FRENCH and EU grocers were hit by a large-scale cyberattack that disrupted refrigeration and caused substantial financial losses. In the early hours of a Monday, attackers compromised commercial refrigeration controllers used by major supermarket chains, causing fridges, freezers and cold rooms to heat up to about 50°C (over 120°F). This degraded or ruined food and reportedly even sparked small fires in some cases. Official details on the attacker’s identity or motivations remain unclear.
The breach appears to hinge on exploitation of Danfoss AK-SM 800A (and related AK-SC355) controllers, with three vulnerabilities (CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452) identified by Claroty Team82 that could allow remote code execution or DoS. Danfoss patched the flaws but indicated customers must deploy updates themselves; the majority of affected units were running outdated AK-SM 800 or AK-SC355 firmware, which are long past end of life (2021 and 2016 respectively).
Danfoss has stated it has long advised customers to keep supported systems up to date and to migrate legacy installations to newer solutions, while CERT-FR later flagged the XWEB platform from Dixell/Copeland as involved in the attacks. Reports from industry analysts cited more than 700 affected stores across France, with additional activity noted in Spain, Portugal, Poland, Germany and Belgium; Intermarché reportedly incurred tens of millions in losses.
The episode underscores the vulnerability of OT refrigeration controls and the risk posed by unauthorised third-party access, prompting emergency discussions about air-gapped or strictly filtered networks, firmware updates and more robust change governance.