Britain's exposed controllers: a UK exposure report after the French fridge attack

Why we looked

Overnight on 11–12 October 2026, attackers reached into the refrigeration controllers of several hundred French supermarkets and drove the fridges and freezers into an endless defrost cycle. Intermarché, Coopérative U, Carrefour and Leclerc lost their chilled and frozen stock, temperatures reached around 50°C, and a few stores caught fire. We covered what happened and how in a companion piece. The obvious next question for anyone responsible for a UK estate is simple: could it happen here, and is our own equipment sitting in the same exposed state?

So on Monday we looked. Using our own IP Insights threat-intelligence platform alongside the public internet-scan services that anyone, including an attacker, can query, we measured how many refrigeration and building-management controllers in the United Kingdom answer to the open internet. We counted populations and characteristics only — never individual sites, and nothing in this report identifies a single victim. The short answer is that the UK is exposed, though not in quite the shape the French headlines would lead you to expect, and the gap between the two tells a useful story about where the real risk sits.

What we found

Across all vendors, IP Insights identifies over 800 internet-exposed refrigeration and building-management controllers in the United Kingdom whose management interfaces answer directly from the public internet. These are not one manufacturer's products. They span Danfoss, Carel, Copeland and others, and they sit in supermarkets, cold stores, distribution centres, plant rooms and the back offices of businesses that would never describe themselves as running industrial control systems.

To make sure that figure was not an artefact of our own collection, we cross-checked it against public internet-scan data, which anyone can query. The public scanners see only a fraction of the true population — they index web interfaces they happen to have crawled and miss anything on an unusual port or behind a cellular gateway — so their numbers are a floor. Even so, the genuine controller signatures are plainly there, and they fingerprint exactly as you would expect:

The raw counts are small because the public scanners under-count, and because Danfoss specifically — the family exploited in France — barely registers in the UK. That is the first surprise, and it is reassuring only until you look wider. The building-automation layer behind these same networks is far larger: public scanners show around 560 UK endpoints speaking BACnet and roughly 275 running the Tridium Niagara control platform, both of which manage exactly the kind of HVAC and refrigeration plant that was attacked in France. The 800 is the refrigeration-specific slice of a much broader connected-buildings surface.

Why France, and why the UK is different

The France contrast is stark and it explains the attack. Looking at Danfoss controllers worldwide, the public scanners see around 5,000, and France alone accounts for roughly 2,967 of them — close to three in every five Danfoss controllers on the internet, anywhere. South Africa is a distant second at about 500, Germany around 170. The United Kingdom has 15. France was not singled out because someone bore it a grudge; it was singled out because its refrigeration estate was, by a wide margin, the most reachable Danfoss population in the world. When that many identical devices share the same known flaw and the same open front door, an attacker does not need to be sophisticated, only systematic.

The UK's low Danfoss count is therefore the wrong thing to take comfort in. Our refrigeration estate simply favours other vendors, and the exposure has followed them. The Copeland XWEB controllers we found are the clearest example: they cluster on business and machine-to-machine networks such as Jola Cloud Solutions and Wireless Logic, which are UK providers of cellular connectivity for remote sites. That is the signature of a controller sitting on a SIM in a shop or a cold store, reachable from anywhere, placed there so a maintenance contractor can dial in. It is the same design decision that undid France — a web-facing controller a long way from anyone who thinks about networks — wearing a different badge. The lesson does not depend on the brand.

What the data reveals

Three things stand out once you look past the headline counts.

The first is where these controllers live. They are overwhelmingly on consumer broadband, rural broadband and machine-to-machine cellular networks, not on corporate retail infrastructure. That matters because it tells you who put them there. A controller on a store's own broadband line, or on a cellular SIM from an M2M provider, is almost always the work of a refrigeration or building-services contractor who needed remote access and took the quickest route to it: a port forward on the site router, or a public IP on the SIM. The retailer's IT team frequently does not know the device exists.

The second is what the devices are. Several of the Danfoss hosts identify themselves through an InterNiche embedded TCP/IP stack, the kind of lightweight networking software that runs on appliance-grade hardware rather than a general-purpose server. These are not misconfigured PCs; they are the controllers themselves, answering for their own web interfaces on ports 80 and 443. There is no server in between to patch, monitor or defend.

