Danfoss Optyma Refrigeration Controller Cyberattack Triggers Forced Defrost Across French Supermarkets

On the night of October 11 2026, threat actors compromised internet‑facing Danfoss Optyma refrigeration controllers in roughly 400‑500 French supermarkets by exploiting default admin/admin credentials on exposed HTTP panels and public SNMP v2c community strings, then issued a Modbus TCP forced‑defrost command (function code 0x10, register 0x0015 set to 0x01) that raised unit temperatures to ≈50 °C. The temperature spike caused perishable goods to thaw and spoil, prompting retailer disclosures, ANSSI Level 2 advisories, and Danfoss‑released firmware patch 2026.10.01 with segmentation guidance.

• Attack Vector & Exploitation:

  • Controllers exposed HTTP admin (default admin/admin) on ports 80/443 and SNMP v2c (public community) on port 161.
  • Discovered via Shodan/ZoomEye scans; attackers used credential stuffing/brute‑force to gain remote access.
  • No malware; direct Modbus TCP write used for command execution.

• Technical Details of Payload:

  • Malicious payload: single Modbus TCP write (function code 0x10) to register 0x0015 set to 0x01, triggering forced defrost.
  • Result: temperature rise to ≈50 °C within a 2‑hour window.
  • Indicators: outbound TCP to controller IPs from foreign IP ranges, spikes in temperature logs, unauthorized login events in audit trails.

• Impact Assessment:

  • Approx. 400‑500 store locations affected; 2,000‑3,000 refrigeration units targeted.
  • Food loss estimated €12‑18 million; operational downtime 4‑6 hours per store for inspection, recooling, restocking.
  • Incident response costs €2‑3 million; ANSSI Level 2 alert; potential NIS2 fines for inadequate OT security.

• Mitigation & Response:

  • Danfoss released Security Bulletin SB20261001 and firmware patch 2026.10.01.
  • Recommended actions: network segmentation, firewall rules blocking inbound Modbus/HTTP from untrusted zones, credential rotation, disabling SNMP v2c or migrating to v3 with authentication.
  • Retailers conducted log reviews, restored units, enhanced monitoring; ANSSI issued advisory for similar OT controllers.

• Lessons Learned & Industry Implications:

  • Highlights risk of internet‑facing OT devices with weak authentication in critical food‑supply infrastructure.
  • Reinforces need for zero‑trust segmentation, MFA for OT consoles, regular credential hygiene.
  • Demonstrates OT attacks can cause direct physical and financial damage without traditional malware.
  • Aligns with IEC 62443 and NIS2 OT security mandates for essential services.