Danfoss (Vendor): news timeline & CVEs

Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

Attackers compromised exposed Danfoss and Copeland refrigeration controllers, spoiling food at nearly 700 French supermarkets.

Unknown criminals compromised internet-exposed refrigeration controllers and raised temperatures as high as 50°C, spoiling food and sparking fires across nearly 700 French supermarkets. France’s ANSSI said Danfoss controllers were widely compromised and later added Copeland and Dixell systems. Claroty’s Team82 had warned in August of authentication-bypass and OS command-execution flaws in Danfoss AK-SM 800A and Copeland XWEB devices, after earlier CISA advisories. Coalition scanning still found 1,506 exposed Danfoss StoreView panels and 1,119 XWEB login pages, with many remaining online after the attacks.

The Register · SecurityOct 15, 19:23 UTC · 1d agoExploit / PoC in the wild 19 sources2· 1 read

France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack

French internet-exposed Danfoss StoreView controllers fell 71 percent within three days after a supermarket cyber-attack.

After an October 11 cyber-attack on supermarket refrigeration in France, Censys saw internet-exposed Danfoss StoreView controllers in France fall 71 percent in three days, from 1,825 of 2,991 worldwide hosts on October 11 to 537 on October 14. Danfoss confirmed its equipment was targeted, mainly unsupported AK-SM800 and AK-SC355 models or AK-SM800A units on outdated firmware, but did not confirm the initial access vector. Censys said patched releases (4.3.1 and later, fixing CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452) did not grow, indicating operators removed devices from the internet instead of patching. Claroty previously chained CVE-2025-41450 and CVE-2025-41451 for remote code execution that could disable cooling and falsify temperatures.

Infosecurity Magazineupdated Oct 15, 19:23 UTC · 1d agofirst Oct 15, 13:45 UTC · 1d agoExploit / PoC in the wild 19 sources CVE-2025-41450

Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers

ANSSI says the French supermarket refrigeration attack also hit Copeland and Dixell controllers, affecting about 700 stores.

France’s ANSSI said the cyberattack that disrupted supermarket refrigeration this week also compromised Copeland XWEB and Dixell XWEB controllers, after first warning about Danfoss AK-SM and AK-SC systems. Finance Minister Roland Lescure said about 700 of France’s roughly 10,000 supermarkets were affected, including Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix. At some Intermarché stores refrigeration ran at 50 degrees Celsius for six hours and food was discarded; prosecutors said the attack also caused fires. How access was gained is still unclear and has not been linked to flaws Claroty disclosed this summer. CERT-FR urged operators to take the controllers offline, and investigators have reported neither a claim of responsibility nor a ransom demand.

SecurityWeekupdated Oct 15, 19:23 UTC · 1d agofirst Oct 15, 12:50 UTC · 1d agoExploit / PoC in the wild 19 sources

EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

Hackers exploited unpatched Danfoss fridge controllers, spoiling food at more than 400 European grocery stores.

Attackers remotely manipulated commercial refrigeration controllers at more than 400 French grocery and retail stores, heating units to about 50°C, spoiling food and reportedly causing small fires. Two Alsace supermarkets alone reported about 270,000 euros in losses, and Sekoia said Spain, Portugal, Poland, Germany, and Belgium were also affected. The activity is linked to unpatched Danfoss AK-SM 800A flaws CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452, which Claroty said allow remote code execution or denial of service. Attackers lengthened defrost cycles so the heating resembled routine maintenance; the actor and motive are unknown.

Dark Readingupdated Oct 15, 19:23 UTC · 1d agofirst Oct 15, 07:00 UTC · 1d agoExploit / PoC in the wild 19 sources CVE-2025-41450 CVE-2025-41451

Fridge hack costing millions and sparking fires stemmed from poor security

Poorly secured supermarket refrigeration controllers were mass-hacked, causing fires and huge reported losses across Europe.

Researchers say a mass compromise of poorly secured supermarket refrigeration controllers caused fires and likely cost tens or hundreds of millions of euros. Affected stores reportedly left outdated controllers on the public internet without VPNs, IP allowlists, changed default credentials, or current firmware. Spain, Portugal, Poland, Germany, and Belgium were reportedly affected. Copeland acknowledged a vulnerability in a discontinued end-of-life controller generation, and Danfoss was also cited as referring to discontinued models. The attacker has stayed silent, leaving vandalism or a state-linked disruption among the speculated motives.

Ars Technica · Securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 14, 21:35 UTC · 2d agoData breach in the wild 19 sources

Cyberattack on Connected Fridges in France

Hackers remotely overheated Danfoss supermarket refrigeration units in France, driving some to about 50C.

Attackers took control of software that regulates supermarket refrigeration in France and ordered units to heat and remain hot. One affected supermarket chain reported temperatures around 50C (120F) overnight, far beyond a normal brief defrost cycle. Danfoss said the affected cold units were older models whose security software could not be updated against a risk the vendor had already identified.

Schneier on Securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 14, 14:10 UTC · 2d agoExploit / PoC in the wild 19 sources1

Unplug your smart fridges, French supermarkets warned after cyberattack

Hackers disrupted exposed refrigeration controllers at hundreds of French supermarkets, spoiling chilled food stocks.

