Hackers exploited unpatched Danfoss fridge controllers, spoiling food at more than 400 European grocery stores.
Attackers remotely manipulated commercial refrigeration controllers at more than 400 French grocery and retail stores, heating units to about 50°C, spoiling food and reportedly causing small fires. Two Alsace supermarkets alone reported about 270,000 euros in losses, and Sekoia said Spain, Portugal, Poland, Germany, and Belgium were also affected. The activity is linked to unpatched Danfoss AK-SM 800A flaws CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452, which Claroty said allow remote code execution or denial of service. Attackers lengthened defrost cycles so the heating resembled routine maintenance; the actor and motive are unknown.
Attackers heated refrigeration systems to about 50°C at more than 400 stores.
Two Alsace supermarkets reported combined losses of about 270,000 euros.
Claroty disclosed CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 in Danfoss AK-SM 800A.
Danfoss patched the flaws, but customers had to update systems themselves.
Sekoia reported effects in Spain, Portugal, Poland, Germany, and Belgium.
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version…
Indicators of compromiseauto-extracted · verify before use · export allAll →
Type
Indicator
Context
md5
3ef22544cbb516d50d8fedafef6855a8
-delta-industrial-plcs#recipe=similar-items&sourcecontentid=3ef22544cbb516d50d8fedafef6855a8) Trio of Critical Bugs Spotted in Delta Industrial PLCs by
md5
519f866bd9cb0808a2c4934672007466
ensors-silent-tracking#recipe=similar-items&sourcecontentid=519f866bd9cb0808a2c4934672007466) Vehicle Tire Pressure Sensors Enable Silent Tracking by J
md5
6709b09566c154b383fa194e8d34ff5f
mpatible-work-securely#recipe=similar-items&sourcecontentid=6709b09566c154b383fa194e8d34ff5f) AI in OT Sparks Cascade of Complex Challenges by Arielle
md5
a7eb29aeaac9d69fb51ea172d29e5391
king-systems-tampering#recipe=similar-items&sourcecontentid=a7eb29aeaac9d69fb51ea172d29e5391) Critical Railway Braking Systems Open to Tampering by Nat
Full article1,997 words · extracted from darkreading.com · click to collapse
Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow…
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version…
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.
Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow…
Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions
Hundreds of French grocers likely lost many millions of dollars this week from cyberattacks that manipulated their refrigeration systems.
Overnight on Monday, hackers broke into commercial refrigeration system controllers at major French grocery chains. They converted refrigerators, freezers, and cold storage rooms into heating units, raising their temperatures up to 50 degrees Celsius (over 120 degrees Fahrenheit), completely spoiling all of the food they contained, and reportedly even causing some small fires. The threat actor's identity and motives are unclear.
Refrigeration controllers allow grocers to set and monitor their fridge temperatures remotely, 24/7. It follows, then, that store owners could've been alerted to, or manually discovered, the fact that something was amiss. To prevent that from happening, French sources report that the attackers extended their targeted systems' defrost cycles — where freezers intentionally melt accumulated frost and ice — so that the heating looked like routine maintenance.
According to the companies' own reports, the attacks impacted somewhere north of 400 grocery and retail stores, all on the same night. An analyst for French cybersecurity company Sekoia told Reuters that Spain, Portugal, Poland, Germany, and Belgium had also been affected.
Just two supermarkets in the Alsace region reported combined losses of 270,000 euros (about $300,000 USD), according to the BBC. If those two cases are anything to go by, losses for all 400 stores could total many, many millions of euros.
Worst of all, experts point out that the attacks were almost certainly avoidable with standard cyber hygiene.
What Caused Freezers to Burn?
Initial reports suggested that Monday's attacks traced back to refrigeration controllers from Danish manufacturer Danfoss. Danfoss has a large footprint in supermarket and food retail control solutions, with more than 50,000 installations of its technology worldwide, according to its website.
On Aug. 9, cybersecurity researchers from Claroty's Team82 disclosed three vulnerabilities in Danfoss' AK-SM 800A platform. The issues — assigned CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 — allowed attackers to perform remote code execution (RCE) or denial-of-service (DoS) against enterprise refrigeration fleets. Danfoss patched the vulnerabilities but counted on customers to update their systems themselves.
In a statement to Reuters, Danfoss pinned the blame on customers running outdated firmware, writing that it "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."
The original equipment manufacturer (OEM) provided more information to a refrigeration news publication, Cooling Post. The "majority" of affected units, it said, were running AK-SM 800 or its older AK-SC355. Both systems are long since end of life: the former as of 2021, the latter 2016.
