Why does a fridge need a security update?

Connected fridges and freezers are computers on a network. In October and November 2026 attackers took over supermarket refrigeration controllers across Europe. The Cyber Resilience Act requires secure defaults and free security updates for fridges sold from 11 December 2027.

Key takeaways

• On the night of 11 to 12 October 2026, attackers changed the refrigeration settings of hundreds of French supermarkets, and a second wave on 2 November 2026 hit stores from Ireland to Estonia.
• CERT-FR lists Danfoss AK-SC and AK-SM controllers among the targeted equipment and warns that end-of-life units with no security fixes face a very high probability of compromise when exposed. No authority has yet published the attackers' way in.
• Two supermarket controllers have had a login whose password an attacker can work out from the date, the Danfoss AK-SM 8xxA in CVE-2025-41450 and the Copeland E3 in CVE-2025-6519.
• Annex I of the Cyber Resilience Act covers each of those mistakes for products placed on the EU market from 11 December 2027, through secure defaults, access control, a limited attack surface and automatic security updates.
• Article 14 reporting has applied since 11 September 2026, and Article 69(3) applies it to products already on the market, so a manufacturer that learns of an actively exploited vulnerability owes an early warning within 24 hours.

How did a fridge become a network device?

A connected fridge or freezer runs software. Many models add a touch screen, Wi-Fi, a companion app and a cloud account. Supermarket cold rooms and freezer aisles run on supervisory controllers that refrigeration contractors reach over a network for remote maintenance.

Each of those features is an entry point. An entry point needs access control, security updates and a way for outsiders to report flaws. In October and November 2026 the cost of missing controls became visible in European supermarkets.

What happened to Europe's supermarket fridges?

On the night of Sunday 11 October 2026, attackers got into the refrigeration controls of hundreds of French supermarkets. France 24 reported temperatures forced up to 50 °C. Intermarché said its affected stores would have to throw away all of their fresh and frozen products, and warned that some insurance policies may not cover this kind of incident. The chief executive of Coopérative U called the attack "unprecedented". The Paris prosecutor opened an investigation.

On Monday 2 November, three weeks later, supermarkets in Belgium, Luxembourg, Italy, Ireland, the Netherlands, Portugal, Sweden, Finland and Estonia reported refrigeration failures. In Estonia, units were raised to 50 °C. The EU food commissioner, Christophe Hansen, described the attacks as a deliberate attempt to disrupt the food supply chain.

No group has claimed responsibility. No authority has published how the attackers got in.

How did the attackers get in?

No authority has said for certain.

CERT-FR alert CERTFR-2026-ALE-012 lists Danfoss AK-SC and AK-SM controllers, Copeland XWEB and Dixell XWEB as targeted equipment. It says that a management interface exposed on the internet goes against good practice, and that end-of-life equipment with no security fixes has a very high probability of compromise when exposed. It also warns that a factory reset on an unpatched unit removes the attacker and leaves the vulnerability. Its hardening advice for Danfoss units is to update the firmware, set the security level to Strict and change the default passwords.

One of the targeted Danfoss product lines had a known weakness. CVE-2025-41450, published by CISA on 20 May 2025, is an authentication bypass in the AK-SM 8xxA series "caused by datetime-based password generation". Claroty's Team82 explained it on 9 August 2026 as a hidden code of the day, generated from the device's date and time, that lets a login skip the configured password. Danfoss fixed it in firmware R4.2. No authority has linked this CVE to the attacks.

The likely picture is a controller that was reachable from the internet, and that was either behind on its firmware or past the end of its support.

Have we seen the code of the day before?

Yes. In September 2025 Armis published a set of flaws in Copeland's E2 and E3 supermarket controllers under the name Frostbyte10. The first of them is CVE-2025-6519. E3 firmware before version 2.31F01 shipped with a default admin user called ONEDAY, with a password generated daily that an attacker could predictably generate. The record adds that the ONEDAY user "cannot be deleted or modified by any user".

CVE-2025-41450 and CVE-2025-6519 describe the same design choice in products from two manufacturers. An admin login depends on a password that an attacker can derive from the date.

Armis says the Frostbyte10 flaws, combined, give unauthenticated remote code execution with root privileges, and lists food that spoils or becomes unsafe among the consequences. Copeland fixed CVE-2025-6519 in E3 firmware 2.31F01. The industry had public warnings about this class of flaw for more than a year before the French attack.

