Weak passwords, internet-facing systems, and outdated equipment enabled intrusions, while an AI coding agent reproduced known controller flaws rapidly

More attacks on connected industrial refrigeration systems in France and other countries are likely, based on numerous interim findings and analyses released so far.

After the cyberattacks on industrial refrigerators and blood banks in France, Vincent Strubel, head of the national cyber agency ANSSI had told the Senate that the controllers had no firewall, and that administrative screens were protected only by weak passwords.

The USA’s FBI and other US agencies have urged operators to remove controllers from the public internet and replace default passwords. Yet, in the United Kingdom, some 274 supermarket refrigeration controllers remained reachable from the open internet.

Furthermore, a spokesperson for Danfoss has told Dutch broadcaster NOS that the systems targeted in the Netherlands were not on a secure network and still used factory-set passwords. Danfoss said most affected units were older products that no longer receive security updates. Copeland had also pointed to a flaw in discontinued controllers, and this had enabled hackers to make 743 changes across 31 devices, including disabling alarms. “The attackers needed no vulnerability, only the default credentials,” wrote one researcher.

AI lowers the barrier

Earlier in 2026, security firm Claroty had published vulnerabilities in Danfoss controllers, and after the French attacks in October, it tested how quickly an AI coding agent could recreate the exploitation process.

Using publicly available firmware and analysis tools, the agent had gained root access to a test device in about 28 minutes, at an estimated cost of roughly US$6 in computing usage. The researchers said a human still needed to intervene when the agent chose an ineffective approach. They also emphasized that the exercise reproduced known flaws rather than discovering new ones.

Attribution remains unclear

No group has claimed responsibility for the attacks or demanded a ransom. France’s foreign minister has blamed Iran. A researcher at SentinelOne suspects that groups aligned with Russia could be possible suspects.

A spokesperson from UK Cyber Defence has advised: “Change the default password and keep these systems off the open internet, and almost all of this goes away.”