and passwords, with no exploit needed, and 70% of exposed US controllers sit behind cellular routers.

      Source ↗
    2 AIs put it here
    Source ↗
  7. 6

    Building heating and cooling controllers (BACnet and Tridium Niagara)

    The largest reachable group: 16,899 BACnet servers (Censys) and 29,736 exposed systems (DIVD). Legacy BACnet has no login. Only one KEV entry, and harm builds slower than with food.

    Included it: Gemini, Claude. Did not include: Meta, ChatGPT, Grok, Kimi.

    In their lists: Gemini: 3 · Claude: 3

    What each AI noted 2
    • Geminiplace 3

      Carrying 58% of all exposed building automation endpoints, BACnet sends building temperature setpoints without password checks.

    • Claudeplace 3

      By far the largest reachable population: 16,899 BACnet servers by one Censys count and 29,736 exposed systems by a Dutch CERT, yet no BACnet or Niagara entry was in my KEV search.

      Source ↗
    2 AIs put it here
    Source ↗
  8. 7

    Water and sewage pumping and lift stations (Modbus, SCADA HMIs)

    Modbus has no login by design, and two SCADA products used here are on the KEV list. The only count is a small student snapshot of about 1,436 port-502 hosts.

    Included it: Gemini, Claude. Did not include: Meta, ChatGPT, Grok, Kimi.

    In their lists: Gemini: 8 · Claude: 9

    What each AI noted 2
    • Geminiplace 8

      Small remote lift stations rely on unsegmented cellular gateways, where a stop command triggers raw sewage spills into residential streets.

      Source ↗
    • Claudeplace 9

      Modbus has no authentication by design, and the Linköping student snapshot found only about 1,436 hosts on port 502 (small-scale and undated).

    2 AIs put it here
    Source ↗
  9. 8

    District heating and boiler controls (Modbus TCP)

    Estimate: FrostyGoop malware reportedly cut heating to 600 apartment buildings with raw Modbus commands. That comes from one report, and there is no scanner count or KEV entry for this class.

    Included it: Gemini, Claude. Did not include: Meta, ChatGPT, Grok, Kimi.

    In their lists: Gemini: 7 · Claude: 10

    What each AI noted 2
    • Geminiplace 7

      Operational malware such as FrostyGoop shut down central heating for 600 apartment buildings by sending raw Modbus commands.

    • Claudeplace 10

      I found no scanner count or KEV entry for this class, so its place rests on judgment: it is mostly local to buildings, and the harm builds over days.

      Source ↗
    2 AIs put it here
    Source ↗
  10. 9

    Walk-in cold rooms and restaurant refrigeration (Copeland XWEB Pro)

    Same food clock as Danfoss: Claroty found 23 flaws, 21 of them high severity, including admin passwords that can be computed from the date and MAC address. No exposure count was published.

    Included it: Claude. Did not include: Gemini, Meta, ChatGPT, Grok, Kimi.

    In their lists: Claude: 2

    What each AI noted 1
    • Claudeplace 2

      Claroty found 23 flaws in one controller line, including admin credentials that can be computed from the date and MAC address, and showed it could switch compressors and defrost on a mini-fridge rig.

      Source ↗
    1 AIs put it here
    Source ↗
  11. 10

    Commercial chiller controllers (Trane Tracer SC+)

    Five flaws reported by Claroty, one giving root shell access through a challenge that can be computed without a secret. No KEV entry and no exposure count.

    Included it: Claude. Did not include: Gemini, Meta, ChatGPT, Grok, Kimi.

    In their lists: Claude: 7

    What each AI noted 1
    • Claudeplace 7

      Claroty reported five flaws in Trane's Tracer line, one allowing root shell access through a challenge that can be computed without a secret.

      Source ↗
    1 AIs put it here
    Source ↗

02More about the top three

The ranking is above. Here is more about the three places at the top: what they are, why they are here, and what is worth knowing.

Only Danfoss has a count of devices online (about 2,750, with Reuters' Shodan figure higher). The vaccine and traffic places have no such count, so they rest on research findings and vendor statements.

1Supermarket refrigeration controllers (Danfoss AK-SM / AK-SC)

No. 1 — Supermarket refrigeration controllers (Danfoss AK-SM / AK-SC). On the lists of 2 of 6 AIs; median place there: 1. It was actually attacked, thousands of old units sat online the next day, and heated fridges spoiled food within hours.

Did you know

  • Danfoss had already warned about this controller family in 2023. Advisory DSA-2023-08-01 covered three flaws in the AK-SM800A, the worst a remote command execution. Patch version 3.3 fixes them.

