Fridge hack spoils food across Europe

Chilled food spoiled in supermarkets across seven European countries overnight around 11 to 12 October after attackers switched refrigeration controllers to defrost. Some units climbed towards 50C for up to six hours before staff noticed. France took most of the damage; Belgium, Germany, the Netherlands, Poland, Portugal and Spain also reported affected sites. French broadcaster BFM TV counted more than 300 stores, and Groupe Casino said about 5 per cent of Monoprix's 600-plus shops, about 30, were hit⁠¹. The Paris Prosecutor's Office estimates "around 700" victims and has about ten complaints; The Record reports losses in the tens of millions of euros⁠².

France's computer emergency response team (CERT-FR), part of the national cybersecurity agency ANSSI, had issued alert ALE-012 on 12 October, reporting "nombreuses compromissions" (numerous compromises) of remote controllers for refrigeration plant⁠³. A day later it named the products: Danish manufacturer Danfoss's AK-SM and AK-SC series (store-wide refrigeration control units), and xweb controllers from US-based Copeland, including those sold under its Dixell brand. Danfoss phased out its AK-SC255 and AK-SC355 controllers in 2016 and declared other lines end-of-life in 2021⁠⁴. No group has claimed the attack and nobody has demanded a ransom. CERT-FR's 16 October update says the campaigns are "probablement toujours en cours" (probably still under way).

CERT-FR tells operators to pull every unit off the public internet, check defrost schedules and confine contractor access to a virtual private network (VPN). A factory reset is "insuffisant" for end-of-life units, which CERT-FR says attackers will compromise again. An October 2025 Danfoss customer newsletter announced a "hard End of Service" policy citing European cyber law⁠⁵, and Copeland acknowledged a flaw "in a discontinued, end-of-life generation" of xweb units. That leaves disconnection or replacement, a capital cost that lands on the grocer. In July the US Cybersecurity and Infrastructure Security Agency (CISA) gave American water utilities the same disconnect-first instruction for exposed controllers.

On 19 October the European Union Agency for Cybersecurity (ENISA) set out what the Cyber Resilience Act (CRA), the EU law that sets security duties for makers of connected products, does about it. For products placed on the market before 11 December 2027, or whose support has ended, "the manufacturer is not required to comply with the vulnerability handling obligations"⁠⁶. A maker must report an exploited flaw in an old controller through the single platform ENISA has been building, and need not fix it. Neither the CRA nor the revised Product Liability Directive, which covers products sold from December 2026, reaches the controllers now in French stores.