On Monday morning, staff at hundreds of French supermarkets arrived at work to find their frozen food aisles were now warm. Overnight, someone had compromised the systems that run the stores’ refrigeration and pushed freezer temperatures as high as 50C. Intermarché and its Netto chain counted at least 300 stores hit. Coopérative U, Carrefour, Monoprix and E.Leclerc all reported attacks. Over 500 stores were affected and some even reported fires from overheating equipment.
You might immediately think this was smart freezers being hacked, but that would be wrong. The target was the controller that runs every freezer in a store, a box hidden in a back room that refrigeration engineers manage remotely. France’s cybersecurity agency named the manufacturer as Danfoss.
Nobody has claimed the attack, and the Prime Minister’s office says the cybersecurity agency found a vulnerability in Danfoss software, but hasn’t given more details. As far as we know, this attack didn’t use AI, nor would the attackers have needed to. Any device connected to the internet can be found. The harder question is what happens when AI is used to attack devices that no human thought worth their time.
Danfoss told the French news agency AFP that most of the affected controllers were legacy products running outdated firmware. It added that it had long advised customers to “migrate legacy systems to current-generation solutions”.
The controllers are a category of systems called operational technology (OT), and OT ages differently from standard IT. It’s designed to run 24 hours a day for decades, and patching OT means downtime for something important. It’s usually maintained by contractors rather than the IT team, so is often left alone and stays reachable long after anyone remembers it. In December 2023, attackers cut water to around 160 households in Erris, County Mayo, Ireland, for two days. In April 2025, someone opened a valve at a Norwegian dam for nearly four hours, probably via a weak password. Neither attack needed much skill. Each found vulnerable OT exposed to the internet.
One of the Danfoss models had a known vulnerability. In 2023, researchers at Synacktiv published an authentication bypass in AK-SM 800 firmware, a hidden “code of the day” that works in place of the password. The code is calculated from the date alone, and the device will tell anyone who asks what the date is. Danfoss said the flaw only affected end-of-life products and advised customers to restrict network access. So the flaw remained unfixed for three years. Nobody yet knows whether the French attackers used it.
Why was any of this kit still running? A Danfoss product notice from April this year, gives the answer.
It lists four legacy controllers, including both models named in France, as end of life with no further technical support. It acknowledges that these systems are still operating in many existing installations. It then says that to comply with various cybersecurity regulations and standards, it is not permitted to publish software updates for end-of-life products. Releasing one would create a legal obligation to bring the platform up to current security standards, which it says is not technically feasible.
Some stores may never have applied the last updates released before support ended. But even if they did, they are still running kit with published vulnerabilities that will never be patched.
The Danfoss document didn’t say which regulations it meant, but it matters less than you’d think. Several are relevant, and none of them relate to a controller already running in a supermarket back room.
The UK’s Product Security and Telecommunications Infrastructure regime, which banned default passwords, only covers consumer connectable products, not a refrigeration controller sold to a business. NIS2 covers food businesses, but only those in wholesale distribution and industrial production. The full requirements of the EU Cyber Resilience Act (CRA) only apply to products placed on the market from December 2027. Anything already running is not covered unless it is substantially modified.
One CRA provision does apply. Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities to regulators within 24 hours, including in legacy products. However, nothing in the regulation requires them to fix the flaws, only to report them.
The CRA probably doesn’t forbid the fix. The European Commission’s draft guidance published in March said security updates generally aren’t substantial modifications, because their purpose is to reduce risk. However, the final text in July added a qualification: a security update can count if it introduces new or increased risks not foreseen in the product’s original risk assessment. Controllers designed long before the CRA would not have been assessed, so faced with that uncertainty, stopping updates is the safe legal choice, and it also happens to sell replacement kit.
For most of the connected-device era, obscure kit was protected by being too boring to attack. Reverse engineering a refrigeration controller’s firmware took a skilled attacker weeks of work, and the payoff was access to one product line in one industry. Attackers had better and more profitable uses for their time.
Vulnerabilities tend to linger, because when the next generation of a product is designed, manufacturers rarely start the software engineering again from scratch. Code is carried forward because it works, and hardware and software components are shared across generations and across rival brands. In 2020, researchers found 19 flaws in a single embedded networking library from a small company called Treck; it was estimated to be included in hundreds of millions of devices built by multiple manufacturers, some of which will never be patched.
