Belgium's national cyber agency, the Centre for Cybersecurity Belgium (CCB), issued an urgent warning on 12 November 2026 about six new, unpatched flaws in the Danfoss AK-SM800A, a refrigeration system manager used in supermarkets, cold storage warehouses and food distribution. The flaws were found by researcher Carlo Meijer at Midnight Blue and affect all firmware up to and including version 5.3.2, the latest release the researchers examined. According to the CCB and Midnight Blue, each of the six is a stack-based buffer overflow (a memory error that can let an attacker run their own code) that can be triggered without logging in. No patches and no Common Vulnerabilities and Exposures (CVE) identifiers were available at the time of publication, and disclosure with Danfoss is still in progress, so technical details are being withheld.
This is not a lab finding in isolation. Since 11 October 2026, attackers have repeatedly reached internet-exposed refrigeration controllers from Danfoss, Copeland and Dixell, first in France and then, from 2 November, at supermarkets and cold storage sites across Europe. The CCB says these incidents caused unwanted defrost cycles, destroyed stock and disrupted supply. France has since attributed the October attack to a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), and United States agencies issued a joint fact sheet on hardening refrigeration and cold chain monitoring systems on 5 November. The new research shows that the advice many owners followed after the first wave, which was to change default passwords, install the latest firmware and turn on strict session control, is not enough on its own. Midnight Blue also reports a weakness in the session control feature itself.
The researchers add two warnings that change how owners should think about recovery. Because the controller does not use the secure boot feature of its processor (a check that only trusted firmware can start), an attacker who takes over a device could leave hidden code that survives a factory reset or a firmware update, or could make the controller permanently unusable. In that case the controller would have to be replaced, and cold rooms could be without control for days.
A refrigeration system manager usually sits in a back room or plant room and controls case temperatures, compressor racks and defrost schedules for a whole store or warehouse. Many are reached remotely by the refrigeration service contractor through a cellular modem or a direct internet address, often because maintenance contracts or insurance require remote monitoring. That remote path is exactly what attackers have been using. The same pattern exists in food and beverage plants, pharmaceutical cold chain, and any building where a contractor manages equipment from outside.
Red Tiger has completed more than 500 OT security assessments and trained more than 4,500 people, and contractor-managed building and process equipment is one of the most common blind spots we find. We do more than find and fix weaknesses like this one. Our team can also install a firewall and sensor at the site, connect it to the Red Tiger 24x7 Security Operations Center (SOC), and monitor the site for ongoing detection and response as a 24x7 managed service, with metrics and reports, so an unexpected connection to a controller is spotted and handled quickly.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Check out our resources and book a follow-up call with our team.
