HUNDREDS of French grocers were hit by cyberattacks that manipulated refrigerated display and storage equipment, turning cooling units into heating systems and spoiling vast quantities of perishable stock. Overnight on Monday, attackers breached commercial refrigeration controllers at major chains, increasing temperatures to as high as 50°C (over 120°F) and, in some cases, triggering small fires. Defrost cycles were extended to mask anomalous temperatures, so the incidents could appear as routine maintenance.
The disruptions affected more than 400 stores reported on a single night, with authorities noting that neighbouring countries including Spain, Portugal, Poland, Germany and Belgium were also affected.
The source of the exploitation is linked to Danfoss AK-SM 800A platform vulnerabilities disclosed by Claroty Team82 on 9 August. The flaws, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, permit remote code execution or denial-of-service against enterprise refrigeration fleets. Danfoss stated the damage was avoidable and attributed the incidents to customers running outdated firmware, noting that many affected units were end-of-life: AK-SM 800 (EOL 2021) and AK-SC355 (EOL 2016).
CERT-FR later also identified a second platform, XWEB from Dixell/Copeland, involved in the attacks, with related disclosures from Team82 about 23 vulnerabilities affecting XWEB Pro, 21 of high severity. The practical response emphasises applying updates and moving to supported hardware, alongside network hardening and ensuring remote access to OT devices is tightly controlled.