French authorities say attackers compromised the internet-connected controllers that manage store-wide refrigeration systems, then drove defrosters until cabinets reached temperatures as high as 50 Celsius. The result was spoiled inventory, smoke, and fires across supermarkets in France, Spain, Portugal, Poland, Germany and Belgium.
The damage likely runs into tens or hundreds of millions of euros, according to Ars Technica. The affected controllers from Danfoss, Dixell and its parent Copeland carried critical vulnerabilities that let an attacker log in with full administrator rights. Some shipped with known default credentials and outdated firmware.
Basic hygiene would have stopped it
Researchers at Pen Test Partners laid out what was missing: the controllers were reachable from the public internet, remote access had no VPN and no IP allowlist, and third-party equipment sat on a contractor’s own connection rather than a controlled network segment.
Those are standard protections, and they were not applied. Claroty warned about exactly this class of exposure last October. CISA echoed the warning in February.
Copeland told Ars Technica the flaw affects “a discontinued, end-of-life generation of controllers.” Danfoss said the same through other outlets. Danfoss did not answer Ars Technica’s questions directly.
No claim of responsibility
Whoever did it has stayed quiet, which leaves two plausible readings. The operation could be large-scale vandalism, or it could be a state or international actor testing how much disruption a cold chain can absorb before shelves empty. Either way, the incident is a reminder that building controls are now attack surface with physical consequences.