What about the fridge in your kitchen?

Samsung's RF28HMELBSR has a screen on the door that shows the owner's Google Calendar. At the DEF CON 23 IoT Village in August 2015, the British firm Pen Test Partners examined it and found that it used SSL and then failed to validate the certificate at the other end. An attacker on the same Wi-Fi could pose as the server and potentially collect the owner's Google login. The researchers ran out of time before they could prove the whole attack.

In 2017 Check Point found a flaw in the sign-in of LG's SmartThinQ app and cloud, and called it HomeHack. An attacker could take over a user's LG account, and with it every appliance on that account. The list included fridges, ovens, dishwashers, washing machines, dryers, air conditioners and the Hom-Bot robot vacuum, which has a camera. Check Point told LG on 31 July 2017, LG shipped a fix at the end of September, and Check Point published on 26 October. That sequence is coordinated vulnerability disclosure, and the CRA makes it a legal duty.

In January 2014 Proofpoint reported "at least one refrigerator" in a botnet that sent malicious email, and blamed default passwords. A week later Symantec traced the same spam to infected Windows computers behind home routers and concluded that "the refrigerator was innocent". Symantec still advised users to change all default passwords.

What is the real risk?

The risk takes three forms.

1. Access to other accounts. A kitchen fridge sits on the home Wi-Fi and holds logins. A flaw in the fridge exposes the accounts behind it, as the Samsung and LG cases showed.
2. Use in a botnet. A device with a default password can be recruited into a botnet to send spam or flood a website.
3. Loss of cooling. At home that means spoiled food. In a supermarket it means stock that must be thrown away, as in France in October and in stores from Ireland to Estonia in November.

Each case in this article was fixed, where it was fixed, after somebody found it. The CRA moves the work to the design stage, before the product is sold.

Would the Cyber Resilience Act have stopped the attacks?

Article 69(2) keeps products placed on the market before 11 December 2027 outside the Regulation's requirements unless they are substantially modified from that date. Every controller attacked in 2026 was placed on the market before that date, so Annex I does not reach any of them.

Every failure in this article is a named requirement for a fridge, a freezer or a refrigeration controller placed on the EU market from 11 December 2027. Regulation (EU) 2024/2847 sets the product requirements in Annex I and the manufacturer obligations in Article 13.

What went wrong	Where it happened	CRA requirement that targets it
A login password worked out from the date	Danfoss AK-SM 8xxA (CVE-2025-41450), Copeland E3 (CVE-2025-6519)	Annex I Part I(2)(b), secure by default configuration. Annex I Part I(2)(d), protection from unauthorised access
An admin account nobody can remove	Copeland E3 ONEDAY user	Annex I Part I(2)(d), access control. Annex I Part I(2)(j), limit attack surfaces
A management interface reachable from the internet	CERT-FR alert on the October 2026 attacks	Annex I Part I(2)(j), limit attack surfaces, including external interfaces
Units left behind on firmware updates	CERT-FR hardening advice after the October 2026 attacks	Annex I Part I(2)(c), automatic security updates enabled as a default setting where applicable
End-of-life units with no security fixes	CERT-FR alert on the October 2026 attacks	Article 13(8), a support period of at least five years. Article 13(19), the end date stated at the time of purchase
Cold rooms driven to 50 °C	France and Estonia, 2026	Annex I Part I(2)(h), availability of essential functions also after an incident. Annex I Part I(2)(k), reduce the impact of an incident
Encrypted connection with no certificate check	Samsung RF28HMELBSR, 2015	Annex I Part I(2)(e), confidentiality of data in transit by state of the art mechanisms
Account takeover through the app and cloud login	LG SmartThinQ, 2017	Annex I Part I(2)(d). Articles 3(1) and 3(2) bring remote data processing that the product needs into scope
Flaws found after sale	Every case above	Annex I Part II(2), (5), (6) and (8), remediation, disclosure policy, contact address and free security updates

Each item in the left-hand column is a basic security control. The CRA makes each one a legal requirement for new products.

Two rows need more detail. The automatic update row moves the update from the operator to the product. Annex I Part I(2)(c) makes automatic installation the default where it applies, so a unit receives fixes without a separate firmware project at each site. The support period row makes end of life a date the buyer knows at the time of purchase. Under Article 13(8) the support period reflects how long the product is expected to be in use, with a floor of five years. A refrigeration controller stays in a plant room for a long time, so its maker should plan for a long support period and state the end date at the time of purchase.

