Cyber-Physical Cold Chain Crisis: Cybersecurity Breaches in Refrigeration Systems (2025–2026)

Report Date: November 2, 2026

Executive Summary

The cybersecurity of refrigeration and freezer systems has shifted from a theoretical concern to an active, high-impact threat vector. Between August 2025 and November 2026, a coordinated series of vulnerabilities, exploits, and real-world attacks have demonstrated that cyber-physical systems controlling commercial refrigeration can be weaponized to cause physical damage, destroy perishable inventory, trigger fires, and disrupt national food supply chains.

The October 11, 2026 attack on French supermarket refrigeration systems represents the first confirmed cyberattack to directly impact a nation’s food supply chain at scale. It was followed less than three weeks later by a second wave across Belgium, Luxembourg, Sweden, and Ireland. The U.S. military faced similar freezer failures at multiple commissary installations in August 2026, now under formal Pentagon investigation.

This report details the attack chain, vulnerable systems, CVE landscape, geopolitical implications, and remediation guidance.

1. Incident Timeline

August 2026 — U.S. Military Commissary Freezer Failures

• Date: Beginning August 26, 2026
• Target: Defense Commissary Agency (DeCA) stores across 10 U.S. states
• Impact: Up to 14 affected commissaries. At Fort Huachuca, Arizona, all freezers entered defrost mode simultaneously, spoiling frozen inventory. Electrical power was confirmed intact — ruling out a grid failure.
• Investigation: Army Criminal Investigation Division Cyber Field Office, Air Force Office of Special Investigations, and Defense Criminal Investigative Service (DCIS) are jointly investigating. Pentagon officials are reportedly examining whether Iran-backed hackers were responsible.
• Status: Under investigation. Root cause not publicly confirmed.

August 2025 — Claroty Team82 Vulnerability Research Published

• Claroty Team82 released “Freeze the Controller, Defrost the Food” — documenting vulnerabilities in Danfoss AK-SM 800A refrigeration controllers.
• Censys scan identified 2,765 Danfoss management interfaces reachable from the public internet.
• Three CVEs disclosed: CVE-2025-41450 (authentication bypass, CVSS 8.2), CVE-2025-41451 (command injection RCE, CVSS 7.6), CVE-2025-41452 (Nginx configuration injection/DoS, CVSS 5.4).
• Danfoss released firmware R4.3.1 to patch all three.
• CISA issued ICS Advisory ICSA-25-140-03.

February 2026 — Copeland XWEB Pro Vulnerabilities Disclosed

• Claroty Team82 identified 23 vulnerabilities in Copeland XWEB Pro controllers, 21 rated high severity.
• Key findings: authentication bypass via Lua logic flaw (CVE-2026-25085), predictable daily password generation from hardcoded keys and device MAC address (CVE-2026-21718), and 19 OS command injection vulnerabilities across multiple API endpoints.
• CISA issued ICSA-26-057-10 with CVSS v3 score of 10.0.
• Copeland released firmware version 1.13 as remediation.

October 11, 2026 — French Supermarket Refrigerator Hack

• Scale: Up to 700 French supermarkets affected
• Chains impacted: ~300 Intermarché and Netto stores, 80 Coopérative U, 80 Carrefour, ~30 Monoprix, several E.Leclerc locations
• Attack method: Attackers accessed internet-exposed refrigeration controller web servers, many accessible with username “admin” and the current date as password (the “code-of-the-day” authentication bypass). Controllers were switched to continuous defrost mode.
• Physical impact: Temperatures reached 50°C (122°F) after six hours; some units hit 80°C (176°F). Fires reported at multiple locations. Fire sprinkler systems activated, causing water damage.
• Financial impact: Estimated €10 million+ in losses. Two Alsace outlets alone reported combined loss of €270,000. Intermarché reported “several million euros.”
• Vulnerable equipment: Danfoss AK-SM800 (end-of-life 2021), AK-SC355 (end-of-life 2016), Danfoss AK-SM 800A (unpatched), Copeland XWEB, Dixell XWEB
• Response: French Prime Minister Sébastien Lecornu instructed ANSSI to investigate and coordinate with European counterparts. Paris prosecutors opened a cybercrime investigation.

October 2026 — Spillover Effects

• Same vulnerabilities found in supermarkets across Belgium, Germany, Luxembourg, Netherlands, Portugal, Poland, and Spain.
• U.S. chains Stop & Shop and Food Lion (Ahold Delhaize) reported IT disruptions and took systems offline.
• Post-attack scanning showed 4,500 Danfoss controllers still online.

