A coordinated attack on refrigeration controllers at roughly 700 supermarkets across France forced defrost cycles that spoiled food and triggered electrical fires, with the incident affecting stores in Spain, Portugal, Poland, Germany and Belgium as well. The attack exploited known critical vulnerabilities in controllers made by Danfoss, Dixell and Copeland that remained unpatched on devices exposed directly to the internet.
The compromised systems were internet-connected remote administration controllers that manage store-wide refrigeration fleets. Attackers activated defrost cycles long enough to raise temperatures to 50 degrees Celsius (122 Fahrenheit), destroying inventory and, in some cases, causing fires when electrical systems overheated.
Security researchers identified multiple systemic failures that enabled the breach. Danfoss controllers used passwords generated daily from publicly available firmware based on the date. A person with access to the firmware code could generate identical credentials across any device running the same unpatched version, potentially affecting hundreds or thousands of installations. Copeland and Dixell controllers contained similar critical vulnerabilities patched only in recent months that grant remote administrative access to attackers.
Basic network segmentation would have prevented the attack. The affected stores did not place the controllers behind a VPN, did not restrict access to whitelisted IP addresses, did not segment third-party equipment from their primary networks and did not change default credentials. Pen Test Partners stated that network isolation, credential changes and current firmware patches would have "changed the outcome." Claroty researchers warned of these exact risks in October. The US Cybersecurity and Infrastructure Security Agency issued similar warnings in February.
Copeland said the vulnerability affected "a discontinued, end-of-life generation of controllers" and stated the company is working with customers on prevention. Danfoss did not immediately respond. The identity and motive of the attackers remain unknown. The attack could represent vandalism at massive scale or an effort by a nation-state or international actor to disrupt European supply chains. The estimated financial cost likely reaches tens or hundreds of millions of euros.
The incident exposes a common corporate tension. Financial departments often resist spending on equipment upgrades when immediate return on investment is unclear. Security leaders lack leverage until after a catastrophic breach materializes. Whether other businesses will act on this cautionary tale remains unclear.