Does the CRA apply to the controllers that were attacked?

Article 14 has applied since 11 September 2026, one month before the first attack. Article 69(3) applies Article 14 to products placed on the market before 11 December 2027 as well. When a manufacturer becomes aware of an actively exploited vulnerability in its product, it sends an early warning within 24 hours, a vulnerability notification within 72 hours, and a final report within 14 days after a corrective or mitigating measure is available. For a severe incident having an impact on the security of the product, Article 14(3) and Article 14(4) set a different schedule. The early warning is due within 24 hours and the incident notification within 72 hours, and the final report is due within one month after the incident notification. The reports go through the ENISA Single Reporting Platform to the CSIRT designated as coordinator and to ENISA.

Those filings are not public, so nobody outside the authorities knows what was reported this autumn. The reporting duty makes the manufacturer examine its installed base as soon as it becomes aware of exploitation, with a deadline running. The difference between exploitable and actively exploited is explained in Exploitable vs. exploited, and the rules for older stock are in Does the CRA apply to products already on the market?.

The Annex I requirements apply from 11 December 2027. A fridge, freezer or controller that goes on sale that day with a date-based password, an open management interface or no update route fails Annex I, and the manufacturer may not place it on the EU market. Article 64 sets fines for breaches of Annex I and of Articles 13 and 14 of up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher.

Is a fridge an important product under the CRA?

Most connected fridges and freezers are default-class products. Annex III lists the important products. Its smart home entries cover smart home general purpose virtual assistants and smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems. A fridge whose core functionality is keeping food cold sits in the default class.

Module A self-assessment is open to default-class products. The manufacturer assesses conformity itself. It must still keep technical documentation that holds the cybersecurity risk assessment, the test evidence and the support period, and a market surveillance authority can ask to see it.

What should a fridge maker do now?

1. Publish a contact address for vulnerability reports and a coordinated vulnerability disclosure policy, so a researcher who finds a flaw has a place to report it. A security.txt file under RFC 9116 is the standard way to point researchers at both. Check yours with the free exposure scanner.
2. Remove every hidden, shared or date-based password.
3. Ship with the management interface closed to the internet, and give remote access through a route the owner controls, such as a VPN.
4. Turn on automatic security updates by default, and validate certificates on every connection the product makes, including the connections to your own cloud.
5. Decide now who confirms an actively exploited vulnerability and who sends the early warning.
6. Set a support period that matches how long people keep a fridge or a controller, and state the end date at the time of purchase.

CVD Portal covers the first and fifth. It gives you the reporting portal, the security.txt, the disclosure policy and the Article 14 drafts, and an authorised person at the manufacturer files them on the ENISA Single Reporting Platform. The second, third and fourth are engineering work. The sixth is a business decision. Only the manufacturer can make them.

Sources

• Regulation (EU) 2024/2847 (Cyber Resilience Act), CELEX 32024R2847, Articles 3, 13, 14, 64 and 69, and Annexes I and III.
• CERT-FR. CERTFR-2026-ALE-012, Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération. 12 October 2026, updated 16 October 2026.
• France 24. 'Unprecedented' cyberattack targets refrigeration units at hundreds of French supermarkets. 12 October 2026.
• France 24. Fridge cyberattack hits supermarkets across Europe. 2 November 2026.
• CISA. ICSA-25-140-03, Danfoss AK-SM 8xxA Series (Update A). 20 May 2025, updated 26 August 2025.
• Claroty Team82. Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers. 9 August 2026.
• Armis Labs. Frostbyte10. 2 September 2025.
• CVE Program. CVE-2025-6519. Published 2 September 2025.
• Pen Test Partners. Hacking DefCon 23's IoT Village Samsung fridge. 18 August 2015.
• Check Point. HomeHack: How Hackers Could Have Taken Control of LG’s IoT Home Appliances. 26 October 2017.
• Proofpoint. Proofpoint Uncovers Internet of Things (IoT) Cyberattack. 16 January 2014.
• Symantec Security Response. Despite the News, Your Refrigerator is Not Yet Sending Spam. 23 January 2014. Archived copy.