Claroty (Organization): news timeline & CVEs

Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

Attackers compromised exposed Danfoss and Copeland refrigeration controllers, spoiling food at nearly 700 French supermarkets.

Unknown criminals compromised internet-exposed refrigeration controllers and raised temperatures as high as 50°C, spoiling food and sparking fires across nearly 700 French supermarkets. France’s ANSSI said Danfoss controllers were widely compromised and later added Copeland and Dixell systems. Claroty’s Team82 had warned in August of authentication-bypass and OS command-execution flaws in Danfoss AK-SM 800A and Copeland XWEB devices, after earlier CISA advisories. Coalition scanning still found 1,506 exposed Danfoss StoreView panels and 1,119 XWEB login pages, with many remaining online after the attacks.

The Register · SecurityOct 15, 19:23 UTC · 1d agoExploit / PoC in the wild 19 sources2· 1 read

France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack

French internet-exposed Danfoss StoreView controllers fell 71 percent within three days after a supermarket cyber-attack.

After an October 11 cyber-attack on supermarket refrigeration in France, Censys saw internet-exposed Danfoss StoreView controllers in France fall 71 percent in three days, from 1,825 of 2,991 worldwide hosts on October 11 to 537 on October 14. Danfoss confirmed its equipment was targeted, mainly unsupported AK-SM800 and AK-SC355 models or AK-SM800A units on outdated firmware, but did not confirm the initial access vector. Censys said patched releases (4.3.1 and later, fixing CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452) did not grow, indicating operators removed devices from the internet instead of patching. Claroty previously chained CVE-2025-41450 and CVE-2025-41451 for remote code execution that could disable cooling and falsify temperatures.

Infosecurity Magazineupdated Oct 15, 19:23 UTC · 1d agofirst Oct 15, 13:45 UTC · 1d agoExploit / PoC in the wild 19 sources CVE-2025-41450

Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers

ANSSI says the French supermarket refrigeration attack also hit Copeland and Dixell controllers, affecting about 700 stores.

France’s ANSSI said the cyberattack that disrupted supermarket refrigeration this week also compromised Copeland XWEB and Dixell XWEB controllers, after first warning about Danfoss AK-SM and AK-SC systems. Finance Minister Roland Lescure said about 700 of France’s roughly 10,000 supermarkets were affected, including Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix. At some Intermarché stores refrigeration ran at 50 degrees Celsius for six hours and food was discarded; prosecutors said the attack also caused fires. How access was gained is still unclear and has not been linked to flaws Claroty disclosed this summer. CERT-FR urged operators to take the controllers offline, and investigators have reported neither a claim of responsibility nor a ransom demand.

SecurityWeekupdated Oct 15, 19:23 UTC · 1d agofirst Oct 15, 12:50 UTC · 1d agoExploit / PoC in the wild 19 sources

EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

Hackers exploited unpatched Danfoss fridge controllers, spoiling food at more than 400 European grocery stores.

Attackers remotely manipulated commercial refrigeration controllers at more than 400 French grocery and retail stores, heating units to about 50°C, spoiling food and reportedly causing small fires. Two Alsace supermarkets alone reported about 270,000 euros in losses, and Sekoia said Spain, Portugal, Poland, Germany, and Belgium were also affected. The activity is linked to unpatched Danfoss AK-SM 800A flaws CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452, which Claroty said allow remote code execution or denial of service. Attackers lengthened defrost cycles so the heating resembled routine maintenance; the actor and motive are unknown.

Dark Readingupdated Oct 15, 19:23 UTC · 1d agofirst Oct 15, 07:00 UTC · 1d agoExploit / PoC in the wild 19 sources CVE-2025-41450 CVE-2025-41451

Fridge hack costing millions and sparking fires stemmed from poor security

Poorly secured supermarket refrigeration controllers were mass-hacked, causing fires and huge reported losses across Europe.

Researchers say a mass compromise of poorly secured supermarket refrigeration controllers caused fires and likely cost tens or hundreds of millions of euros. Affected stores reportedly left outdated controllers on the public internet without VPNs, IP allowlists, changed default credentials, or current firmware. Spain, Portugal, Poland, Germany, and Belgium were reportedly affected. Copeland acknowledged a vulnerability in a discontinued end-of-life controller generation, and Danfoss was also cited as referring to discontinued models. The attacker has stayed silent, leaving vandalism or a state-linked disruption among the speculated motives.

Ars Technica · Securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 14, 21:35 UTC · 2d agoData breach in the wild 19 sources

French Supermarket Cyber-Attack Impacts More Refrigeration Controllers

Attackers altered internet-exposed refrigeration controllers at French supermarkets, spoiling cold storage.

A cyber-attack around October 11 disrupted refrigeration at French supermarkets and appears to extend beyond Danfoss equipment. CERT-FR listed Danfoss AK-SC and AK-SM controllers as well as Dixell and Copeland xweb systems as affected. An E. Leclerc store in Tarn reported disruption despite using Dixell equipment, and Le Monde described a Bordeaux-area supermarket where freezer settings were changed from −22°C to 150°C, with several changes per second. Claroty said many refrigeration controllers are exposed to the internet and that initiating defrost required deliberate action.