    Source ↗
What it is
Controllers that run the cooling in supermarket fridges and freezers.
Its edge
Only one with a real attack and a count of devices online.
Who should know
Useful to know for anyone who relies on shops for fresh food.
  • Exposed devices onlineAbout 2,750 online
Why it is here

  • After the October 2026 attack, Reuters counted at least 4,500 Danfoss web interfaces visible on Shodan. A separate count by Predicta Lab found 2,752 exposed Danfoss systems. Different scanners give different totals, so the numbers are not added together.

    Source ↗

  • Harm came fast. About 150 Les Mousquetaires stores had fridges heated to up to 50 °C (122 °F) for six hours, per Reuters. Danfoss said most affected devices were obsolete, such as the AK-SM800 and AK-SC355, which no longer get support.

    Source ↗
Did you know

  • CISA's advisory on the Danfoss AK-SM 8xxA series lists an authentication bypass, CVE-2025-41450, in versions before R4.2. Danfoss made release R4.2 to fix it. The advisory is separate from CISA's exploited-flaws list.

    Source ↗
History

  • Danfoss's ADAP-KOOL control, introduced in 1987, was one of the first refrigeration controls with microprocessor control. The installer only set the temperature and differential; the controller handled the rest.

    Source ↗
Keep in mind

  • Danfoss has not confirmed how attackers got in. Scan counts only show devices visible online, not which were hacked. Store totals differ: AFP said at least 300 Intermarché/Netto stores, Reuters about 150.

    Source ↗
Where to go further

  • Read how attackers pushed fridges warm at hundreds of French stores in October 2026. Then check whether your local store's older Danfoss AK-SM 800 units still get updates. Most affected units were old. — (voice only)

    Source ↗
Compare the top three ↓

2Vaccine and pharmacy cold storage with remote monitoring

No. 2 — Vaccine and pharmacy cold storage with remote monitoring. On the lists of 2 of 6 AIs; median place there: 5. Vaccines spoil within hours once they leave their safe range, and sensor readings were shown to be fakeable, though no public count exists.

Did you know

  • A NIST presentation cites a study estimating that 14 to 35% of delivered vaccines are exposed to the wrong storage temperatures. NIST says its program cut vaccine waste by more than 30% in some cases.

    Source ↗
What it is
Fridges and freezers that store vaccines, with remote temperature monitoring.
Its edge
Harm is to health, since spoiled vaccines can still look fine.
Who should know
Useful for anyone who gets vaccines, or works in clinics and pharmacies.
  • Exposed devices onlineNo KEV entry or public count
Did you know

  • Checking a thermometer by hand twice a day can miss problems. A Houston study of 54 vaccine refrigerators found issues that the twice-daily manual logs had missed.

    Source ↗
History

  • In May 2002, three vaccine fridges at a large public health office in Alberta, Canada, were left unmonitored for 20 days. A large store of vaccines was lost, including MMR and varicella.

    Source ↗
Keep in mind

  • This is a 2021 research warning, not a reported real attack. The article gives few test details. It also says sensors less prone to interference may not work below -40 degrees Celsius.

    Source ↗

  • An analysis on the NSF site says fake readings could also trigger unnecessary vaccine recalls. I found no product recall or maker advisory for a specific monitoring system, so the size of the risk is unverified.

    Source ↗
Where to go further

  • Start with the sections on storage units and temperature monitors. They explain how to keep vaccines between 2°C and 8°C and how to check that they stay there. — (voice only)

    Source ↗
Compare the top three ↓

3Traffic signal controllers

No. 3 — Traffic signal controllers. On the lists of 2 of 6 AIs; median place there: 6. Harm could come in seconds, and exposed units were old, unsupported, and in one case had a web page with no login.

Did you know

  • Another researcher found about 30 Econolite traffic controllers running 2018–2020 software that could be attacked remotely. He said they were typically on toll roads and in small cities and counties.

    Source ↗
What it is
Roadside boxes that decide when traffic lights change.
Its edge
Fastest possible harm, in seconds, with no login on one model.
Who should know
Useful for drivers and city staff who rely on safe junctions.
  • Exposed devices onlineZero KEV entries
Why it is here

  • A researcher found an Intelight X-1 traffic controller (CVE-2024-38944) that could be fully controlled without logging in. About 10 days after the report, the vendor replied that it only accepts reports on products it currently sells and lacks resources to analyze end-of-life software.

    Source ↗
History

  • In 2024, researcher Andrew Lemon found that the internet-exposed web interface of an Intelight X-1 traffic controller had no authentication. The vendor, Q-Free, replied with a legal letter saying it only accepts reports for products still for sale.

    Source ↗
Keep in mind

  • The researcher found only about 30 exposed Intelight devices, and it is unclear how many are reachable online. Econolite says his actions would not have been possible if the device had not been exposed to the open internet.

