French supermarket cyberattack exploited known vulnerabilities in refrigeration controllers, researchers had warned

Over 1,500 controllers still exposed online months after patches were available

By LineZotpaper

Published16 October 2026

Read Time2 min

A cyberattack on Sunday night disrupted hundreds of French supermarkets by hacking refrigeration controllers, causing food spoilage and fires. Security researchers had warned about exploitable vulnerabilities in these devices months earlier, and patches were available, but many systems remained exposed.

Late Sunday night, unknown criminals hacked thousands of refrigeration controllers in nearly 700 French supermarkets, raising temperatures to 122°F (50°C) and spoiling food while sparking fires. France’s national cybersecurity agency ANSSI warned of widespread compromises involving Danfoss controllers, later adding Copeland and its Dixell brand.

The compromised devices were accessible over the internet, with many no longer receiving updates or running outdated firmware. Operational technology security firm Claroty’s Team82 had published details of dozens of vulnerabilities in August, including authentication bypass and command execution flaws affecting Danfoss AK-SM 800A and Copeland XWEB controllers. The US Cybersecurity and Infrastructure Security Agency (CISA) issued advisories in February and May 2025.

“What makes this incident particularly striking is the timeline,” said Tiago Henriques, chief underwriting officer at cyber insurance provider Coalition. He noted the hacks occurred two months after Team82’s research and after Danfoss released a firmware update (R4.3.1) to mitigate the flaws.

Despite available patches, Coalition’s scanning found 1,506 unique IP addresses still publicly exposing a Danfoss StoreView admin panel between September 7 and October 6, with 54 percent associated with French networks. Over 2,600 controllers from the named brands had a login page open to the internet. As of Thursday, 618 Danfoss devices remain online, including 206 in France, 50 in the US, and two in the UK.

Copeland emailed a statement: “We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers. Protecting our customers’ operations has always been a top priority. We are currently working with impacted customers to mitigate the risk.” Danfoss did not immediately respond to requests for comment.

Henriques stressed that digital risk extends beyond workstations and email servers, and identifying exposed access points before they are targeted can preserve business continuity.

Analysis

Why This Matters

The attack shows that unpatched industrial internet-connected devices pose real-world physical risks, including food spoilage and fires.
The incident underscores the gap between vulnerability disclosure and remediation, leaving businesses exposed for months after patches are available.
French supermarkets suffered operational disruption and financial loss; similar attacks could target any organisation using internet-connected OT devices.

Background

Refrigeration controllers are critical in cold-chain logistics, used by supermarkets, warehouses, and food distribution. Many of these controllers are built by companies like Danfoss and Copeland and are designed for longevity but often have long update cycles. As they become internet-connected for remote management, they introduce cybersecurity risks. Security researchers and agencies regularly find vulnerabilities in these industrial control systems.

Key Perspectives

Security researchers (Claroty’s Team82): They published vulnerability details months before the attack to prompt patching, following responsible disclosure norms. They demonstrated that attackers could “freeze the controller” and “defrost the food.” Affected vendors (Danfoss, Copeland): Both firms have issued patches or are working with impacted customers. Copeland noted the affected controllers are end-of-life. Cyber insurance and risk management (Coalition): Continuous scanning reveals that many organisations fail to patch or remove exposed admin panels, leaving themselves vulnerable long after fixes are available.

What to Watch

Whether further attacks on exposed refrigeration controllers occur, particularly in other countries where devices remain online.
Responses from ANSSI and CISA, including potential takedowns or mandatory patching directives.
Law enforcement progress in identifying the attackers behind the French supermarket hacks.

Sources

Researchers warned attackers could 'defrost the food' months before French supermarkets got hit — www.theregister.com - Articles