EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

Outdated Refrigeration Firmware Spoils Millions in EU Grocery Stock

Overnight on October 11, 2026, attackers compromised refrigeration management controllers at more than 400 grocery stores across France, triggering extended defrost cycles that pushed cold-storage and freezer units as high as 50°C (122°F) and destroyed stock worth an estimated tens of millions of euros. The incident, now referred to as the 2026 French supermarket refrigerator hack, spread beyond France to stores in Spain, Portugal, Poland, Germany, Belgium, Luxembourg, and the Netherlands, with limited disruptions also reported at Stop & Shop and Food Lion locations in the United States. According to incident analysis from Claroty's Team82 and Pentest Partners, cited alongside CERT-FR's own alert, the root cause was not a novel exploit — it was years-old, unpatched firmware on Danfoss AK-SM800/AK-SC355 and Copeland/Dixell XWEB Pro refrigeration controllers that retailers had outsourced to third-party maintenance contractors and lost visibility over.

Incident Overview

How the Attack Worked

A Years-Old Authentication Flaw

The affected Danfoss AK-SM800/AK-SC355 system managers coordinate refrigeration across multiple cases and cold rooms in a store rather than providing cooling directly, and many were discoverable on the open internet running a public-facing web management interface. Researchers found the units exposed a secondary login path, reachable through undocumented XML attributes, whose authentication value was generated from the device's own current date using a fixed algorithm with no per-device secret. That meant the same admin-style credentials worked across every unaffected unit on a given day, and an unauthenticated attacker could simply query the controller for its clock to compute the valid password. Earlier, related weaknesses in the AK-SM800, AK-SC255, and AK-SC355 families had already been documented by security researchers in 2023, and Claroty's Team82 formally disclosed CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 in August 2025 — more than a year before this incident.

The Third-Party Modem Problem

Commercial refrigeration is typically installed and serviced by a specialist contractor, not the retailer's own IT team. To get fast remote access for diagnostics and maintenance, many of these contractors fit the controller with its own cellular modem rather than requesting a managed connection through the retailer's network — it is quicker than filing a change request and waiting on the retailer's security team. The result is a population of "shadow" OT assets that the retailer does not own, cannot see on its own asset inventory, and has no record of patching. Analysts estimated thousands of similar refrigeration controllers were discoverable through internet-wide scanning tools, each representing an entry point the store's own security monitoring never knew existed.

Disguising the Damage

Store refrigeration platforms are typically monitored around the clock for temperature excursions, which should have triggered an immediate alert. Instead of simply disabling cooling, the attackers reportedly extended the controllers' normal defrost cycle — the routine, scheduled warming period refrigeration units already use to clear ice buildup — so the rising temperatures resembled ordinary maintenance rather than a fault. Over roughly six hours, affected units climbed to as high as 50°C, spoiling refrigerated and frozen inventory across the store, and in some locations the sustained electrical strain reportedly caused small fires.

A Preventable Repeat

Danfoss had already shipped a firmware fix in response to Team82's 2025 disclosure, and Pentest Partners noted bluntly that "the access was known, the mechanism documented, and the fix available" well before the attack — the devices were simply never patched or replaced, in part because the AK-SC355 reached end-of-life in 2016 and the AK-SM800 in May 2021. The incident also follows unexplained refrigeration failures reported at US military commissaries weeks earlier, and sits alongside a separate but related disclosure: security firm Armis identified ten vulnerabilities — collectively dubbed FrostByte10 — in Copeland E2/E3 refrigeration controllers, reported to Copeland, which has since issued its own firmware update.

Impact Assessment

Recommendations

For Retail IT and OT Teams

• Inventory every internet-connected OT device, including refrigeration, HVAC, and building-management hardware installed and maintained by third-party contractors. A self-scan against internet-exposure tools can surface forgotten cellular modems your own asset register never recorded.
• Eliminate contractor-installed cellular modems on OT equipment; replace them with retailer-managed VPN or firewall-brokered remote access, and require written sign-off before any new device is given a direct internet path.
• Segment refrigeration and building-management networks from POS and corporate IT, and alert on defrost-cycle or duty-cycle anomalies, not just raw temperature thresholds that attackers can mask.
• Patch or retire end-of-life controllers even when they still function — exposure risk, not uptime, is the deciding factor once a device is past vendor support.

For Refrigeration and OT Equipment Vendors

• Remove date-derived or fixed-algorithm authentication schemes; require unique, per-device credentials that cannot be computed from publicly queryable data.
• Audit firmware for undocumented secondary login paths or hidden API/XML endpoints before shipping, and include them in third-party penetration testing scope.
• Provide customers with a remote-access attestation at time of installation and service, documenting any modem, SIM, or always-on connection added to the unit.

For Security Leadership and Procurement

• Add OT remote-access architecture — not just data handling — to vendor risk assessments for refrigeration, HVAC, and building-management contracts.
• Negotiate firmware-update SLAs into maintenance contracts for OT vendors, matching the patching obligations already standard in IT software agreements.
• Fold OT scenarios into business continuity planning, including temperature-anomaly and cold-chain-failure playbooks alongside existing ransomware and IT outage runbooks.

Key Takeaways

1. Outdated, outsourced firmware — not a novel exploit — caused the damage. CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 were disclosed and patched more than a year before this attack.
2. Third-party remote access is a persistent blind spot. Cellular modems installed by refrigeration contractors gave attackers a path retailers themselves could not see, inventory, or monitor.
3. Attackers actively evaded detection by extending defrost cycles so remote temperature-monitoring alerts would not fire.
4. The impact crossed borders quickly. What began in France spread to at least seven additional EU countries and touched US retailers within weeks.
5. Losses scale fast with store count. Two stores alone lost a combined €270,000; across 400+ affected stores, total losses reach into the tens of millions of euros.
6. OT security is food-supply-chain security. EU officials explicitly framed the incident as a food-security risk, elevating it well beyond a routine IT outage.

Sources

• DarkReading — EU Grocers Pay a Steep Price for Unpatched Fridge Firmware
• Pentest Partners — You Don't Need a Nation State to Warm Up a Fridge
• CERT-FR Alert CERTFR-2026-ALE-012
• Claroty Team82 (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452 disclosure, August 2025)
• BBC coverage of Alsace-region store losses