Refrigeration Controller Hack Spoils Food Across European Supermarkets

A cyberattack hit hundreds of supermarkets across Europe, setting refrigerators and freezers to defrost overnight. Exploiting a vulnerability in refrigeration controllers, hackers reportedly raised temperatures to 50 degrees Celsius (122 degrees Fahrenheit), spoiling food products and causing significant monetary damages. The attack hit several supermarket chains across Europe, including Auchan, Carrefour, E.Leclerc, Intermarché (owned by Groupement Mousquetaire), and Monoprix, Reuters reports . Most of the damage was done in France, but food retailers in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain were also affected. Cooperative U CEO Dominique Schelcher confirmed on X that several stores were affected. Cooperative U operates supermarkets under the Hyper U, Super U, and U Express and Utile brands. “Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be necessary to shed full light on this attack,” an automated translation of Schelcher’s post reads. “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable,” Schelcher added. According to French news outlet BFM TV , more than 300 supermarket locations across France were affected. The losses are estimated to reach millions of euros. The hackers reportedly compromised refrigeration controllers from Danish company Danfoss and tampered with refrigerator and freezer settings in the middle of the night. The temperature in some equipment reportedly rose for six hours before employees discovered the issue. “Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented . The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

Exploiting a vulnerability in refrigeration controllers, hackers reportedly raised temperatures to 50 degrees Celsius (122 degrees Fahrenheit), spoiling food products and causing significant monetary damages. The attack hit several supermarket chains across Europe, including Auchan, Carrefour, E.Leclerc, Intermarché (owned by Groupement Mousquetaire), and Monoprix, Reuters reports . Most of the damage was done in France, but food retailers in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain were also affected. Cooperative U CEO Dominique Schelcher confirmed on X that several stores were affected. Cooperative U operates supermarkets under the Hyper U, Super U, and U Express and Utile brands. “Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be necessary to shed full light on this attack,” an automated translation of Schelcher’s post reads. “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable,” Schelcher added. According to French news outlet BFM TV , more than 300 supermarket locations across France were affected. The losses are estimated to reach millions of euros. The hackers reportedly compromised refrigeration controllers from Danish company Danfoss and tampered with refrigerator and freezer settings in the middle of the night. The temperature in some equipment reportedly rose for six hours before employees discovered the issue. “Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented . The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

The attack hit several supermarket chains across Europe, including Auchan, Carrefour, E.Leclerc, Intermarché (owned by Groupement Mousquetaire), and Monoprix, Reuters reports . Most of the damage was done in France, but food retailers in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain were also affected. Cooperative U CEO Dominique Schelcher confirmed on X that several stores were affected. Cooperative U operates supermarkets under the Hyper U, Super U, and U Express and Utile brands. “Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be necessary to shed full light on this attack,” an automated translation of Schelcher’s post reads. “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable,” Schelcher added. According to French news outlet BFM TV , more than 300 supermarket locations across France were affected. The losses are estimated to reach millions of euros. The hackers reportedly compromised refrigeration controllers from Danish company Danfoss and tampered with refrigerator and freezer settings in the middle of the night. The temperature in some equipment reportedly rose for six hours before employees discovered the issue. “Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented . The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

Most of the damage was done in France, but food retailers in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain were also affected. Cooperative U CEO Dominique Schelcher confirmed on X that several stores were affected. Cooperative U operates supermarkets under the Hyper U, Super U, and U Express and Utile brands. “Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be necessary to shed full light on this attack,” an automated translation of Schelcher’s post reads. “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable,” Schelcher added. According to French news outlet BFM TV , more than 300 supermarket locations across France were affected. The losses are estimated to reach millions of euros. The hackers reportedly compromised refrigeration controllers from Danish company Danfoss and tampered with refrigerator and freezer settings in the middle of the night. The temperature in some equipment reportedly rose for six hours before employees discovered the issue. “Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented . The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

Cooperative U CEO Dominique Schelcher confirmed on X that several stores were affected. Cooperative U operates supermarkets under the Hyper U, Super U, and U Express and Utile brands. “Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be necessary to shed full light on this attack,” an automated translation of Schelcher’s post reads. “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable,” Schelcher added. According to French news outlet BFM TV , more than 300 supermarket locations across France were affected. The losses are estimated to reach millions of euros. The hackers reportedly compromised refrigeration controllers from Danish company Danfoss and tampered with refrigerator and freezer settings in the middle of the night. The temperature in some equipment reportedly rose for six hours before employees discovered the issue. “Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented . The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

“Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be necessary to shed full light on this attack,” an automated translation of Schelcher’s post reads. “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable,” Schelcher added. According to French news outlet BFM TV , more than 300 supermarket locations across France were affected. The losses are estimated to reach millions of euros. The hackers reportedly compromised refrigeration controllers from Danish company Danfoss and tampered with refrigerator and freezer settings in the middle of the night. The temperature in some equipment reportedly rose for six hours before employees discovered the issue. “Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented . The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable,” Schelcher added. According to French news outlet BFM TV , more than 300 supermarket locations across France were affected. The losses are estimated to reach millions of euros. The hackers reportedly compromised refrigeration controllers from Danish company Danfoss and tampered with refrigerator and freezer settings in the middle of the night. The temperature in some equipment reportedly rose for six hours before employees discovered the issue. “Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented . The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

According to French news outlet BFM TV , more than 300 supermarket locations across France were affected. The losses are estimated to reach millions of euros. The hackers reportedly compromised refrigeration controllers from Danish company Danfoss and tampered with refrigerator and freezer settings in the middle of the night. The temperature in some equipment reportedly rose for six hours before employees discovered the issue. “Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented . The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

The hackers reportedly compromised refrigeration controllers from Danish company Danfoss and tampered with refrigerator and freezer settings in the middle of the night. The temperature in some equipment reportedly rose for six hours before employees discovered the issue. “Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented . The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

“Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented . The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives. Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches. “Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

“Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned . It’s unclear whether the attackers exploited the flaws Claroty disclosed. Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Related: Canonical Websites Disrupted in Second DDoS Attack This Year Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Critical SonicWall Vulnerability Exploited Days After Disclosure

Ionut Arghire is an international correspondent for SecurityWeek.