In short
- Attackers exploited vulnerabilities in Danfoss, Copeland, and Dixell controllers, with millions of euros in losses reported by Mousquetaires Group.
- CERT-FR warns attack campaigns are ongoing and advises against exposing management interfaces to the public internet.
What happened
Hackers accessed internet-connected refrigeration controllers in French supermarkets, triggering intense defrost cycles that spoiled food and sparked fires. The Paris Prosecutor's Office has launched a criminal investigation, with the Anti-Cybercrime Office (OFAC) tasked to identify victims and link the incident to reported damages.
Vulnerabilities in Danfoss, Copeland, and Dixell systems were exploited, despite prior warnings and firmware updates. Mousquetaires Group reported 300 stores compromised and millions of euros in losses, while Coopérative U confirmed 80 stores targeted. CERT-FR advises urgent action as attacks are likely ongoing.
Attacking equipment essential to the conservation of fresh products means attacking the food supply chain of the French people," Schelcher wrote. "It is unprecedented, extremely serious, and unacceptable.
In numbers
- 300 Mousquetaires Group stores compromised
- 2,765 Exposed Danfoss controllers identified online
What compliance teams should check
- Review exposure of Danfoss AK-SM and AK-SC, Copeland XWEB, and Dixell XWEB controllers to the public internet as highlighted by CERT-FR.
- Verify implementation of the August 2025 Danfoss firmware update for all AK-SM 800A platforms and check for unpatched equipment.
- Monitor CERT-FR security bulletins for ongoing attack campaigns and update incident response protocols for food supply chain disruptions.
Why it matters
This incident demonstrates the real-world impact of cyber vulnerabilities in operational technology, directly affecting food safety and supply chains. Compliance officers must ensure that critical infrastructure, such as refrigeration systems, is not exposed to the public internet and is regularly patched. The attack highlights the need for robust incident response and risk management, as ongoing campaigns could target similar systems, causing financial losses and public health risks. Regulatory scrutiny and industry-wide awareness are likely to increase following this event.
Catch stories like these on your own customers.
complead screens your customers against adverse media, sanctions and PEP lists, and re-checks them every day. When a name you hold turns up in the news, it lands in your case queue with the evidence attached.