    Source ↗
Compare the top three ↓

The top three side by side

Supermarket refrigeration controllers (Danfoss AK-SM / AK-SC)Vaccine and pharmacy cold storage with remote monitoringTraffic signal controllers
In the AIs' lists2 / 62 / 62 / 6
Exposed devices onlineAbout 2,750 onlineNo KEV entry or public countZero KEV entries
Put first byGemini, Claude——

Places with the same number of AIs are ordered by their average place in the AIs' own lists.

More ratings

03Worth knowing

What the AIs noticed while building the list.

The KEV list alone would not have flagged the French fridge attack: Danfoss AK-SM had no entry, although its two CVEs were public from 2025.

Noticed by:
Included it: Claude. Did not include: Gemini, Meta, ChatGPT, Grok, Kimi.
Source ↗

No new code was needed. The attackers used the controllers' own defrost function to push temperatures to about 50C, and some stores reportedly had fires.

Noticed by:
Included it: Gemini, Claude. Did not include: Meta, ChatGPT, Grok, Kimi.
Source ↗

Claroty published the Danfoss and Copeland flaws on 9 August 2026, and the fridge attack followed about two months later.

Noticed by:
Included it: Claude. Did not include: Gemini, Meta, ChatGPT, Grok, Kimi.
Source ↗

Exposure is falling but is still big enough for campaigns. Bitsight counted about 140,000 exposed ICS in 2019 and about 100,000 in 2023, and exposed Rockwell PLCs fell 47% from the 2020 peak.

Noticed by:
Included it: Claude. Did not include: Gemini, Meta, ChatGPT, Grok, Kimi.
Source ↗

Counts vary widely by source, date and method. Danfoss: 2,752 (Predicta), 2,765 (Censys), over 4,500 (Shodan). Unitronics: 149 in the US (Censys), against an unsourced claim of 1,800–2,500. Some exposed devices are honeypots.

Noticed by:
Included it: Gemini, Claude. Did not include: Meta, ChatGPT, Grok, Kimi.
Source ↗

04How we counted

In plain words, no formulas.

1The question

Top 10 Everyday Machines Most Exposed to Remote Tampering, from Supermarket Freezers to Water Pumps

2Why this topic

Readers see which ordinary machines they rely on every day are most reachable and least patched, a cross-system comparison that no single scanner or advisory list provides.

3Where it applies

Global civilian operational technology: food refrigeration, pharmacy and vaccine cold storage, water treatment, building heating and cooling, traffic control, cold transport

4What we looked at

  • Number of internet-reachable controllers of each system type found by public scanners
  • Number of actively exploited flaws in that system type's controllers on the CISA KEV list
  • Share running end-of-life firmware that no longer gets security updates
  • How fast harm reaches the public if the system is switched off or misset (hours for food and vaccines, longer for others)
  • Predicta Lab (via BleepingComputer) — Danfoss refrigeration systems reachable online on 12 Oct 2026: 2,752, of which 1,590 in France; Shodan quoted at more than 4,500
  • Censys / Claroty Team82 — Internet-reachable Danfoss AK-SM 800A and Copeland XWEB management interfaces (2,765 AK-SM in an earlier scan)
  • Shodan Industrial Control Systems explorer — Internet-reachable ICS and building protocols (Modbus 502, Niagara Fox 1911/4911, BACnet 47808, Unitronics PCOM); live counts need a login
  • Censys BACnet census — 16,899 BACnet servers reachable on the internet (undated, probably several years old)

5Who ranked

The leading AIs, each building its own list of ten independently and naming a source for every place: Gemini, Claude, Meta, ChatGPT, Grok, Kimi.

6How the places were set

The same entry written differently by different AIs was counted as one. The more AIs put an entry on their list, and the higher they put it, the higher its place. "AI agreement" shows how many of the AIs had it on their own list. Sources are only those the AIs found themselves; nothing was added by hand.

05Each AI's own list

🇺🇸 Gemini10 places · 1 notes

The same question, answered by Gemini alone. The final list above combines all the AIs.

  1. 1
    Supermarket Refrigeration Controllers (Danfoss AK-SM / AK-SC)

    A remote command turned cooling units into ovens at 50°C (122°F), spoiling millions of euros of food in under eight hours.

  2. 2
    Municipal Water Well and Pumping PLCs (Unitronics Vision and Samba)

    Factory-preset '1111' passcodes on open ports allowed attackers to shut down drinking-water booster pumps across multiple utility districts.

    Source ↗
  3. 3
    Commercial Building HVAC and Chillers (BACnet/IP Controllers)

    Carrying 58% of all exposed building automation endpoints, BACnet sends building temperature setpoints without password checks.

  4. 4
    Integrated Facility Supervisors (Tridium Niagara JACE)

    Acting as the master brain for hospitals and airports, thousands of supervisory gateways still expose unencrypted Fox protocol ports.