By Tuesday, France's national CERT (CERT-FR) had identified that another refrigeration controller platform — "XWEB," from vendors Dixell and parent company Copeland — had also been involved in the attacks. It didn't specify what vulnerabilities or firmware versions might've been at fault, though the circumstantial evidence now surely points to threat actors building off of Team82's research. On the exact same day they outed those vulnerabilities affecting Danfoss, the same researchers disclosed 23 affecting XWEB Pro, 21 of high severity.
Grocers Were Warned on Possible Fridge Attacks
On Aug. 26, a strange collection of similar reports started to seep out of US military installations.
Refrigeration units were dying. In each base where it was happening, folks probably figured they were dealing with some odd electrical issue. But then more and more stations reported the same thing.
After coming across these odd reports on social media, an independent journalist took a wild guess. "Self-aware enough to know this sounds insane, but I need you to stick with me," wrote M. Elizabeth on Substack. "I think there is a nonzero chance someone has hacked the commissary freezers."
To date, the US military has not confirmed who or what caused outages at commissaries spread across at least 14 separate Air Force bases, Navy installations, and Army posts. It could have been a coincidence that the attacks occurred only two weeks after Danfoss's vulnerability disclosures.
It would be extra coincidental considering that the Defense Commissary Agency (DeCA) — the Defense Department's (DoD) central agency overseeing military commissaries — has explicitly referenced working with Danfoss technologies in the past. For example, in a template technical specification for commissary contractors from June 2022, DeCA referenced the Danfoss AK-SM 800A as a "basis for design" for individual control units.
Beware, Grocers Everywhere
In his own experience, Xona Systems CEO Bill Moore recalls, "At a lot of these stores that are brick-and-mortar retail — but also manufacturing plants, power plants, oil and gas sites, it's across the board — the biggest problem out there is that organizations do a pretty good job at segmenting their own networks. But when it comes to OT, there are all of these OEMs and third parties that need access. And organizations have not really paid attention."
By granting many vendors and OEMs access to their systems, organizations end up exposing themselves to remote attacks. "And there's literally no visibility or governance over a lot of those connections. I would say it's true in a big percentage of cases — half, maybe more, across the board. They let all of their OEMs kind of do their own thing, but then we've seen a lot of hackers compromise those third-party connections," he laments.
In an email to CNBC, Les Mousquetaires — parent company to Intermarché and Netto — explained that its attack occurred via a service provider in charge of refrigeration systems in some of its stores.
"Bottom line: take your gear off the Internet," says Andrew Ginter, vice president of industrial security at Waterfall Security Solutions. Shodan searches this week yielded thousands of Internet-exposed Danfoss systems, for example, with around 1,500 in France alone.
In a perfect world, organizations would protect their control systems behind hardware-enforced remote access, Ginter says, "but even a humble firewall between these devices and the Internet would help."
Apply a password and two-factor identification to those connections
Auto-update the firewall, to avoid forgetting
Use commercial-grade or industrial-grade devices, not consumer-grade; many consumer-grade devices do not provide updates, or do not update at all promptly
Finally, he adds, "Replace the firewall strictly every four years. Why? Because if we have Internet-exposed devices, nine times out of 10 we don't have a security team, and we're not going to notice when our firewalls go out of support and auto updates stop."
"The very basics are not enough for big-iron critical infrastructure or heavy industry, but they'll go a long way toward keeping hacktivists out of your freezers," Ginter concludes. "Get your stuff off the Internet. Do it on an emergency basis."
Nate Nelson is a journalist and award-winning scriptwriter. In addition to Dark Reading he writes for Darknet Diaries, the most popular show in cybersecurity across all media.
He began his career as a freelancer, ghostwriting Forbes and CNBC op-eds for executives in tech and finance. Then he transitioned to journalism at Threatpost, where he covered cybersecurity news and trends. Throughout those years he co-created a cybersecurity podcast, Malicious Life, which in its day climbed into the Top 20 technology podcasts charts on Apple Podcasts and Spotify.
He holds degrees from New York University and Bard College. As a born and bred New Yorker, he enjoys a superiority complex, but is polite enough to keep it to himself.
canadiangrocer.com — Affected grocers might not have protected themselves with an available firmware update. An overnight cyberattack on the refrigeration systems of major French grocery chains has forced hundreds of stores to discard large quantities of fresh and frozen food, with early estimates suggesting losses in the millions of dollars.
Informa TechTarget|
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know.
Source: F. E. Warren Air Force Base via Facebook
_-RTimages-alamy.jpg?width=1400&auto=webp&quality=80&disable=upscale)
