# Reverse Engineering the CRAZY Fridge Hack (what happened?)

Source: https://www.youtube.com/watch?v=JqljXzMrSGk
Recap page: https://rapidrecap.app/video/JqljXzMrSGk
Generated: 2026-10-19T20:49:56.885+00:00

---
## The Gist

A hacker targeted internet-connected Danfoss refrigeration controllers at 700 supermarkets across France on October 11, raising internal temperatures to 50 degrees Celsius and causing millions in food spoilage and fires.

## Quick Overview

Supermarket refrigeration systems run on operational technology that is frequently exposed to the internet with weak security practices and outdated firmware. Clarity Team 82 researchers recently uncovered critical authentication and command injection vulnerabilities in Danfoss AK-SM 800A controllers that allow remote attackers to gain root access. Because thousands of these devices remain directly accessible online without proper security behind a VPN, widespread food spoilage incidents like the recent French supermarket hacks will continue to happen.

**Key Points:**
- An attacker compromised around 700 supermarkets across France on October 11 by exploiting internet-connected refrigeration control units.
- The hacker manipulated temperature settings up to 50 degrees Celsius, triggering defrost cycles that spoiled perishable goods and sparked electrical fires.
- Team 82 at Clarity discovered severe vulnerabilities in Danfoss AK-SM 800A refrigeration controllers two months prior to the incident.
- The controllers suffered from a hardcoded day-code authentication mechanism and a command injection flaw that combined to grant unauthenticated remote root access.
- Danfoss released firmware version R4.31 to address the security flaws, but many operators fail to update their operational technology.
- A public search reveals thousands of vulnerable Danfoss management controllers directly exposed to the internet without proper virtual private network protection.
- Critical operational technology systems running on C often prioritize uptime over security, leaving embedded software dangerously vulnerable to remote exploits.

![Screenshot at 02:31: The executive summary of the pentest report showing critical path traversal and remote code execution findings in the target software.](https://ss.rapidrecap.app/screens/JqljXzMrSGk/00-02-31.jpg)

**Context:** Operational technology includes critical infrastructure devices like power controllers, water pumps, and refrigeration units that directly impact the physical world. Unlike traditional web applications that undergo rigorous penetration testing, operational hardware is rarely updated and often exposed directly to the internet with weak authentication safeguards.

## Detailed Analysis

The video breaks down how a massive cyberattack ruined millions of dollars worth of food across 700 French supermarkets by exploiting remote refrigeration controllers. The attacker infiltrated Danfoss AK-SM 800A supervisory control and data acquisition units by leveraging known vulnerabilities, specifically bypassing authentication through a predictable day-code algorithm and executing malicious commands via email configuration injections. Despite security researchers disclosing these flaws and Danfoss releasing firmware patches, thousands of facilities leave these industrial devices exposed directly to the internet without adequate perimeter security.

### The French Supermarket Refrigeration Hack

An October cyberattack targeted operational technology across France and destroyed massive amounts of inventory.

- A malicious actor compromised an estimated 700 supermarkets throughout France on the night of October 11.
- The attacker exploited internet-connected refrigeration control units and drove internal temperatures up to 50 degrees Celsius.
- The forced defrost cycle spoiled tons of perishable food and caused electrical systems in multiple supermarkets to catch fire.

![Screenshot at 00:34: A news article showing empty grocery store refrigerators after the cyberattack destroyed perishable food supplies in France.](https://ss.rapidrecap.app/screens/JqljXzMrSGk/00-00-34.jpg)

### Vulnerabilities in Danfoss Refrigeration Controllers

Research published by Team 82 exposed critical security flaws in widely deployed Danfoss hardware.

- Danfoss AK-SM 800A controllers manage commercial refrigeration infrastructure in supermarkets, cold-storage facilities, and warehouses.
- Researchers discovered a hardcoded day-code authentication mechanism that generates daily passwords based on the device date and time.
- Attackers can combine the authentication bypass with command injection flaws in the email configuration to gain root access and control the device.

![Screenshot at 03:41: The research article headline detailing the vulnerabilities discovered in Danfoss refrigeration controllers.](https://ss.rapidrecap.app/screens/JqljXzMrSGk/00-03-41.jpg)

### Operational Technology Security Failures

Industrial control systems suffer from poor coding practices and a complete lack of maintenance after deployment.

- Operational technology devices are designed to keep critical infrastructure running constantly, making engineers reluctant to apply firmware updates.
- Many facility operators place sensitive hardware directly on the public internet instead of housing them behind secure virtual private networks.
- Public search engines index thousands of vulnerable refrigeration management panels worldwide, leaving them exposed to automated attacks.

![Screenshot at 06:17: A global map showing thousands of Danfoss management controllers directly accessible on the public internet.](https://ss.rapidrecap.app/screens/JqljXzMrSGk/00-06-17.jpg)