November 2, 2026 — Second European Wave

• Countries affected: Sweden, Belgium, Luxembourg, Ireland
• Chains: Ahold Delhaize/Colruyt (Belgium/Luxembourg), ICA and Coop (Sweden)
• Pattern: Identical to October attack — evaporators switched to defrost mode, temperatures spiked
• Attribution: Belgian refrigeration company Sabcobel confirmed cyberattack. Sweden’s national cybersecurity centre confirmed multiple incidents. No group has claimed responsibility.
• Note: Ahold Delhaize had reported a cybersecurity incident to Dutch police in October, suggesting the attackers had been in the network before the November temperature spike.

2. Technical Deep Dive: Vulnerability Analysis

2.1 Danfoss AK-SM 800A Platform

Architecture: The AK-SM 800A is a centralized system manager coordinating refrigeration controllers. It runs an embedded Nginx web server, a CGI handler (sm_fcgi_app), and an internal Nginx instance for application logic.

CVE-2025-41450: Authentication Bypass (“Code of the Day”)

• CVSS v3: 8.2 (HIGH)
• Mechanism: Hidden authentication path in xml.cgi triggered by specific request parameters. The check_code_of_day function generates a daily password from the device’s current date using a deterministic algorithm. The algorithm was fully reverse-engineered by Claroty.
• Impact: Complete authentication bypass. Administrative access to the full web management interface.
• Real-world usage: Confirmed as the primary attack vector in the French supermarket hack. Username “admin” + current date as password worked on many systems.

CVE-2025-41451: OS Command Injection (RCE)

• CVSS v3: 7.6 (HIGH)
• Mechanism: SMTP email configuration fields passed unsanitized into OS shell commands. The email authentication password field was formatted directly into a system command.
• Impact: Post-authentication remote code execution. Full system compromise.
• Chain potential: When combined with CVE-2025-41450, this becomes an unauthenticated RCE chain.

CVE-2025-41452: Nginx Configuration Injection

• CVSS v3: 5.4 (MEDIUM)
• Mechanism: The load_nginx_headers endpoint accepts headers.conf file uploads. Maliciously crafted directives can manipulate web server routing and trigger unhandled exceptions in sm_app, crashing the web service.
• Impact: Denial of service against the management interface.

Legacy Equipment

• Danfoss AK-SM 800: End-of-life since 2021. No longer receives updates.
• Danfoss AK-SC 355: Phased out in 2016.
• These systems cannot be patched and require replacement or network isolation.

2.2 Copeland XWEB Pro Platform

Architecture: Lighttpd web server with Lua-based middleware. Multiple API and CGI endpoints for refrigeration management.

Key Vulnerabilities (23 total, 21 HIGH severity)

• CVE-2026-25085 (Auth Bypass): Lua authentication routine returns an empty table for unrecognized auth modes. In Lua, any table evaluates as truthy, bypassing authentication entirely.
• CVE-2026-21718 (Predictable Passwords): Daily admin credentials derived from device MAC address, current date, and hardcoded cryptographic keys. All inputs are publicly obtainable.
• 19 Command Injection Flaws: User-controlled input concatenated into OS commands across multiple endpoints without sanitization. Includes server username fields, library installation routes, and preconfiguration imports.
• CVE-2026-3037 (Stack Buffer Overflow): Memory corruption vulnerability.

Physical Demonstration

Team82 demonstrated that a compromised Copeland controller could manipulate physical refrigeration functions, silencing alarms while temperatures rose to dangerous levels.

2.3 Samsung Smart Refrigerator (Historical — 2015)

Pen Test Partners Finding (DEF CON 23):

• Samsung RF28HMELBSR smart fridge failed to validate SSL certificates when connecting to Google services.
• Man-in-the-middle attacks could intercept Gmail credentials from the fridge’s calendar integration.
• The fridge connected to Google Calendar via a web interface; credentials were transmitted but the SSL certificate was not verified.
• Attackers on the same network could use de-authentication attacks and fake Wi-Fi access points to position themselves as a MITM.
• This demonstrated that consumer smart appliances can serve as credential-stealing vectors, not just physical manipulation targets.

3. The Attack Chain (Reconstructed)

Based on the October 2026 French attack and subsequent waves, the attack methodology follows this pattern:

Phase 1: Reconnaissance

• Internet-wide scanning (Shodan, Censys) to identify exposed refrigeration controller management interfaces.
• Filter by HTTP/S title strings matching Danfoss StoreView or similar management panels.
• 2,752 Danfoss systems identified as internet-facing; 1,590 in France alone (Baptiste Robert, Predicta Lab).

Phase 2: Initial Access

• Attempt default credentials: username “admin”, password = current date.
• This exploits the “code-of-the-day” authentication bypass or weak password practices.
• For Copeland systems: exploit the Lua authentication bypass or derive daily admin credentials.