  5. 5
    Pharmacy and Vaccine Cold-Storage Freezers (Ultra-Low Temp IoT)

    A four-hour defrost override degrades sensitive mRNA vaccines and biologics, destroying clinic supplies before alarms trigger shifts.

  6. 6
    Municipal Traffic Signal Controllers (ATC and NEMA TS2 Cabinets)

    Directly accessible cellular modems on roadside cabinets allow remote tampering that can cause simultaneous green conflicts in seconds.

  7. 7
    District Heating Substation Controllers (Modbus TCP Gateways)

    Operational malware such as FrostyGoop shut down central heating for 600 apartment buildings by sending raw Modbus commands.

  8. 8
    Wastewater Lift Station Controllers (EtherNet/IP Micro PLCs)

    Small remote lift stations rely on unsegmented cellular gateways, where a stop command triggers raw sewage spills into residential streets.

    Source ↗
  9. 9
    Refrigerated Freight Telematics (Reefer Truck and Trailer Units)

    Cellular telematics dongles allow fleet managers—and remote intruders—to alter cargo setpoints from -20°C to +20°C mid-transit.

  10. 10
    Commercial EV Fast-Charging Stations (OCPP Gateway Controllers)

    High-amperage direct current chargers connected via public cellular networks can be remotely tripped to destabilize microgrids or halt fleets.

What Gemini noticed

Unlike enterprise IT where malware steals data, operational technology attacks on food and water trigger physical harm in under four hours, rendering forensic recovery secondary to food waste and pressure loss.

Source ↗
🇺🇸 Claude10 places · 4 notes

The same question, answered by Claude alone. The final list above combines all the AIs.

  1. 1
    Supermarket refrigeration controllers (Danfoss AK-SM / AK-SC, France 2026)

    About 2,750 Danfoss systems were reachable online the day after the attack, 1,590 of them in France, and none of the flaws were on CISA's exploited list.

    Source ↗
  2. 2
    Walk-in cold rooms and restaurant refrigeration (Copeland XWEB Pro)

    Claroty found 23 flaws in one controller line, including admin credentials that can be computed from the date and MAC address, and showed it could switch compressors and defrost on a mini-fridge rig.

    Source ↗
  3. 3
    Building heating and cooling controllers (BACnet and Niagara)

    By far the largest reachable population: 16,899 BACnet servers by one Censys count and 29,736 exposed systems by a Dutch CERT, yet no BACnet or Niagara entry was in my KEV search.

    Source ↗
  4. 4
    Water treatment PLCs (Rockwell MicroLogix, Unitronics)

    In 2026 attackers locked operators out of water controllers just by changing IP addresses and passwords, with no exploit needed, and 70% of exposed US controllers sit behind cellular routers.

    Source ↗
  5. 5
    Vaccine and pharmacy cold storage with remote monitoring

    A University of Michigan team showed that a walkie-talkie near a freezer could make its sensor report false temperatures.

    Source ↗
  6. 6
    Traffic signal controllers

    One vendor, Econolite, said the exposed controllers it was shown had been end-of-life 'for many years'.

    Source ↗
  7. 7
    Commercial HVAC and chiller controllers (Trane Tracer SC+)

    Claroty reported five flaws in Trane's Tracer line, one allowing root shell access through a challenge that can be computed without a secret.

    Source ↗
  8. 8
    Refrigerated trucks and reefer containers (telematics)

    Remote setpoint control comes standard on 4G units, yet I found no public cyber advisory, only thieves who pull the battery or antenna.

    Source ↗
  9. 9
    Water and sewage pumping stations (Modbus and SCADA HMIs)

    Modbus has no authentication by design, and the Linköping student snapshot found only about 1,436 hosts on port 502 (small-scale and undated).

  10. 10
    Boilers and district heating controls

    I found no scanner count or KEV entry for this class, so its place rests on judgment: it is mostly local to buildings, and the harm builds over days.

    Source ↗

What Claude noticed

The attacked product, Danfoss AK-SM, had no CISA KEV entry (in the 2026-10-20 feed) when it was hijacked. The two CVEs were public from 2025. The KEV list alone would not have flagged it.

Source ↗

Attackers did not need new code. They used the controllers' own automatic defrost function to push temperatures to about 50C, which also caused fires in some stores.

Source ↗

Exposure counts are falling, not rising. Rockwell PLCs reachable online dropped 47% from 2020 to June 2026, and Bitsight saw about 140,000 exposed ICS in 2019 against about 100,000 in 2023. The remaining ones are still enough for a campaign.

Source ↗

Claroty published the Danfoss and Copeland flaws on 9 August 2026 and the fridge attack followed about two months later. Danfoss says the hijacked units were mostly old models it no longer updates.

Source ↗