Exposed OT After France's Fridge Hack: Swiss Lessons 2026

In the night of 11 to 12 October 2026, refrigeration controllers in hundreds of French supermarkets were switched into defrost mode and left there for hours. Chilled and frozen goods had to be thrown away. France's CERT-FR reported "numerous compromises" of remote controllers from the Danfoss AK-SM and AK-SC series, later adding Copeland and Dixell xweb systems, and warned that attack campaigns were probably still under way (CERT-FR). Nobody has claimed the attack, and the entry vector has not been confirmed.

What is known is less spectacular than the images of heated freezers, and more useful: the targeted devices were management interfaces reachable from the internet, many of them past the end of their support life. That is not a new story. It is the latest instance of one.

A Pattern, Not an Anomaly

In November 2023, attackers took over Unitronics programmable logic controllers at US water utilities, including the Municipal Water Authority of Aliquippa in Pennsylvania. CISA said they likely got in by "exploiting cybersecurity weaknesses, including poor password security and exposure to the internet", and told operators to confirm that the factory default password "1111" was no longer in use (CISA).

In May 2024, CISA, the FBI, the NSA, the UK's NCSC and other agencies described pro-Russia hacktivists manipulating small OT systems in water, dams, energy and food and agriculture across North America and Europe. Their access came from "publicly exposed internet-facing connections and outdated VNC software, as well as using the HMIs' factory default passwords and weak passwords without multifactor authentication". Once in, they "maxed out set points, altered other settings, turned off alarm mechanisms, and changed administrative passwords to lock out" the operators (joint fact sheet).

Replace water pumps with freezers and the French incident reads the same way: a setpoint changed remotely, at night, on equipment whose owners did not expect it to be reachable. Switzerland's Federal Office for Cyber Security drew the same picture in its 2023/II semi-annual report, noting that hacktivists do not shy away from sabotaging manipulations of exposed OT devices, and that while state sabotage against Switzerland is considered extremely unlikely, hacktivist groups involved in a conflict are likely to target the country (BACS semi-annual report 2023/II).

The Identity Problem: Credentials Nobody Manages

Every one of these cases turns on an identity that sat outside any identity and access management process.

The first kind is the default credential. CERT-FR's recommendations for Danfoss units include setting the security level to "Strict" and making sure default passwords have been changed. The Unitronics and hacktivist cases taught the same lesson three years earlier.

The second kind is the hidden vendor credential. On the current Danfoss AK-SM 800A platform, Claroty's Team82 found a "code of the day" mechanism: instead of validating the configured administrator password, the device accepted a password generated from its own date and time, giving anyone who reproduced the algorithm a full administrative session (Claroty Team82). The flaw is tracked as CVE-2025-41450 and fixed in firmware R4.2 (CISA ICSA-25-140-03). There is no public evidence that it was used in October, and most units hit were older models. The point is structural: a maintenance shortcut is an identity, and nobody on the operator's side knew it existed.

The third kind is the contractor reached by address instead of by name. CERT-FR accepts filtering the source IP addresses of refrigeration contractors on a firewall only as an emergency measure that must not be considered durable, and asks for access to be restored only through a secured VPN or a protected network. An IP allowlist tells you which network a request came from, not which technician made it or whether their laptop is still theirs.

The Governance Problem: Nobody Owns the Device

If identity explains how attackers get in, governance explains why the doors stay open.

Danfoss has said that most of the hijacked units were legacy products that no longer receive security updates; the AK-SM 800 has had none since 2021 and the AK-SC 355 since 2016 (CSO Online). They were still online. Switzerland's KBOB, the coordination body of public-sector builders and property owners, describes exactly this in its July 2025 recommendation on ICT security in building automation: such systems are insufficiently protected in many environments, with missing responsibilities and outdated systems among the main reasons, and device lifecycles of 5 to 20 years that security updates rarely cover in full (KBOB).

Censys adds a dimension that should worry any regulator. About 134,000 hosts exposed ICS services on the internet in early 2026, and roughly 70% sat on consumer or mobile networks, where registration data "often points to the telecommunications provider rather than the organization operating the equipment". The operator "may never hear about the exposure" (Censys). Europe's share fell from 36.5% to 32% between 2024 and early 2026, most of it in France, Italy and Belgium. France was hit anyway.

Contracts can make it worse. Among its recommendations, CERT-FR tells operators to check their insurance terms before cutting the internet data feed of these controllers. When the decision to keep a device online sits with facilities, a refrigeration contractor or an insurer, and the loss lands elsewhere, exposure is a governance outcome, not a technical accident.

What This Means for Swiss Operators

No Swiss incident is known: Migros, Coop, Aldi Suisse and Lidl Schweiz reported no attacks on their stores (SRF). That is the right moment to look, not a reason to relax. The same controller families, building management systems and remote maintenance arrangements run in Swiss retail, hospitals, transport and utilities. Germany's BSI reacted within a day with recommendation BSI-CS 154 for operators of small installations, including food refrigeration: no direct internet access, VPN with multi-factor authentication, prompt updates and routine checks of internet reachability (Solarserver). The Federal Office for Cyber Security's own guidance for connected devices is just as direct: make sure a device is not reachable from the internet if its use does not require it, never keep preset credentials, and disconnect devices that are no longer needed (BACS).

Two Swiss-specific points deserve attention. Since 1 April 2025, operators of critical infrastructure must report cyberattacks to the Federal Office for Cyber Security within 24 hours of discovery (BACS); a manipulated cold chain or building system is exactly the kind of event a CISO should already have mapped against that duty. And the KBOB recommendation offers a ready-made procurement lever: security updates as a condition of maintenance contracts, suppliers informing about major patches at least twice a year, and a named internal role that checks vulnerabilities continuously.

• Search Shodan or Censys for your own address ranges and management interfaces, and remove every OT or building automation interface from direct internet exposure.
• Build an inventory of controllers and building systems with model, firmware, vendor support status and a named accountable owner.
• Eliminate default credentials and bring vendor and maintenance access into your identity process: named accounts, multi-factor authentication through a VPN or gateway, and logs delivered to you.
• Treat IP allowlisting of contractors as a stopgap, with a date by which it is replaced.
• Give every end-of-life device a replacement date and a budget line, not a patch ticket.
• Alert on unannounced setpoint or mode changes outside maintenance windows, not only on temperature thresholds.
• Review maintenance and insurance contracts that require devices to stay online, and add patch, notification and revocation clauses.

The French attackers did not need a zero-day. They needed a door nobody was watching. Closing it is less a matter of technology than of deciding, in writing, who is responsible for it, before the next campaign finds the doors that are still open in Switzerland.