Phase 3: Control Manipulation

• Once authenticated, access the defrost cycle control interface.
• Trigger continuous/forced defrost mode on all connected refrigeration circuits.
• The defrost function is legitimate functionality — there is no attack signature for a feature doing what it was designed to do.

Phase 4: Physical Impact

• Defrost mode runs for hours (observed: ~6 hours).
• Temperatures climb from normal refrigeration levels (1–4°C) to 50°C (122°F), occasionally reaching 80°C (176°F).
• Equipment overheats, insulation melts, electrical fires ignite.
• Fire sprinkler systems activate, causing secondary water damage.
• Perishable inventory spoils.

Phase 5: Stealth

• No ransomware encryption. No data exfiltration. No ransom note.
• The attack leaves no traditional cyber forensic markers in IT systems.
• Point-of-sale systems, customer databases, and corporate networks remain untouched.
• The damage is entirely physical and operational.

4. Affected Systems and Scale

Geographic scope:

• Primary: France (700+ stores)
• Secondary: Belgium, Luxembourg, Sweden, Ireland (November 2026)
• Tertiary: Germany, Netherlands, Portugal, Poland, Spain (vulnerability exposure)
• U.S.: 14 military commissaries (August 2026), Ahold Delhaize chains (Stop & Shop, Food Lion)

Internet exposure:

• 2,765 Danfoss controllers internet-facing (Censys, August 2026)
• 4,500 Danfoss controllers still online (post-attack scan, October 2026)
• Many systems have been internet-accessible for years, some with default credentials

5. Attribution and Threat Actors

No group has claimed responsibility for the French or European supermarket attacks. However, several indicators point to the threat landscape:

Iran-backed hackers:

• Pentagon is reportedly investigating whether Iran-backed actors are behind the U.S. military commissary freezer failures.
• Iranian hackers targeted U.S. water providers earlier in 2026.
• Sabotage and disruption of critical infrastructure align with Iranian APT operational patterns.

Russia:

• Possesses capability. Sabotage of food supply is a known Russian method of operation.

Lower-sophistication actors:

• Ken Munro (Pen Test Partners) noted the attacks could be “kids messing around” given the simplicity of the exploit — scanning for internet-facing devices and logging in with “admin” and the date.
• The attack chain requires no zero-days, no social engineering, no supply chain compromise.

Nation-state motivation:

• Food supply disruption is asymmetric warfare. It creates public fear, economic damage, and political pressure without kinetic action.
• The attack specifically targets downstream consumer touchpoints rather than upstream supply chain.
• Combined with water utility attacks, the pattern suggests multi-domain critical infrastructure targeting.

6. Regulatory and Legislative Response

United States

• Farm and Food Cybersecurity Act: Reintroduced in 2025 (previously proposed 2024). Bipartisan.
• DHS 2021 Assessment: Identified refrigeration failures and shipping delays as cybersecurity risks to food supply.
• CISA ICS Advisories: ICSA-25-140-03 (Danfoss), ICSA-26-057-10 (Copeland).
• Food and Agriculture ISAC: Warning that attackers are targeting internet-accessible industrial controls with suboptimal defenses.
• 2025 UNFI cyberattack: Earlier food supply chain disruption via cyberattack on distributor giant, causing empty shelves at Whole Foods and other retailers.

European Union

• ANSSI: Investigating October 2026 attack; coordinating with European partners.
• CERT-FR Alert Bulletin CERTFR-2026-ALE-012: Published warning about targeted remote controllers.
• EU Commissioner Christophe Hansen: Called the attack unprecedented and emphasized that food security requires attention at all levels.

France

• Paris prosecutors opened formal cybercrime investigation.
• Refrigeration is commonly outsourced to third-party companies, meaning supermarkets themselves cannot manage security measures directly.

7. Remediation and Mitigation

Immediate Actions

1. Scan and inventory: Identify all refrigeration controllers, firmware versions, and remote access mechanisms. Use Shodan/Censys to check for internet exposure.
2. Patch immediately:
   • Danfoss AK-SM 800A: Upgrade to firmware R4.3.1 or later.
   • Copeland XWEB/XWEB Pro: Upgrade to firmware v1.13 or later.
3. Change default credentials: Any system still using default or predictable passwords must be changed immediately.
4. Remove internet exposure: Management interfaces must not be directly internet-accessible. Use VPNs, zero-trust access, or dedicated management networks.
5. Network segmentation: Isolate OT refrigeration networks from corporate IT. Apply firewall rules restricting IT-to-OT, vendor-to-OT, and OT-to-internet pathways.

For End-of-Life Systems

• Danfoss AK-SM 800 and AK-SC 355 cannot be patched.
• Replace with supported hardware or implement compensating controls: strict network isolation, physical access controls, and manual monitoring.

