Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

Security researchers warned about exploitable vulnerabilities in refrigeration controllers months - and in one case, more than a year - before cyberattacks disrupted hundreds of French supermarkets.

Late Sunday night, unknown criminals hacked thousands of controllers, cranking the heat as high as 122°F (50°C), spoiling food and sparking fires across nearly 700 of the country’s supermarkets.

France's national cybersecurity agency ANSSI on Monday warned of widespread compromises involving Danfoss refrigeration controllers, and a day later added affected systems from Copeland and its Dixell brand.

The compromised devices were accessible over the internet, with many reportedly no longer receiving software or security updates and others running outdated firmware.

Danfoss did not immediately respond to The Register’s request for comment.

Copeland emailed us the following statement: “We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers.

Protecting our customers’ operations has always been a top priority.

We are currently working with impacted customers to mitigate the risk.

We will continue to support customers in strengthening cybersecurity through supported products, current software and industry-recommended practices.” Operational technology (OT) security firm Claroty’s Team82 sounded the alarm on these buggy devices in August, warning that hackers could “freeze the controller” and “defrost the food.” At the time, the researchers published details of dozens of vulnerabilities, including authentication bypass and operating-system command execution flaws, affecting Danfoss AK-SM 800A and Copeland XWEB controllers.

Even earlier, the US Cybersecurity and Infrastructure Security Agency (CISA) published advisories about security flaws in both brands’ controllers.

In February, CISA said nearly two dozen CVEs in Copeland XWEB and XWEB Pro could be exploited to “allow an attacker to bypass authentication, cause a denial-of-service condition, cause memory corruption, and execute arbitrary code.” In a May 2025 advisory, updated in August 2025, CISA published a similar warning about buggy Danfoss AK-SM 8xxA series devices.

“What makes this incident particularly striking is the timeline,” Tiago Henriques, chief underwriting officer at cyber insurance provider Coalition, told The Register.

He noted that the French supermarket hacks happened two months after Team82 published its research, and Danfoss released a firmware update (R4.3.1) to mitigate the flaws. 'Critical exposure' continues “Yet, despite the availability of these patches, Coalition’s scanning identified critical exposure to these threats continuing well into the fall,” Henriques said.