Commercial HVAC Cybersecurity: Where the Contractor’s Job Starts and Ends

On the night of October 11, 2026, someone logged into supermarket refrigeration controllers across France and forced the cases into defrost at setpoints around 122°F, stretching some cycles from one hour to eight to delay alarms.¹ By Tuesday, France’s finance minister put the count at roughly 700 of the country’s 10,000 supermarkets and said the attack “touches the heart of our food security.”²

The targets were Danfoss AK-SM and AK-SC system managers. France’s national cyber agency, CERT-FR, later added Copeland and Dixell XWEB units to its alert.³ Danfoss said the affected units were running outdated firmware.⁴ Copeland pointed to “a discontinued, end-of-life generation of controllers.”⁵

Translation for the field: the fixes existed, nobody installed them, and the boxes sat on the open internet. This is gear HVACR techs install and service.

What’s at Stake

Start with product. Two stores in Alsace reported €270,000 in combined losses.⁶ Intermarché’s CEO estimated national losses in the tens of millions of euros.⁷ Reported fires are still under investigation, and at least one chain said it saw smoke but no confirmed fires.⁵

Then equipment. Profero described an attack this year on an Israeli food plant’s CO₂ refrigeration: changed setpoints, valves forced open, and three compressors destroyed by liquid carryover.⁸

Then records. Supervisory systems like XWEB hold the temperature logs stores keep for inspectors and insurers. Gary’s forensic insurance call on a frozen cooler shows what the morning after looks like.

How They Get In

The attack routes are boring. That is the point.

• Internet-exposed front ends. Claroty researchers counted 2,765 Danfoss AK-SM 800A units reachable online using free scanning tools.⁹
• Predictable passwords. The Danfoss flaw included a login bypass built on date-based passwords.¹⁰ Copeland’s E2 and E3 controllers had a built-in account with a predictable daily password.¹¹
• Old firmware. Every recent disclosure shipped with a patch.
• The contractor’s own logins. In 2013, attackers stole network credentials from Fazio Mechanical, a refrigeration contractor, and used them to get inside Target. About 40 million card accounts were exposed.¹² The way in was the contractor’s email, not the rooftop unit.
• People. Call pretending to be the store manager, ask for a password, and someone often hands it over. Gary and Keith Gipson covered social engineering on the podcast.

What AI Changes

The skill floor just dropped. This past winter, attackers with no industrial-systems experience used commercial AI tools against a water utility near Monterrey, Mexico. Dragos found the AI read vendor documentation for the utility’s SCADA (supervisory control and data acquisition) system and generated lists of default credentials to try.¹³ The push into the control system failed, but the AI did research that used to take a skilled attacker days.

Google’s threat team reported a criminal group using an AI coding assistant to compromise thousands of accounts in under six hours.¹⁴ AI also makes mistakes: Anthropic found its model, misused in a state-backed campaign, regularly claimed credentials that did not work.¹⁵ That barely matters here. A default password on an internet-facing controller does not need a smart attacker. It needs someone who looks, and AI makes looking cheap.

Best Practices by System Type

Light Commercial

Wi-Fi thermostats count. A 2025 flaw in Network Thermostat X-Series units let an attacker reset credentials and take full admin control.¹⁶ No port forwarding to thermostats, ever. Use unique credentials per site and check firmware during the fall commercial maintenance push.

Refrigeration

• Danfoss AK-SM 800A: firmware R4.3.1 or later, with the security level set to Strict.³ ⁹
• Copeland XWEB Pro: firmware 1.13 or later.¹⁷
• Copeland E2: end-of-life since October 2024.¹¹ Flag it for replacement in writing.
• Every visit, compare defrost schedules, setpoints and alarm delays to the design. If you know how a defrost clock is supposed to behave, a schedule someone else wrote will stand out.

BAS

Legacy BACnet/IP and Modbus have no authentication, so anything on the same network can talk to them. BACnet Secure Connect (BACnet/SC) adds encryption and certificates. Tridium Niagara had 13 flaws disclosed in 2025, worst where hardening guidance was skipped.¹⁸ Mitsubishi Electric’s AE-200 and EW-50 central controllers carried an authentication bypass rated 9.8 out of 10.¹⁹ If BMS network architecture is still fuzzy, start there. The remote dashboards customers love are exactly what attackers scan for.

Where Your Job Ends

IT is not an HVAC contractor’s job. Creating a hole in the network is.

Find an exposed controller? Write it up and hand it to the person who owns the network. New to controls? Start with BMS Basics.

Protect Yourself and Your Shop

Third parties were involved in 48% of breaches in Verizon’s 2026 report.²⁰ Customers notice.

• One login per tech, per site. A shared “service” password can’t be shut off one person at a time.
• Log every remote session: who connected, when, from where, with which tool. Get the owner’s authorization in writing.
• Treat the service laptop as critical equipment. MFA (multi-factor authentication) on email and full-disk encryption. Fazio’s inbox was the door to Target.
• Build the paper trail. End-of-life notices, exposure findings and declined recommendations go in writing, every time.
• Ask your broker if cyber is covered. Many general liability policies exclude it.
• Keep site details out of AI. No site IPs, controller logins or network maps in public chatbots. Run any AI tool through the BS detector before it touches customer data.

HKIA could not find a published North American case holding an HVAC contractor liable for a cyberattack at a customer site. Nobody wants to be the first.

Conclusion

The French attack needed no exotic exploit. It needed controllers on the internet, running old firmware, behind predictable passwords. A tech touches every one of those on a PM visit.

Run the five-minute HVAC Cyber Preparedness Scorecard, pick Commercial, and print the fix list. Then read the companion piece, Residential HVAC Cybersecurity, because for most shops the bigger risk is sitting in the office inbox.