A cyberattack on internet-exposed refrigeration controllers ruined chilled and frozen food at hundreds of French supermarkets over the weekend. CERT-FR initially identified Danfoss AK-SC and AK-SM systems, then expanded warnings to Dixell and Copeland equipment, including Dixell’s XWEB interface. Groupement Mousquetaires, operator of Intermarché and Netto, removed products from affected displays. CERT-FR urged stores to disconnect public-facing controllers, use VPNs, update firmware, enforce strict security and replace default passwords.

CSO Onlineupdated Oct 15, 19:23 UTC · 1d agofirst Oct 14, 10:37 UTC · 2d agoExploit / PoC in the wild 19 sources

French Supermarket Cyber-Attack Impacts More Refrigeration Controllers

Attackers altered internet-exposed refrigeration controllers at French supermarkets, spoiling cold storage.

A cyber-attack around October 11 disrupted refrigeration at French supermarkets and appears to extend beyond Danfoss equipment. CERT-FR listed Danfoss AK-SC and AK-SM controllers as well as Dixell and Copeland xweb systems as affected. An E. Leclerc store in Tarn reported disruption despite using Dixell equipment, and Le Monde described a Bordeaux-area supermarket where freezer settings were changed from −22°C to 150°C, with several changes per second. Claroty said many refrigeration controllers are exposed to the internet and that initiating defrost required deliberate action.

Infosecurity Magazineupdated Oct 15, 19:23 UTC · 1d agofirst Oct 14, 09:30 UTC · 2d agoExploit / PoC in the wild 19 sources2

Risky Bulletin: Spyware chip found in Ledger crypto-wallets

Spy chips in Ledger Nano X wallets sold via CryptoBilis stole seed phrases and over $86 million.

Tibane Labs reported spy chips soldered into Ledger Nano X wallets sold by Southeast Asian reseller CryptoBilis, intercepting on-screen seed phrases and sending them to attackers over a built-in modem and eSIM. Ledger linked the backdoored devices to more than $86 million in stolen crypto and told customers to discard affected wallets and move funds; it paused work with CryptoBilis. Newer implants use a painted flex PCB, and at least one Ledger Flex bought at Singapore Airport was also reported implanted. The same bulletin also covers freezer tampering at French supermarkets including Intermarche, an Ahold Delhaize outage, and a Meta GitHub breach affecting more than 1,500 US employees.

Risky Business NewsOct 14, 03:02 UTC · 3d agoMalware in the wild2· 1 read

French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply

SOCRadar reports a French supermarket cyberattack and exposed Danfoss OT behind the food supply.

SOCRadar published an analysis of a cyberattack on French supermarket operations and the operational-technology exposure behind France’s food supply. The article’s sections cover what happened, Danfoss systems and what is known about a related vulnerability, and an exposure snapshot of Danfoss StoreView in France. It also frames the incident as hybrid pressure on French infrastructure and lists recommendations for retail and OT operators. The captured text does not name a specific retailer, CVE, threat actor, or quantified impact.

SOCRadarOct 13, 12:11 UTC · 3d agoData breach1

Cyberattacks crank French supermarket refrigeration systems up to 50°C

Cyberattacks pushed French supermarket fridges to 50°C, spoiling food across hundreds of stores.

Cyberattacks on supermarket refrigeration controllers in France reportedly raised temperatures to 50°C (122°F), spoiling food at hundreds of stores and in some cases starting fires. Carrefour, Intermarché (about 150 stores), Monoprix (about 5% of 490 stores), and Coopérative U (80 of 2,000) were among those affected. Danfoss said impacted equipment ran outdated firmware. CERT-FR reported numerous compromises of AK-SM and AK-SC controllers and advised isolating them, resetting, patching, and rotating credentials. Claroty had previously found a predictable date-based admin bypass in the AK-SM 800A, but authorities have not confirmed that flaw was used. Coopérative U said it is not a Danfoss customer. Separately, Ahold Delhaize reported an unlinked cybersecurity incident disrupting Dutch grocery digital services and stock.

The Register · Securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 12:00 UTC · 3d agoExploit / PoC in the wild 19 sources

Hackers heat up supermarket fridges, spoiling food across France

Attackers tampered with Danfoss refrigeration controllers, spoiling food at French supermarket chains.

Attackers tampered with Danfoss commercial refrigeration controllers used by Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, and Monoprix, forcing stores across France to discard refrigerated and frozen food. Le Monde reported defrost cycles were extended from one to eight hours; some equipment reportedly reached about 50°C, with damaged gear and fires also reported. Danfoss said most affected units were unsupported legacy AK-SM800 and AK-SC355 systems. Les Mousquetaires estimates several million euros in losses, and the Paris prosecutor’s office has opened an investigation. No attacker has been identified, and no link has been established to a separate Ahold Delhaize network incident.

Malwarebytes Labsupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 11:17 UTC · 3d agoExploit / PoC in the wild 19 sources

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers

Attackers remotely heated Danfoss fridge controllers at hundreds of French supermarkets, spoiling stock and causing tens of millions in losses.

