Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

Security researchers warned about exploitable vulnerabilities in refrigeration controllers months - and in one case, more than a year - before cyberattacks disrupted hundreds of French supermarkets.

Late Sunday night, unknown criminals hacked thousands of controllers, cranking the heat as high as 122°F (50°C), spoiling food and sparking fires across nearly 700 of the country’s supermarkets.

France's national cybersecurity agency ANSSI on Monday warned of widespread compromises involving Danfoss refrigeration controllers, and a day later added affected systems from Copeland and its Dixell brand. The compromised devices were accessible over the internet, with many reportedly no longer receiving software or security updates and others running outdated firmware.

REG AD

Danfoss did not immediately respond to The Register’s request for comment. Copeland emailed us the following statement: 

REG AD

“We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers. Protecting our customers’ operations has always been a top priority. We are currently working with impacted customers to mitigate the risk. We will continue to support customers in strengthening cybersecurity through supported products, current software and industry-recommended practices.”

Operational technology (OT) security firm Claroty’s Team82 sounded the alarm on these buggy devices in August, warning that hackers could “freeze the controller” and “defrost the food.” At the time, the researchers published details of dozens of vulnerabilities, including authentication bypass and operating-system command execution flaws, affecting Danfoss AK-SM 800A and Copeland XWEB controllers.

Even earlier, the US Cybersecurity and Infrastructure Security Agency (CISA) published advisories about security flaws in both brands’ controllers. 

In February, CISA said nearly two dozen CVEs in Copeland XWEB and XWEB Pro could be exploited to  “allow an attacker to bypass authentication, cause a denial-of-service condition, cause memory corruption, and execute arbitrary code.”

In a May 2025 advisory, updated in August 2025, CISA published a similar warning about buggy Danfoss AK-SM 8xxA series devices.

“What makes this incident particularly striking is the timeline,” Tiago Henriques, chief underwriting officer at cyber insurance provider Coalition, told The Register. He noted that the French supermarket hacks happened two months after Team82 published its research, and Danfoss released a firmware update (R4.3.1) to mitigate the flaws.

'Critical exposure' continues

“Yet, despite the availability of these patches, Coalition’s scanning identified critical exposure to these threats continuing well into the fall,” Henriques said. 

REG AD

Between September 7 and October 6, Coalition’s sensors identified 1,506 unique IP addresses still publicly exposing a Danfoss StoreView web-accessible admin panel, and 820 of these - 54 percent - were associated with French networks. 

“Our scans counted at least 2,624 refrigeration controllers from the named brands with a login page open to the internet: 1,506 Danfoss StoreView and 1,119 XWEB,” he added, noting that one IP runs both types of controllers.

To be clear: this doesn’t mean all of these controllers were vulnerable, but rather they were exposed to the open internet.

Even after the cyberattacks - as of Thursday - 618 Danfoss devices remain connected to the internet, according to the insurance provider’s count. Of these, 206 are connected to French networks, while 50 are in the US, and two in the UK.

“An unpatched device featuring a web-accessible admin panel can act as a major entry point” for digital attackers, Henriques said. “The takeaway is clear: digital risk extends far beyond workstations and email servers.”

Criminals are targeting OT and other industrial devices that are connected to the internet, too. 

“Identifying these exposed access points before they are targeted can directly contribute to preserving business continuity,” Henriques said.

OT cyber leaders call for CISA directive

REG AD

In America, a group of OT cybersecurity and technology providers doubled down on their call for stronger food and agriculture protections in the US. The French cyberattacks “are another stark reminder of the importance of implementing baseline cybersecurity measures to enhance operational technology cybersecurity,” the Operational Technology Cybersecurity Coalition (OTCC) said in a Wednesday statement.

Earlier this month, the group, whose members include Claroty, Forescout, Honeywell, and Schneider Electric, called on CISA to issue a Binding Operational Directive to improve OT cybersecurity within the federal government. The OTCC repeated this demand on Wednesday and suggested that the US Department of Agriculture could encourage organizations in the food and agriculture sector to implement cybersecurity best practices.

“While no incidents have been reported in the United States, malicious actors are undoubtedly viewing this incident as a potential attack vector to perform here,” the statement said. “We cannot wait for that to happen.”®