Infosecurity Magazineupdated Oct 15, 19:23 UTC · 1d agofirst Oct 14, 09:30 UTC · 2d agoExploit / PoC in the wild 19 sources2

Cyberattacks crank French supermarket refrigeration systems up to 50°C

Cyberattacks pushed French supermarket fridges to 50°C, spoiling food across hundreds of stores.

Cyberattacks on supermarket refrigeration controllers in France reportedly raised temperatures to 50°C (122°F), spoiling food at hundreds of stores and in some cases starting fires. Carrefour, Intermarché (about 150 stores), Monoprix (about 5% of 490 stores), and Coopérative U (80 of 2,000) were among those affected. Danfoss said impacted equipment ran outdated firmware. CERT-FR reported numerous compromises of AK-SM and AK-SC controllers and advised isolating them, resetting, patching, and rotating credentials. Claroty had previously found a predictable date-based admin bypass in the AK-SM 800A, but authorities have not confirmed that flaw was used. Coopérative U said it is not a Danfoss customer. Separately, Ahold Delhaize reported an unlinked cybersecurity incident disrupting Dutch grocery digital services and stock.

The Register · Securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 12:00 UTC · 3d agoExploit / PoC in the wild 19 sources

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers

Team82 found authentication bypass and remote code execution flaws in Danfoss AK-SM 800A controllers.

Claroty Team82 disclosed flaws in the web management interface of Danfoss AK-SM 800A refrigeration controllers used in supermarkets, cold storage, and warehouses. Researchers found a hidden code-of-the-day authentication bypass, command injection CVE-2025-41451 leading to remote code execution, and authenticated injection of arbitrary Nginx directives that can manipulate traffic or cause denial of service. Censys showed 2,765 exposed interfaces. Danfoss patched the issues in new firmware; the report does not describe in-the-wild exploitation.

Lobsters · securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 07:09 UTC · 3d agoVulnerability 19 sources CVE-2025-414512

Cyberattacks hit European grocers: French supermarket freezers hijacked, Dutch and Belgian stores disrupted

Attackers hijacked Danfoss refrigeration controllers at hundreds of French supermarkets, spoiling frozen stock; Ahold Delhaize separately hit by disruptive incident.

Attackers remotely hijacked Danfoss refrigeration control systems overnight at hundreds of French supermarkets including Intermarché, Netto, Super U, Leclerc, Carrefour Market and Monoprix, warming freezers and destroying chilled/frozen goods with per-store damage of tens to hundreds of thousands of euros. Claroty Team82 disclosed flaws in Danfoss AK-SM 800A and Copeland XWEB Pro web management interfaces in August 2026 that were since patched, but it is unconfirmed whether they were exploited here. Separately, Ahold Delhaize confirmed a security issue disrupting Albert Heijn, Etos, Gall & Gall and Delhaize stores in the Netherlands and Belgium, halting distribution centers and knocking websites and apps offline.

Help Net Securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 12, 16:07 UTC · 4d agoExploit / PoC in the wild 19 sources

Major French Supermarket Chains Hit by Cyber-Attack, Food Stock Impacted

Cyberattack on Danfoss refrigeration software hit French supermarket chains, triggering forced defrosts and spoiling food stock.

A cyber-attack from October 11, 2026 targeted refrigeration installations at multiple French supermarket chains including Coopérative U, Intermarché, E. Leclerc, Carrefour and Monoprix. Attackers reportedly compromised outdated Danfoss refrigeration control software, remotely triggering forced defrost cycles with temperatures up to 50°C. Two stores in Haguenau alone lost €270,000 in merchandise, and roughly 150 Intermarché stores are affected. Danfoss controllers have known critical CVEs (CVE-2023-25915, CVE-2025-41450/41451/41452) and Claroty demonstrated similar attacks at DEF CON 34.

Infosecurity Magazineupdated Oct 15, 19:23 UTC · 1d agofirst Oct 12, 11:57 UTC · 4d agoData breach in the wild 19 sources CVE-2023-25915 CVE-2025-41450

Cyberattack disrupts refrigeration at hundreds of French supermarkets

Attackers remotely triggered defrost on Danfoss controllers, spoiling food at hundreds of French supermarkets.

A cyberattack overnight Sunday remotely triggered defrost on refrigeration controllers at hundreds of French supermarkets, spoiling fresh food. About 300 Intermarché and Netto stores and fewer than 100 Coopérative U locations were affected, according to BFMTV, and ANSSI said it is supporting victims and coordinating in Europe. Retailers linked the systems to Danish manufacturer Danfoss and older software versions, though Danfoss has not confirmed it was targeted. CISA previously published an advisory on three Danfoss controller flaws, and Claroty found more than 2,700 devices exposed online, but it is unknown whether those vulnerabilities were used.

The Recordupdated Oct 15, 19:23 UTC · 1d agofirst Oct 11, 23:00 UTC · 5d agoExploit / PoC in the wild 19 sources1

Claroty

Timeline11 articles

Related CVEsby mentions

Appears with