Temperatures inside hacked refrigeration controllers were raised as high as 122°F (50°C), spoiling food and sparking fires across nearly 700 French supermarkets, after unknown criminals seized thousands of internet-accessible devices late Sunday night, security notices and vendor statements show.
What happened inside the supermarkets: a rapid, high-heat sabotage
Late Sunday night, unknown criminals gained control of refrigeration controllers and “cranked the heat as high as 122°F (50°C),” according to reporting by The Register. The result was widespread food spoilage and fires affecting nearly 700 supermarkets in France. France’s national cybersecurity agency ANSSI on Monday warned of “widespread compromises” involving Danfoss refrigeration controllers, and on Tuesday added affected systems from Copeland and its Dixell brand.
Vulnerabilities flagged months — and in one case more than a year — earlier
Researchers and government agencies had previously warned that these controller families contained exploitable flaws. Claroty’s Team82 “sounded the alarm” in August, publishing details of dozens of vulnerabilities — including authentication bypass and operating-system command execution flaws — affecting Danfoss AK-SM 800A and Copeland XWEB controllers. Separately, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had published advisories: in February it warned that nearly two dozen CVEs in Copeland XWEB and XWEB Pro could be used to bypass authentication, cause denial-of-service, trigger memory corruption, and execute arbitrary code. A May 2025 advisory, updated in August 2025, issued a similar warning about buggy Danfoss AK-SM 8xxA series devices.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePatches were released; exposure continued
Danfoss issued a firmware update — R4.3.1 — to mitigate the disclosed flaws after Team82's research, but security and insurance industry scans found many devices remained reachable over the public internet. Tiago Henriques, chief underwriting officer at cyber insurance provider Coalition, observed that the French supermarket hacks occurred two months after Team82 published its research and after the Danfoss firmware update was released. Danfoss “did not immediately respond to The Register’s request for comment,” while Copeland emailed a statement acknowledging “the vulnerability identified in a discontinued, end-of-life generation of controllers” and saying it was “working with impacted customers to mitigate the risk.”
Coalition’s scans: thousands of controllers with web-accessible login pages
Coalition’s sensors counted widespread internet exposure between September 7 and October 6. Their scan identified 1,506 unique IP addresses publicly exposing a Danfoss StoreView web-admin panel; 820 of those IPs — 54 percent — were associated with French networks. Overall, Coalition’s count found at least 2,624 refrigeration controllers from the named brands with a login page open to the internet: 1,506 Danfoss StoreView and 1,119 XWEB (one IP hosted both). After the attacks, Coalition reported that as of Thursday 618 Danfoss devices remained connected to the internet, including 206 on French networks, 50 in the United States, and 2 in the United Kingdom.
How technologists, policymakers, and retailers are responding
- Technologists and security teams: Claroty’s Team82 public disclosures and CISA advisories had outlined authentication-bypass and remote command-execution vectors. Coalition’s Henriques warned that “An unpatched device featuring a web-accessible admin panel can act as a major entry point,” and added, “The takeaway is clear: digital risk extends far beyond workstations and email servers.” Teams responsible for operational technology (OT) are being pushed to identify exposed controllers and apply available mitigations or isolate devices from the public internet.
- Policymakers and regulators: The Operational Technology Cybersecurity Coalition (OTCC) — whose members include Claroty, Forescout, Honeywell, and Schneider Electric — renewed its call for stronger federal action, asking CISA to issue a Binding Operational Directive to improve OT cybersecurity within the federal government. The OTCC also suggested the U.S. Department of Agriculture could encourage food and agriculture organizations to implement cybersecurity best practices. The coalition warned, “While no incidents have been reported in the United States, malicious actors are undoubtedly viewing this incident as a potential attack vector to perform here” and added, “We cannot wait for that to happen.”
- Affected enterprises and procurement leaders: Copeland described the vulnerable controllers as a “discontinued, end-of-life generation,” and said it would “continue to support customers in strengthening cybersecurity through supported products, current software and industry-recommended practices.” The episode underscores decisions around deploying end-of-life OT equipment and the operational consequences when such devices remain internet-facing without current updates.
The striking timeline — public disclosures and vendor patches months or in some advisories more than a year before the outages — leaves a narrow but concrete question: why so many controllers remained web-accessible after fixes and warnings were available. Claroty’s threat description — that attackers could “freeze the controller” and “defrost the food” — was literal in its effect. The incident now places pressure on vendors, operators, insurers, and regulators to reduce internet exposure of OT devices and to speed remediation where firmware and support have been withdrawn.