Architectural Changes

• OT exposure management: Continuous monitoring of refrigeration controller network reachability.
• Behavioral monitoring: Alert on anomalous defrost cycle activation, especially simultaneous across multiple circuits or outside scheduled maintenance windows.
• Physical safeguards: Independent temperature monitoring systems separate from the controller network.
• Vendor management: Contracts with third-party refrigeration operators must include cybersecurity requirements and patching SLAs.

8. The Broader Implications

Cyber-Physical Convergence

The refrigeration attacks represent a paradigm shift: cyberattacks moving from data theft and IT disruption to physical-world damage. The attack surface is now the machinery that keeps food cold, factories running, and infrastructure functioning.

AI and Automation Risk

As AI agents gain authority to operate physical systems, they become a new attack surface. An AI agent trusted to manage store equipment would sit between attackers and controllers which is one level above the current attack point. Manipulated agents could be compromised through poisoned data, bad credentials, or adversarial instructions.

Insurance and Liability

Intermarché warned that some insurance policies may not cover this type of cyber-physical incident. The gap between cyber insurance and property insurance creates a coverage vacuum.

Food Security as National Security

• The 2026 attacks are the first cyber-physical food supply disruption at scale.
• Cold chain integrity is critical for food safety where spoiled food cannot be sold, creating supply shortages.
• Pharmaceutical cold chains (vaccines, biologics) face identical vulnerability profiles.

9. Conclusion

The refrigeration controller attacks of 2025–2026 represent a watershed moment in OT cybersecurity. They demonstrate that:

1. Legacy industrial control systems are an urgent risk. End-of-life equipment connected to the internet is trivially exploitable.
2. Convenience destroys security. Remote management interfaces, designed for technician convenience, became mass-exploitation vectors.
3. Patch compliance is existential. Vulnerabilities were publicly disclosed months before exploitation. Organizations that applied patches were unaffected.
4. OT and IT must converge. Security teams cannot protect refrigeration controllers with traditional IT approaches. OT-specific exposure management, behavioral monitoring, and network architecture are required.
5. The physical world is now a cyberattack surface. When operational technology sits at the intersection of networks and physical processes, software flaws become weapons.

The November 2026 European wave which is arriving less than three weeks after the October attack and confirms this is not an isolated incident. The underlying vulnerability (internet-exposed, unpatched controllers with weak authentication) persists across thousands of systems globally. Until operators address the internet exposure and patch their infrastructure, the attack pattern will repeat.

Sources

1. Wikipedia — “2026 French supermarket refrigerator hack” (October 2026)
2. TechCrunch — “A fresh wave of cyberattacks has hit Europe’s supermarket refrigerators” (November 2, 2026)
3. Forbes — “The French Supermarket Fridge Hack That Made Cyberattacks Physical” (October 20, 2026)
4. Nextgov — “Pentagon investigates suspected cyberattack behind military freezer failures” (October 29, 2026)
5. Industrial Cyber — “Intermarché cyberattack exposes refrigeration security risks” (October 13, 2026)
6. RedSeal — “When the Freezers Fail: What the DoD Commissary Incident Tells Us About OT Cyber Risk” (September 15, 2026)
7. Claroty Team82 — “Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers” (August 9, 2026)
8. Cybersecurity Dive — “Dangerous flaws in refrigeration equipment were disclosed months before retail attacks” (October 13, 2026)
9. CISA — ICSA-25-140-03 (Danfoss AK-SM 8xxA Series)
10. CISA — ICSA-26-057-10 (Copeland XWEB and XWEB Pro)
11. Claroty Team82 — “Chilling Discoveries: Unpacking Vulnerabilities in Copeland XWEB Pro Controllers”
12. Al Jazeera — “Freezers in Sweden, Belgium overheat following possible cyberattacks” (November 2, 2026)
13. CBS News — “More grocery stores in Europe report fridge and freezer temperature spikes” (November 2, 2026)
14. Pen Test Partners — “Hacking DefCon 23’s IoT Village Samsung fridge” (August 18, 2015)
15. Schneier on Security — “Using Samsung’s Internet-Enabled Refrigerator for Man-in-the-Middle Attacks” (August 2015)
16. Copeland Product Bulletin — “Security update XWEB-PRO” (February 2026)
17. Danfoss Security Advisories — DSA-2025-03-01, DSA-2025-08-01
18. Food and Agriculture ISAC — “The Signal in the Noise: Why AI-Accelerated CVEs Are Straining Food and Agriculture Defense”
19. Reuters — Multiple reports on French and European supermarket attacks (October–November 2026)
20. CERT-FR — Alert Bulletin CERTFR-2026-ALE-012 (October 12, 2026)