On the night of 1 to 2 November 2026, refrigerated cabinets and freezers in more than 100 shops across at least six European countries started warming up, some to around 50 °C. It was the second wave of attacks on internet-exposed refrigeration controllers in three weeks, after hundreds of French supermarkets were hit on 11 and 12 October. On 4 November, EU cybersecurity bodies reminded product manufacturers of their reporting duties, and on 5 November five US agencies, including CISA and the FBI, published a joint fact sheet on hardening these systems.
Most of the coverage has been about spoiled food and empty shelves. The question for engineers is a different one. The devices that were hit are controllers built into commercial refrigeration equipment, and several of the models named by investigators had been out of support for years while still running in shops. Someone designed those cabinets, chose those controllers and wrote the commissioning instructions.
Many Inventor users are in exactly that position. Machine builders, makers of cold rooms, display cases, process skids, packaging lines and test rigs put controllers, gateways and remote-access modules into the products they design. This article looks at what happened, what is confirmed and what is not, and what Inventor teams should change in their product records and designs.
TL;DR: Attackers changed settings on internet-exposed refrigeration controllers in two waves, in France on 11 and 12 October and across Europe on 1 and 2 November 2026. Many of the devices were old models without security updates.
France's CERT-FR named Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB supervisors in its alert. Danfoss said most affected units were legacy products or current products running outdated firmware. The US fact sheet of 5 November lists authentication bypass, code injection and weak configurations as possible routes, and recommends removing controllers from the internet, changing default passwords, updating firmware and retiring unsupported devices. Who is behind the attacks, and exactly how each site was entered, has not been made public. For Inventor teams that build equipment: record every controller and its firmware in the product structure, know its support dates, ship without default passwords and without direct internet access, design for replacement, and keep dated records of what you shipped.
What happened to Europe's supermarket fridges?
The first wave hit France overnight from 11 to 12 October 2026. Refrigeration units in hundreds of supermarkets, including stores of several large chains, were forced into defrost mode, so cabinets and freezers warmed up and stock had to be thrown away. Reported numbers of affected stores vary widely between sources, which is one reason we do not give a single figure here.
The second wave came on the night from Sunday 1 to Monday 2 November. According to SecurityWeek's round-up, more than 100 stores were affected in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, with problems also reported in Finland, Italy and Portugal. A Belgian refrigeration service company said the attackers again switched evaporators to defrost. In the Netherlands, Danfoss said at least 17 businesses were hit, mostly butchers and small grocers. On 3 November the French blood service EFS confirmed that an incident at a refrigeration equipment provider had changed temperature and defrost settings at three of its blood storage sites.
Nobody has claimed the attacks, investigators have not said whether the two waves are linked, and Belgium's federal prosecutor's office has opened an investigation. Researchers quoted in the coverage said the affected units they knew of had management interfaces reachable from the internet, and a deception company reported login attempts against its decoy Danfoss controllers between 20 and 30 October, most of them with factory default credentials that are documented publicly.
Which controllers were involved, and why were they exposed?
France's national cybersecurity agency ANSSI published CERT-FR alert CERTFR-2026-ALE-012 on 12 October and updated it on 13 and 16 October. It lists the Danfoss AK-SM and AK-SC series and the Copeland and Dixell XWEB supervisors, and says plainly that exposing a management interface on the internet goes against good practice. It tells operators to remove internet exposure, check the whole configuration, especially defrost ranges, and restore remote access only through a secure VPN or protected network.
Two details in the alert matter for anyone who designs or sells equipment. First, it warns operators to check their insurance and service contracts before cutting the data link to their refrigeration contractor, because remote monitoring is often part of the deal. Second, it says that keeping an end-of-life device without security fixes on the internet exposes it to a very high probability of compromise, and that a factory reset alone is not enough because the device stays vulnerable.
