Attackers remotely manipulated commercial refrigeration controllers at more than 400 European grocery and retail stores overnight on Monday, reportedly raising temperatures to 50 °C and destroying chilled and frozen stock. Small fires were also reported.
The store count comes from the affected companies’ reports cited by Dark Reading. French retailers were the main documented targets, while a Sekoia analyst told Reuters that stores in Spain, Portugal, Poland, Germany and Belgium were also affected.
The intruders have not been identified, and their motive remains unclear.
Refrigeration settings were altered remotely
Initial reports connected the incidents to Danfoss refrigeration controllers. CERT-FR subsequently identified Dixell and Copeland’s XWEB platform as another system involved in the attacks.
According to French reporting cited by Dark Reading, the attackers extended defrost cycles, making the temperature increase resemble a maintenance operation. Defrost functions legitimately warm refrigeration equipment to remove ice, but prolonged or manipulated cycles can expose food to unsafe temperatures and place additional thermal stress on the equipment.
Two supermarkets in France’s Alsace region reported combined losses of €270,000, approximately US$300,000, according to the BBC account cited in the report. That figure covers those two locations, not the full attack.
Les Mousquetaires, the parent company of Intermarché and Netto, told CNBC that access to refrigeration systems in some of its stores came through a service provider. The statement points to third-party connectivity as one intrusion path in at least part of the incident, rather than establishing a single access method across every affected retailer.
Vulnerabilities disclosed in Danfoss controllers
Claroty Team82 disclosed three vulnerabilities in the Danfoss AK-SM 800A family on 9 August. The reporting does not establish that attackers exploited any particular CVE during the grocery-store incidents.
The NVD descriptions identify different technical conditions and affected versions:
- CVE-2025-41450 is an improper-authentication issue, classified as CWE-305, in the Danfoss AK-SM 8xxA Series before version 4.2. It has a CVSS 3.1 score of 8.2 and the vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H. NVD describes it as network-accessible with high attack complexity, no privileges required and user interaction required. - CVE-2025-41451 is a command-injection weakness, classified as CWE-77, in alarm-to-mail configuration fields. On versions before 4.3.1, an authenticated attacker could potentially obtain remote code execution.
- CVE-2025-41452 is a post-authentication vulnerability involving external control of a web-interface configuration setting. Classified as CWE-15, it can cause denial of service through improper handling of exceptional conditions on versions before 4.3.1.
Based on those affected ranges, version 4.3.1 is the first release identified as outside the scope of all three vulnerabilities. Danfoss has issued updates, but customers are responsible for deploying them.
Danfoss said that the majority of units affected in the incidents were AK-SM 800 controllers or the older AK-SC355. The company identified those products as having reached end of life in 2021 and 2016, respectively. It attributed the problem to outdated firmware and reiterated its recommendation to update supported equipment and migrate legacy systems to current products.
That distinction matters: the newly documented vulnerabilities concern the AK-SM 8xxA Series, while the reported attack also involved older installed equipment. The available reporting does not provide a vulnerability-by-vulnerability explanation for the compromises.
XWEB was also implicated
Claroty Team82 disclosed 23 vulnerabilities in Copeland XWEB Pro on 9 August, 21 of which were rated high severity. CERT-FR later identified the wider XWEB platform as involved in the attacks.
The timing has prompted suggestions that the attackers used recently published research, but this remains an inference. The reporting does not connect a specific XWEB vulnerability to a particular compromised store.
What refrigeration operators should do
Operators using Danfoss AK-SM 8xxA controllers should verify the installed firmware. Systems before 4.2 remain within the affected range for CVE-2025-41450, while CVE-2025-41451 and CVE-2025-41452 affect versions before 4.3.1. Legacy AK-SM 800 and AK-SC355 installations should be assessed against Danfoss’s migration guidance.
Andrew Ginter of Waterfall Security Solutions recommended removing industrial control devices from direct Internet exposure as an emergency measure. Where immediate isolation is not possible, his advice includes placing a commercial- or industrial-grade firewall in front of the controllers, using a default-deny policy, limiting connections to approved IP addresses, requiring passwords and two-factor authentication, and keeping the firewall automatically updated.
The service-provider route described by Les Mousquetaires also makes third-party access a priority. Retailers should identify which contractors can remotely reach refrigeration systems, restrict those connections to the systems and periods required, and review authentication and firewall controls around them.
For affected businesses, the consequences extend beyond unavailable cooling: manipulated controllers can destroy inventory, interrupt store operations and create physical hazards. Firmware updates, removal of direct exposure and tighter control over contractor access address the concrete weaknesses highlighted by this incident.