On the night of October 11, attackers remotely controlled Danfoss AK-SM and AK-SC refrigeration controllers at French supermarkets, forcing defrost and heating units to as much as 50°C. Intermarché and Netto reported roughly 150 to 300 stores affected, with Carrefour, Coopérative U, Monoprix, and E.Leclerc also hit; Les Mousquetaires estimated losses in the tens of millions of euros. CERT-FR and ANSSI urged operators to disconnect the controllers or tightly filter access. Danfoss said most units were unsupported AK-SM 800 and AK-SC 355 models, plus some outdated AK-SM 800A firmware, and neither a vulnerability nor an attacker has been named.

The Hacker Newsupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 08:48 UTC · 3d agoExploit / PoC in the wild 19 sources2

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers

Team82 found authentication bypass and remote code execution flaws in Danfoss AK-SM 800A controllers.

Claroty Team82 disclosed flaws in the web management interface of Danfoss AK-SM 800A refrigeration controllers used in supermarkets, cold storage, and warehouses. Researchers found a hidden code-of-the-day authentication bypass, command injection CVE-2025-41451 leading to remote code execution, and authenticated injection of arbitrary Nginx directives that can manipulate traffic or cause denial of service. Censys showed 2,765 exposed interfaces. Danfoss patched the issues in new firmware; the report does not describe in-the-wild exploitation.

Lobsters · securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 07:09 UTC · 3d agoVulnerability 19 sources CVE-2025-414512

Cyberattack shuts down refrigerators at French supermarkets

Attackers remotely defrosted refrigerators at 250–350 French supermarkets via Danfoss controllers.

Attackers remotely hijacked older Danfoss refrigeration controllers overnight and used a built-in defrost function to raise refrigerator temperatures at French supermarket chains including Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U. Reports put the impact at 250 to 350 stores, with food waste and financial losses; the Paris prosecutor’s office opened an investigation that also covers reported fires. How the controllers were compromised is unknown. CISA warned in May 2025 about high-severity authentication-bypass CVE-2025-41450 in Danfoss AK-SM 8xxA systems used in food retail, but no evidence yet ties that flaw to this attack.

BleepingComputerupdated Oct 15, 19:23 UTC · 1d agofirst Oct 12, 15:23 UTC · 4d agoExploit / PoC in the wild 19 sources CVE-2025-41450

Attackers Reportedly Hack Supermarket Fridges and Raise Temperatures to 50°C

Attackers remotely compromised Danfoss refrigeration controllers in ~150 French supermarkets, setting temperatures to 50°C and causing major food spoilage and financial losses.

French supermarket chains Intermarché, E.Leclerc, and Système U experienced a cyberattack targeting Danfoss refrigeration control systems overnight October 11-12, with attackers remotely setting temperatures to 50°C and triggering continuous defrost cycles across affected stores. Approximately 150 Intermarché stores were impacted, with potential losses reaching hundreds of thousands of euros from spoiled food stock. Coopérative U CEO Dominique Schelcher confirmed criminal activity affected refrigeration production systems. The exact intrusion method, responsible group, and whether a known vulnerability was exploited remain unconfirmed, though older software versions are suspected.

Cyber Security Newsupdated Oct 15, 19:23 UTC · 1d agofirst Oct 12, 12:54 UTC · 4d agoData breach in the wild 19 sources

Hackers activate automatic defrosting accross European supermarket fridges

Hackers forced Danfoss fridge controls at French supermarkets into continuous defrost, also hitting deliveries and prices.

An ongoing cyberattack has disrupted Danfoss refrigeration controls used by French supermarket chains Intermarché, Leclerc, and Coopérative U, according to La Dépêche and Tom's Hardware. Coopérative U president Dominique Schelcher confirmed Monday morning that refrigeration systems at several stores in the network had been affected since the previous night and called the incident extremely serious. Reports say units were set to defrost continuously at 50 degrees Celsius, while deliveries and electronic shelf-label pricing were also impacted. Teams were mobilized to restore systems and an investigation was promised.

Hacker News · securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 12, 12:16 UTC · 4d agoData breach in the wild 19 sources HN 24↑ · 9 comments

Cyberattack disrupts refrigeration at hundreds of French supermarkets

Attackers remotely triggered defrost on Danfoss controllers, spoiling food at hundreds of French supermarkets.

A cyberattack overnight Sunday remotely triggered defrost on refrigeration controllers at hundreds of French supermarkets, spoiling fresh food. About 300 Intermarché and Netto stores and fewer than 100 Coopérative U locations were affected, according to BFMTV, and ANSSI said it is supporting victims and coordinating in Europe. Retailers linked the systems to Danish manufacturer Danfoss and older software versions, though Danfoss has not confirmed it was targeted. CISA previously published an advisory on three Danfoss controller flaws, and Claroty found more than 2,700 devices exposed online, but it is unknown whether those vulnerabilities were used.

The Recordupdated Oct 15, 19:23 UTC · 1d agofirst Oct 11, 23:00 UTC · 5d agoExploit / PoC in the wild 19 sources1

Danfoss

Timeline18 articles

Related CVEsby mentions

Appears with