Danfoss said that most of the affected units in France were legacy products, naming the AK-SM 800, declared end of life in 2021, and the AK-SC 355, phased out in 2016, or current AK-SM 800A units running outdated firmware. It said it keeps providing firmware and security updates for supported products and advises migrating legacy systems. Separately, researchers had described flaws in the AK-SM 800A web interface for which Danfoss had already released fixed firmware; nobody has confirmed that those flaws were used in these attacks.
In other words, this is not a story about one exotic zero-day. It is a story about long-lived equipment, controllers that outlived their vendor support, remote access that was convenient for service, and default settings that nobody changed.
What do the US agencies recommend?
On 5 November, CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation published a joint fact sheet on industrial refrigeration and cold chain monitoring systems. It says attackers may exploit unpatched or internet-accessible controllers through authentication bypass, arbitrary code injection or weak configurations, alter settings and force units into continuous heating and defrost cycles. Possible effects include shorter equipment life, fire hazards, inventory loss and a loss of visibility into current temperatures.
The recommended steps are familiar but specific: no internet exposure for controller panels, remote access only through an up-to-date firewall or edge device, a separate network segment for operational technology, no default passwords, phishing-resistant multifactor authentication where feasible, firmware updates and a lifecycle process to retire unsupported devices, allowlisting of who may make changes, offline backups, logging, and reasonable setpoint limits with alerts. CISA's Chris Butera put it this way: "Every organization that depends on refrigeration and monitoring systems should assume it could be a target."
Why should machine builders and Inventor teams care?
The operators who run the equipment are the first line of defence, but the choices that made these attacks possible were often made earlier, at the design stage: which controller went into the panel, how long its maker promised to support it, whether it shipped with a default password, whether remote access went straight onto the internet, and whether there was room in the enclosure to fit a newer model later.
In the EU there is now a legal angle as well. The joint statement of 4 November from the European Commission, ENISA, Europol's EC3, the EU CSIRTs Network and EU-CyCLONe reminded manufacturers of hardware and software products that under the Cyber Resilience Act they must report actively exploited vulnerabilities and severe incidents through the CRA single reporting platform. That duty has applied since 11 September 2026. Under Article 14 of the CRA, an early warning is due within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report later. The CRA's main design requirements, such as security by design and security support over a defined period, apply from 11 December 2027.
Whether a given machine builder counts as the manufacturer of a product with digital elements, and whether a specific event triggers a report, depends on the product and needs legal advice. What is clear is that a team that cannot quickly say which of its machines contain which controller, with which firmware, will struggle to meet a 24-hour deadline. The same records also matter for product liability, which we covered in our article on the new EU product liability rules that apply from 9 December 2026.
Where do your design records come in?
The table below maps the lessons from the attacks to the product data that Inventor teams already manage.
None of this is new engineering. It is the same discipline that smart manufacturing data security and manufacturing IP and supply chain security call for, applied to the controllers in your own products. Supplier data matters too: CAD data security across supply chains explains why the files you exchange with controller and panel suppliers deserve the same care.
Building equipment for customers? Keep proof of what you designed and when.
BORIS for Autodesk Inventor registers your CAD files with a blockchain timestamp and gives you a certificate of ownership, straight from Inventor.
👉 See how BORIS for Autodesk Inventor works
Does this also affect your own engineering network?
Yes, in two ways. First, the same pattern of exposed management interfaces, old firmware and default passwords applies to the infrastructure around your design data. We have written about the exploited VMware ESX flaw and Vault servers, backup tools as an attack path to Inventor and Vault data and Windows versions that stop getting updates on Inventor PCs and Vault servers. End of support is a risk wherever it appears.
Second, documents that describe your machines are useful to attackers. Commissioning guides, network drawings and service manuals often contain default accounts, port numbers and remote-access details. When such files leak, as in the Clop PLM data leak that put engineering drawings online, they can help someone target the equipment you shipped. Treat them as sensitive design data, not as marketing material.
What should Inventor teams do now?
