IoT & Smart Device Security
Connected Fridge & Appliance Hacks
On the night of October 11–12, 2026, hackers seized Danfoss refrigeration controllers in hundreds of French supermarkets, forcing freezers to 50°C, spoiling food worth millions, and starting fires. The cause was the classic IoT failure stack: end-of-life firmware with no updates, a known authentication flaw (CVE-2025-41450), and admin interfaces exposed to the internet. Smart appliances need the same discipline as servers: inventory, updates, and no internet-facing admin panels.
Key points
- Inventory every connected appliance and controller with model, firmware, and support status.
- Remove internet exposure from all appliance admin interfaces, VPN or allowlisted IPs only.
- Patch supported firmware immediately; Claroty's August 2025 Danfoss research showed auth bypass was fixable.
- Replace EOL controllers that vendors no longer patch, Danfoss said exactly this after the attack.
- Change every default credential; the attack needed only a valid login, no exotic exploit.
- Segment appliances onto isolated VLANs with no path to IT systems or the internet.
- Monitor for abnormal commands (forced defrosts, setpoint changes) like any IDS use case.
- Write the food-safety response plan before the incident: who isolates, who discards, who calls CERT.
Field note
Check your own Shodan footprint quarterly, it takes ten minutes and shows exactly what attackers see. The French victims learned their exposure from the incident report instead.
Frequently asked questions
What exactly happened in France in October 2026?
Attackers took over Danfoss AK-SM/AK-SC refrigeration controllers in hundreds of supermarkets across France and several neighboring countries, forcing heating cycles that spoiled food and caused fires. CERT-FR issued alert CERTFR-2026-ALE-012.
Was it a sophisticated attack?
Evidence points to basics: EOL unpatched firmware and internet-exposed admin panels. A valid login sufficed for normal admin functions like defrost control.
Are home smart fridges at risk too?
Same device classes, same failure modes, default credentials, rare updates, and cloud dependencies. Segment them and update them.
How do we know if our controllers are exposed?
External exposure audits (the Shodan view) plus vendor support-status checks, the two steps victims skipped.
How Kinetikatech helps with iot & smart device security
Honestly, most teams come to us after trying it themselves first: Fridges, cameras, controllers, and building systems were never designed for the hostile internet, we secure them anyway. Our 24/7 Server Monitoring and Server Management service exists so you don't have to learn iot & smart device security the hard way, we handle the setup, the watching, and the 3 a.m. surprises.