The third, and the most important for anyone reading a number in this report, is that everything here is a floor and not a ceiling. Public internet scanners index only a slice of the internet at any moment, they see web interfaces far better than they see industrial protocols, and they cannot see a controller that answers only to its contractor's gateway. Our own platform sees more than they do, and neither of us sees everything. The honest reading of 800 is "at least 800, and the true figure is higher."

What to do this week

None of what follows needs fear to justify it, and none of it is expensive. The controllers that stayed cold in France were simply the ones that had been patched and were not reachable from outside. That is within reach of every operator reading this.

1. Find out what you have. Ask your refrigeration and building-services contractors for a list of every controller on your estate, the make and model, and the firmware version. The common families are Danfoss AK-SM and AK-SC, Copeland XWEB, Carel and Trane Tracer. If the answer is "we will have to check," that is itself the finding.
2. Take the management interface off the public internet. A controller has no business answering to the open internet, however convenient that is for an engineer on call. Remote access belongs behind a VPN or a managed remote-access gateway, limited to named engineers, with multi-factor authentication and a log of every session.
3. Patch to current firmware. The Danfoss flaw exploited in France was fixed over a year ago. Confirm with your contractor that every controller is on the current release, and make firmware a standing item in the maintenance contract rather than a one-off scramble.
4. Put the contractor's access in your supplier due diligence. The entry point in France appears to have been a third party that manages refrigeration across many sites. Any provider holding remote access to your plant belongs on your supplier register, with the same questions you would ask of any other supplier with a route into your operations: who can use it, how it is secured, and what they would notice if someone else did.
5. Watch the plant. A login to a controller from an unfamiliar address, a defrost command outside the scheduled window, or a temperature alarm with no recovery are all events a monitored environment would raise within minutes. The attack in France ran for roughly six hours before anyone noticed, because nobody was watching and the controllers were doing exactly as they were told.

How to check, and how we can help

If you want to know whether any of your own sites are among the exposed, we can tell you quickly and without touching a single device. IP Insights works entirely from data that is already public, so a check against your organisation's address ranges is passive, non-intrusive and produces a yes-or-no answer per site rather than a report you then have to act on blind. For clients of our managed SOC we already treat refrigeration and building controllers on the same footing as servers and laptops, because an attacker plainly does; for everyone else, a short conversation is enough to get started.

In keeping with how we have always worked, we are sharing the aggregate findings in this report with the relevant national and sector bodies before pushing it widely, so that the people who can act across the whole sector hear it first. We are not publishing addresses, device lists or anything that would help an attacker, and we will not. The purpose of this report is to get controllers patched and taken off the open internet, not to map them for anyone else.

Retail, and the cold chain behind it, runs on trust that the chilled aisle is cold. Keeping that trust turns out to be a matter of knowing what you own, patching it, and not leaving its front door open to the street. That is a very ordinary kind of good morning, and it is the one worth doing.

Methodology and sources

The UK and international figures in this report come from two sources used together: UK Cyber Defence's IP Insights threat-intelligence platform, which collects internet-exposure data from public and passive sources, and the public internet-scan services Shodan and Censys, which anyone can query. All figures are aggregate population counts obtained from counting queries; at no point did we connect to, authenticate against, or interact with any identified device, and this report contains no addresses, no device inventories and nothing that identifies an individual site. Vendor counts were taken from controller-specific signatures (for example the Carel pCOWeb interface and the Copeland XWEB and Danfoss AK-SM / AK-SC web interfaces) rather than loose keyword matches, which is why they are smaller and more conservative than a naive search would return. Public-scanner figures are a lower bound: these services index only part of the internet and see web interfaces far more readily than industrial protocols or devices behind cellular gateways.

The technical background to the Danfoss flaws is drawn from Claroty Team82's 2025 research and the resulting fixes. See our companion piece on the French attack for the full account.

UK Cyber Defence: Cyberattack defrosts the fridges at hundreds of French supermarkets · Claroty Team82: Freeze the Controller, Defrost the Food · CVE-2025-41450 · CVE-2025-41451