Warnings Came Months Early: Hacked Refrigeration Controllers Disrupt Hundreds of French Supermarkets

Late on a Sunday night, unknown criminals hacked thousands of refrigeration controllers in France. They pushed temperatures as high as 50°C (122°F), spoiling food and sparking fires across nearly 700 supermarkets. France's national cybersecurity agency, ANSSI, warned of widespread compromises involving Danfoss controllers on Monday, and a day later added affected systems from Copeland and its Dixell brand.

According to the report, the compromised devices were reachable over the internet. Many were reportedly no longer receiving software or security updates, and others were running outdated firmware. Copeland said the vulnerability affected a discontinued, end-of-life generation of controllers, and that it is working with impacted customers. Danfoss did not immediately respond to The Register's request for comment.

The weaknesses were not a secret. Security firm Claroty's Team82 warned in August that attackers could "freeze the controller" and "defrost the food", publishing details of dozens of vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB controllers, including authentication bypass and operating-system command execution flaws. Earlier, the US Cybersecurity and Infrastructure Security Agency (CISA) published advisories on both brands. In February it said nearly two dozen flaws in Copeland XWEB and XWEB Pro could let an attacker bypass authentication and run arbitrary code. A May 2025 advisory, updated in August, raised similar concerns about Danfoss AK-SM 8xxA devices.