In 2025, Claroty’s researchers found the same hidden code-of-the-day login vulnerability I mentioned earlier in the next generation of controllers. It was the same backdoor, two years and a product generation later, but this time it was fixed. Copeland, another major supplier of supermarket refrigeration controls, shipped a default admin account in its E3 controller with a predictable daily password that customers could not delete.
Field engineers need a way in when a customer has lost the password, so each new generation tends to get a new backdoor.
Historically, attackers rarely bothered with obscure controllers that had no published way in. AI is cutting the cost of finding one.
In June, Anthropic’s red team tested how quickly AI can turn a published security fix into a working attack. Its most capable model at the time, Mythos Preview, built eight attacks that took full control of Windows machines using 21 security updates. It worked only from the published patches, without the original source code, and each attack cost about $2,000 in computing time. The researchers concluded that the need for scarce experts has largely gone, and highlighted OT and connected devices that can only be updated during planned downtime as the systems that will become more exposed as costs keep falling.
Mythos Preview isn’t publicly available, but GLM-5.3 is. Released by China’s Zhipu AI as an open-weight model, it matched Mythos Preview closely on one exploit-building benchmark, and Anthropic’s testing found its safeguards could be bypassed 64% of the time with nothing more than a false cover story. Its smaller sibling chained two known Chrome flaws into a working exploit for $20.40. America’s NIST called GLM-5.3 the most cyber-capable open-weight model released to date. Firmware and security updates are often freely downloadable to make it easy for customers.
Vulnerabilities can repeat across products, and AI is good at checking for that. Once a model has found one vendor hiding a backdoor in its login system, it can check the next hundred products for the same thing overnight. Human researchers found similar issues in Danfoss and Copeland products, two years apart, but for a model, checking for them is routine. Anthropic’s researchers made a related point this week: AI agents may put far more effort than human attackers into breaking into large numbers of the world’s connected devices. Most of those are low-value targets that were never worth a skilled human’s time.
Google’s threat intelligence group sees attackers using AI to automate scanning and to create working attacks from newly released software patches. It hasn’t yet seen fully automated attacks against real targets, but to me the direction is clear, as AI makes breaking in cheaper, the devices nobody has examined will start to fall.
Manufacturers and software developers can and should use the same tools the attackers are using. Anthropic just opened a free vulnerability-finding service for open-source maintainers, and any manufacturer can point a model at its own firmware.
Someone has to have a reason to look. For a current supported product, the vendor has a reason, as every flaw it finds first is one it can fix before a customer is hurt. For end-of-life kit, however, nobody does. The vendor says it can’t ship fixes. The retailer doesn’t know what’s inside the box on the back-room wall, and the refrigeration contractor with remote access is paid to keep the freezers cold, not to audit firmware.
That leaves just one party with a reason to point AI at these devices, and it isn’t the one we want.
One change would shift that. Regulators should say plainly that security-only updates to products already in service create no new obligations, under the CRA or any other product rule, whatever the original risk assessment did or didn’t foresee. That removes the reason manufacturers give for walking away. It doesn’t force anyone to patch. But a vendor that is free to fix its old products, and must report every time they are exploited, has a reason to start looking before the attackers do.
If your organisation runs connected OT, it is part of your estate, whatever your asset register says. Find out whether it can be reached from the internet, and make sure remote access goes out through a broker rather than in through an open port. Before you sign for new kit, ask the supplier for its end-of-life date.
Much of this OT was never properly protected. It just wasn’t worth anyone’s time, and AI is about to change that.
I write about AI, cybersecurity, and technology every Friday. Subscribe to get it in your inbox.
Sources
France attack: Al Jazeera, CBC, Euronews, franceinfo, Reuters via TimesLIVE (Danfoss statement, ANSSI finding)
Danfoss end-of-life notice, April 2026: AP561680726928es-MX0101
Synacktiv, AK-SM 800 authentication bypass, 2023: advisory
Claroty Team82, AK-SM 800A: research; CISA ICSA-25-140-03
Copeland E3, CVE-2025-6519: CVE record
Ripple20: JSOF at Black Hat 2020
Erris: The Record; Bremanger: Anadolu
CRA Article 69: regulation text; Commission guidance C(2026) 5252, July 2026, via Osborne Clarke and Addleshaw Goddard
CRA Article 14 reporting timelines: itemis
NIS2 Annex II: text; Finnish Food Authority
PSTI scope: Bird & Bird
Anthropic Frontier Red Team: N-day exploits, GLM-5.3, self-replication
Anthropic OSS Scanner, October 2026: announcement
Google Threat Intelligence Group: From Prompting to Autonomy