--- title: EU Grocers Pay a Steep Price for Unpatched Fridge Firmware description: Hundreds of French grocery and retail stores suffered cyberattacks on refrigeration controllers, with attackers extending defrost cycles to raise fridge and... canonical: https://daily.dev/posts/eu-grocers-pay-a-steep-price-for-unpatched-fridge-firmware-ncqg12gmt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: EU Grocers Pay a Steep Price for Unpatched Fridge Firmware | daily.dev og:description: Hundreds of French grocery and retail stores suffered cyberattacks on refrigeration controllers, with attackers extending defrost cycles to raise fridge and... og:url: https://daily.dev/posts/eu-grocers-pay-a-steep-price-for-unpatched-fridge-firmware-ncqg12gmt og:image: https://api.daily.dev/og/posts/nCQg12gMt.png og:image:alt: EU Grocers Pay a Steep Price for Unpatched Fridge Firmware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # EU Grocers Pay a Steep Price for Unpatched Fridge Firmware **[Dark Reading](https://daily.dev/sources/dr)** · 6 min read · 0 upvotes · 0 comments ## Summary Hundreds of French grocery and retail stores suffered cyberattacks on refrigeration controllers, with attackers extending defrost cycles to raise fridge and freezer temperatures to 50°C, spoiling food and causing some fires. Over 400 stores across France, Spain, Portugal, Poland, Germany, and Belgium were affected, with two Alsace stores alone reporting €270,000 in losses. The attacks exploited unpatched vulnerabilities in Danfoss AK-SM 800/AK-SC355 controllers (CVE-2025-41450/41451/41452, disclosed by Claroty's Team82 in August) and Copeland/Dixell XWEB Pro controllers, many of which were long past end-of-life. Similar unexplained refrigeration failures hit US military commissaries weeks earlier. Experts attribute the incidents to poor OT network segmentation, unmanaged third-party vendor access, and thousands of Internet-exposed devices found via Shodan, and recommend basic firewall hygiene and taking control systems off the public Internet. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerabilities in Danfoss AK-SM 800A refrigeration controllers were exploited in the French supermarket cyberattacks? Three vulnerabilities disclosed by Claroty's Team82 on August 9 and tracked as CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 allowed remote code execution or denial-of-service against Danfoss AK-SM 800A refrigeration controllers. Danfoss patched the flaws but relied on customers to apply updates themselves; most affected units were running the end-of-life AK-SM 800 or older AK-SC355 platforms, unpatched at the time of the attacks. _daily.dev surfaces ICS vulnerability disclosures like these for teams tracking OT patch exposure._ ### How did hackers cause supermarket freezers to overheat and spoil food in France? Attackers remotely compromised refrigeration controllers and extended the defrost cycle, the normal process where freezers briefly melt built-up frost, so that the resulting heating looked like routine maintenance rather than an attack. Temperatures rose as high as 50 degrees Celsius, spoiling food in over 400 stores across France and other European countries and reportedly causing some small fires. _developers securing OT and retail systems follow incidents like this on daily.dev to spot the next overlooked attack vector._ ### What basic firewall practices can protect Internet-exposed OT devices like refrigeration controllers from remote attacks? Waterfall Security's Andrew Ginter recommends a default deny-all rule, allowing connections only from specific IP addresses, adding password and two-factor authentication to those connections, enabling auto-updates, using commercial or industrial-grade firewalls instead of consumer-grade ones, and replacing the firewall every four years so it never silently falls out of support. _daily.dev helps OT and security teams keep up with practical hardening steps for Internet-exposed industrial devices._ ## Similar posts on daily.dev - [Critical infrastructure’s long, undefended tail exposed by UK energy attack](https://daily.dev/posts/critical-infrastructure-s-long-undefended-tail-exposed-by-uk-energy-attack-hajfwhwyk) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/eu-grocers-pay-a-steep-price-for-unpatched-fridge-firmware-ncqg12gmt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"EU Grocers Pay a Steep Price for Unpatched Fridge Firmware","url":"https://daily.dev/posts/eu-grocers-pay-a-steep-price-for-unpatched-fridge-firmware-ncqg12gmt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/eu-grocers-pay-a-steep-price-for-unpatched-fridge-firmware-ncqg12gmt"},"datePublished":"2026-10-15T07:00:39.966Z","dateModified":"2026-10-15T20:07:01.296Z","description":"Hundreds of French grocery and retail stores suffered cyberattacks on refrigeration controllers, with attackers extending defrost cycles to raise fridge and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9ff323bc01b32af862c9969a1c11d1e0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9ff323bc01b32af862c9969a1c11d1e0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/eu-grocers-pay-a-steep-price-for-unpatched-fridge-firmware-ncqg12gmt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"EU Grocers Pay a Steep Price for Unpatched Fridge Firmware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/eu-grocers-pay-a-steep-price-for-unpatched-fridge-firmware-ncqg12gmt#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities in Danfoss AK-SM 800A refrigeration controllers were exploited in the French supermarket cyberattacks?","acceptedAnswer":{"@type":"Answer","text":"Three vulnerabilities disclosed by Claroty's Team82 on August 9 and tracked as CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 allowed remote code execution or denial-of-service against Danfoss AK-SM 800A refrigeration controllers. Danfoss patched the flaws but relied on customers to apply updates themselves; most affected units were running the end-of-life AK-SM 800 or older AK-SC355 platforms, unpatched at the time of the attacks. daily.dev surfaces ICS vulnerability disclosures like these for teams tracking OT patch exposure."}},{"@type":"Question","name":"How did hackers cause supermarket freezers to overheat and spoil food in France?","acceptedAnswer":{"@type":"Answer","text":"Attackers remotely compromised refrigeration controllers and extended the defrost cycle, the normal process where freezers briefly melt built-up frost, so that the resulting heating looked like routine maintenance rather than an attack. Temperatures rose as high as 50 degrees Celsius, spoiling food in over 400 stores across France and other European countries and reportedly causing some small fires. developers securing OT and retail systems follow incidents like this on daily.dev to spot the next overlooked attack vector."}},{"@type":"Question","name":"What basic firewall practices can protect Internet-exposed OT devices like refrigeration controllers from remote attacks?","acceptedAnswer":{"@type":"Answer","text":"Waterfall Security's Andrew Ginter recommends a default deny-all rule, allowing connections only from specific IP addresses, adding password and two-factor authentication to those connections, enabling auto-updates, using commercial or industrial-grade firewalls instead of consumer-grade ones, and replacing the firewall every four years so it never silently falls out of support. daily.dev helps OT and security teams keep up with practical hardening steps for Internet-exposed industrial devices."}}]} ```