French Supermarket Cyberattacks Target Vulnerable Refrigeration Controllers
Hackers exploited known security flaws in internet-connected refrigeration systems to spoil food inventory.
1Widespread Refrigeration Sabotage
Unknown criminals recently hacked thousands of refrigeration controllers across nearly 700 French supermarkets. By remotely increasing temperatures to 122°F (50°C), the attackers caused significant food spoilage and sparked fires. The French national cybersecurity agency, ANSSI, confirmed the widespread compromise of systems manufactured by Danfoss and Copeland, including the Dixell brand.
2Predictable Security Failures
Security researchers at Claroty’s Team82 warned about these specific vulnerabilities as early as August. The flaws included authentication bypass and operating-system command execution, which allowed attackers to manipulate controller settings. Despite these public warnings, many systems remained connected to the internet without receiving essential software updates or critical security patches.
3Regulatory Warnings Ignored
The US Cybersecurity and Infrastructure Security Agency (CISA) issued multiple advisories regarding these controllers throughout 2025. Specifically, CISA highlighted nearly two dozen CVEs in Copeland XWEB and Danfoss AK-SM 8xxA series devices. These warnings detailed how attackers could exploit memory corruption and denial-of-service conditions, yet many organizations failed to implement necessary mitigations.
4Persistent Internet Exposure
Coalition’s sensors identified over 2,600 refrigeration controllers with login pages exposed to the public internet between September and October. Even after the French attacks, hundreds of Danfoss devices remain accessible online. This ongoing exposure demonstrates that digital risk management often fails to extend beyond traditional workstations to critical industrial operational technology.
5Patch Availability Versus Reality
Although Danfoss released firmware update R4.3.1 to address identified flaws, adoption remains dangerously low. Coalition data shows that 54 percent of exposed Danfoss StoreView panels were located within French networks. This gap between patch availability and actual deployment highlights a systemic failure in maintaining secure, internet-facing industrial control systems across the retail sector.
6OT Security Coalition Demands
The Operational Technology Cybersecurity Coalition is now urging CISA to issue a Binding Operational Directive. Members including Honeywell and Schneider Electric argue that baseline cybersecurity measures are essential for protecting the food and agriculture sector. They suggest the US Department of Agriculture should mandate stricter security practices to prevent similar incidents occurring domestically.
7Expanding Threat Landscape
The French incident serves as a stark reminder that industrial devices are primary targets for malicious actors. Tiago Henriques of Coalition noted that digital risk now encompasses far more than email servers or standard office hardware. Organizations must prioritize identifying exposed access points to preserve business continuity and prevent physical damage to critical infrastructure.
8Future Risk Mitigation
As attackers increasingly view industrial control systems as viable attack vectors, the industry faces mounting pressure to act. The transition from legacy, end-of-life hardware to supported, secure systems is vital. Without proactive intervention and the immediate removal of unpatched devices from the public internet, the risk of further large-scale operational disruption remains high.