EU Grocers Pay a Steep Price for Unpatched Fridge Firmware
Hackers exploited unpatched Danfoss fridge controllers, spoiling food at more than 400 European grocery stores.
Attackers remotely manipulated commercial refrigeration controllers at more than 400 French grocery and retail stores, heating units to about 50°C, spoiling food and reportedly causing small fires. Two Alsace supermarkets alone reported about 270,000 euros in losses, and Sekoia said Spain, Portugal, Poland, Germany, and Belgium were also affected. The activity is linked to unpatched Danfoss AK-SM 800A flaws CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452, which Claroty said allow remote code execution or denial of service. Attackers lengthened defrost cycles so the heating resembled routine maintenance; the actor and motive are unknown.