- Map your controllers. For every product family, list the controllers, HMIs, gateways and remote-access modules in the BOM, with model, firmware version and supplier.
- Know the support dates. Ask suppliers for end-of-support dates and security update policies, store them as item data, and review them at every new revision.
- Ship without default passwords. Make unique credentials part of commissioning, and keep passwords out of drawings and manuals.
- Avoid direct internet access. Design remote service through a VPN or managed gateway, and show it on the machine's network drawing.
- Design for replacement. Leave panel space, mounts and cable routes so a controller can be swapped for a supported model without redesigning the enclosure.
- Set safe limits. Where it matters for safety or product quality, add limits or alarms that a changed setpoint cannot override.
- Plan for reporting. If you sell products with digital elements in the EU, decide who owns CRA reporting and how you would find affected units within 24 hours.
- Keep dated proof. Register released configurations with BORIS so you can show what you designed and shipped, and when, independent of your own servers.
For more background, read our guide to CAD file protection with Vault, encryption, DRM and proof of ownership and how blockchain timestamps help prove design authorship. If you are connecting AI agents to Inventor, our article on the Inventor 2027.2 MCP server explains which data leaves the workstation.
The bigger picture
This week's news on our sister sites shows the same theme from other angles: convenience settings and shared files that expose more than intended.
- Saved secrets in AI tool settings. On CADChain, research on Claude Code permission files in public GitHub repositories found database passwords and keys that had been saved by approving commands, and explains why CAD, PDM and PLM credentials deserve the same care.
- AI that designs hardware. BORIS for SOLIDWORKS looks at OpenAI's report on using its models to design a physical device, including the manufacturing limits the model missed and what it means for design data and authorship.
- Disclosure and permissions for 3D assets. Blended BORIS covers the new AI policy on Nexus Mods, with mandatory AI disclosure tags and new permission settings for using mods in AI training.
Conclusion
The attacks on Europe's refrigeration controllers did not need a sophisticated new technique. They used what was already there: devices that were reachable from the internet, models that no longer received security updates, and passwords that were never changed. Operators are now cleaning up, and authorities on both sides of the Atlantic have spelled out what they expect.
For machine builders, the lesson is about the design stage. Know which controllers go into your products and how long they will be supported, ship them locked down, make them replaceable, and keep records that let you answer quickly when something goes wrong. Those records are also your proof of what you designed, and when.
Your designs, your proof.
BORIS for Autodesk Inventor gives every registered file a blockchain timestamp and a certificate of ownership, straight from Inventor.
👉 Protect your Inventor designs with BORIS
FAQ: refrigeration controller attacks and equipment design
What happened in the refrigeration attacks?
Attackers changed settings on internet-exposed refrigeration controllers, forcing defrost or heating so that cabinets and freezers warmed up. Hundreds of French supermarkets were hit on 11 and 12 October 2026, and more than 100 shops in at least six European countries on 1 and 2 November.
Which devices were involved?
France's CERT-FR named Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB supervisors. Danfoss said most affected units were legacy models without updates or current models running outdated firmware.
Who is behind the attacks?
That has not been made public. Nobody has claimed them, and investigators have not said whether the two waves are linked.
Was a specific vulnerability used?
No specific vulnerability has been confirmed. The US fact sheet lists authentication bypass, code injection and weak configurations as possible routes, and researchers reported attempts with publicly documented default passwords.
What does the Cyber Resilience Act require?
Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours. Most other CRA requirements apply from 11 December 2027. Whether it applies to your product needs legal advice.
Is this relevant if we only design mechanical parts in Inventor?
If your products include controllers, HMIs or remote-access modules, yes. Even if they do not, the same lessons apply to the servers, PCs and backups that hold your Inventor and Vault data.
How does BORIS help?
BORIS for Autodesk Inventor registers CAD files with a blockchain timestamp from inside Inventor, so you can show which version of a design existed and when. It does not secure controllers or replace security updates.