Germany’s security office warns Danfoss cooling fixes fall short

Germany’s Federal Office for Information Security, known as BSI, warned on 13 November that vulnerabilities remain in some Danfoss industrial refrigeration systems and that the Danish company had not provided sufficient software updates to counter attacks.

CNA said attacks in the preceding week hit supermarket refrigerators and freezers from Sweden to Belgium, forcing stores to throw away food. The incidents followed a similar attack in France in October 2026; at least some affected units used Danfoss temperature-control technology that was also targeted in France.

How the controls are exposed

Switzerland’s NCSC says its findings show that attackers gain access through control interfaces directly reachable from the internet. Once inside, they can change settings remotely, including temperatures and alarm thresholds. The NCSC says tampering can spoil food, medicines and other temperature-sensitive goods and disrupt operations. Attacks on cooling controls have also come to light in Switzerland. Following the incidents in France, the NCSC had already warned critical-infrastructure operators through the Cyber Security Hub platform.

The NCSC initially identified two Danfoss systems that have reached the end of their supported lives: AK-SM 800 System Manager and AK-SC 355. It also identified the current AK-SM 800A / AK-SM 8xxA family when running outdated firmware, the software that operates the equipment.

What operators should do

BSI advises operators to take affected systems offline where possible. If a connection is needed, it says it should be secured through a virtual private network, or VPN, which provides a protected connection. Security managers should also check whether available Danfoss updates can be installed.

The office cautions that new patches cannot guarantee that further vulnerabilities will not emerge, so industrial controls should not be directly accessible from the internet. The NCSC says updates for the current Danfoss family address known vulnerabilities.

For unsupported systems that must remain in use, the NCSC recommends limiting access to trusted networks or VPN connections and replacing the equipment with supported systems as soon as possible. It also advises organizations to identify their controls and check internet access, including for systems run or maintained by outside providers.