Cyberattacks Manipulate Grocery Refrigeration Systems, Spoiling Food at 400+ Stores
Summary
Attacks manipulated refrigeration systems at more than 400 grocery and retail stores, spoiling food and reportedly causing small fires. The actor is unknown; outdated firmware and exposed systems are cited as risks.
Key points
- Companies reported that attacks affected more than 400 grocery and retail stores in France; a Sekoia analyst told Reuters that Spain, Portugal, Poland, Germany, and Belgium were also affected.
- Attackers reportedly changed refrigeration controllers to heat cold-storage units, while extending defrost cycles to make the heating appear routine.
- Two supermarkets in Alsace reported combined losses of 270,000 euros; broader losses could reach many millions, but that figure is an estimate.
- Danfoss said affected units included end-of-life AK-SM 800 and AK-SC355 systems. The article says researchers had disclosed and Danfoss patched vulnerabilities in AK-SM 800A, but customers had to install firmware updates.
- France's CERT-FR also identified Dixell/Copeland XWEB controllers in the attacks; the article does not establish which vulnerabilities or firmware versions were involved.
- Les Mousquetaires said its attack occurred through a refrigeration-system service provider. The attacker and motive remain unknown.
- The article recommends removing control systems from direct Internet exposure, restricting remote access, using firewall rules and two-factor authentication, and replacing unsupported firewalls. Separate US military commissary outages have not been attributed to an attack.
Article Details
- Victim Organization
- French grocery chains, including Les Mousquetaires, Intermarché, and Netto; the article does not identify all affected companies
- Incident Type
- Cyberattacks manipulated commercial refrigeration controllers, turning refrigeration units into heating units and spoiling food.
- Affected Records
- More than 400 grocery and retail stores were reportedly affected.
- Operational Impact
- Refrigerators, freezers, and cold storage rooms were reportedly heated to as high as 50°C, spoiling stored food; some small fires were also reported. Two supermarkets in Alsace reported combined losses of €270,000.
- Claim Status
- confirmed
CVE
CVE-2025-41450Team82 disclosed three vulnerabilities in Danfoss' AK-SM 800A platform. The issues — assigned CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 — allowed attackers to perform remote code execution (RCE) orCVE-2025-41451three vulnerabilities in Danfoss' AK-SM 800A platform. The issues — assigned CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 — allowed attackers to perform remote code execution (RCE) or denial-of-serviceCVE-2025-41452in Danfoss' AK-SM 800A platform. The issues — assigned CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 — allowed attackers to perform remote code execution (RCE) or denial-of-service (DoS) against
People
Andrew GinterVice president of industrial security at Waterfall Security Solutions, quoted giving network-security advice.Bill MooreXona Systems CEO quoted discussing third-party access risks to operational technology.M. ElizabethIndependent journalist who speculated that someone may have hacked commissary freezers at US military installations; the article says the cause was not confirmed.
Vendors
Copelandthat another refrigeration controller platform — "XWEB," from vendors Dixell and parent company Copeland — had also been involved in the attacks. It didn't specify what vulnerabilities or firmware versionsDanfosssuggested that Monday's attacks traced back to refrigeration controllers from Danish manufacturer Danfoss. Danfoss has a large footprint in supermarket and food retail control solutions, with more than 50,000DixellCERT (CERT-FR) had identified that another refrigeration controller platform — "XWEB," from vendors Dixell and parent company Copeland — had also been involved in the attacks. It didn't specify what
Products
AK-SC355Cooling Post. The "majority" of affected units, it said, were running AK-SM 800 or its older AK-SC355. Both systems are long since end of life: the former as of 2021, the latter 2016.AK-SM 800a refrigeration news publication, Cooling Post. The "majority" of affected units, it said, were running AK-SM 800 or its older AK-SC355. Both systems are long since end of life: the former as of 2021, the latter 2016.Danfoss AK-SM 800AOn Aug. 9, cybersecurity researchers from Claroty's Team82 disclosed three vulnerabilities in Danfoss' AK-SM 800A platform. The issues — assigned CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 — allowed attackers toXWEBTuesday, France's national CERT (CERT-FR) had identified that another refrigeration controller platform — "XWEB," from vendors Dixell and parent company Copeland — had also been involved in the attacks. It didn'tXWEB Prosame day they outed those vulnerabilities affecting Danfoss, the same researchers disclosed 23 affecting XWEB Pro, 21 of high severity.
Countries
Belgiumanalyst for French cybersecurity company Sekoia told Reuters that Spain, Portugal, Poland, Germany, and Belgium had also been affected.FranceBy Tuesday, France's national CERT (CERT-FR) had identified that another refrigeration controller platform — "XWEB," from vendors Dixell and parent company Copeland — had also been involved in the attacks. It didn'tGermanynight. An analyst for French cybersecurity company Sekoia told Reuters that Spain, Portugal, Poland, Germany, and Belgium had also been affected.Polandon the same night. An analyst for French cybersecurity company Sekoia told Reuters that Spain, Portugal, Poland, Germany, and Belgium had also been affected.Portugalall on the same night. An analyst for French cybersecurity company Sekoia told Reuters that Spain, Portugal, Poland, Germany, and Belgium had also been affected.Spainstores, all on the same night. An analyst for French cybersecurity company Sekoia told Reuters that Spain, Portugal, Poland, Germany, and Belgium had also been affected.
Industries
Food retailcontrollers from Danish manufacturer Danfoss. Danfoss has a large footprint in supermarket and food retail control solutions, with more than 50,000 installations of its technology worldwide, according to itsGrocery and retailAccording to the companies' own reports, the attacks impacted somewhere north of 400 grocery and retail stores, all on the same night. An analyst for French cybersecurity company Sekoia told Reuters that Spain,