What the European Supermarket Hacks Teach About Hiding Critical Systems

What happened and what the evidence shows

The attacks spread from France to supermarkets in at least seven more European countries within a month. After an October attack in which French police said hackers seized control of cooling units at hundreds of supermarkets, a second wave in November expanded the risk to more retailers. 

Affected chains included stores operating under Delhaize, Carrefour, Spar, Coop, and ICA, among others. Reporting described attackers manipulating refrigeration settings, including switching equipment into defrost mode, resulting in spoiled food. In the United States, Axios reported that the Pentagon is investigating suspected cyberattacks involving refrigeration systems at six military commissaries, and American grocers use similar technology.

The common exposure was internet-facing management interfaces. Reports also described login attempts using publicly documented factory-default credentials. The precise intrusion method has not been established for every affected installation, so default-password attempts should not be confused with proof that one credential weakness explains every compromise.

France’s national cybersecurity agency, ANSSI, said through its CERT-FR alert that the attackers targeted vulnerabilities in Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB systems. Its guidance prioritizes removing public internet exposure, checking configurations, restoring access through protected connectivity, and applying manufacturer security recommendations, including changing default passwords on Danfoss controllers.

Exposure became a path to control

The root cause was exposure. Because attackers could reach the controllers directly, a default password or outdated firmware could be enough to give them control. The critical security boundary sits between someone discovering a management interface and gaining the ability to affect a physical process. When that boundary depends primarily on the controller’s own authentication and software, a weakness in the controller can become a weakness in the entire operation.

Consider the questions a retailer should be able to answer:

• Can an unknown internet user discover or connect to this controller?
• Does a maintenance provider receive access to one approved system or an entire network?
• Can a compromised service laptop reach equipment unrelated to its current task?
• Does access expire when maintenance ends?

Those questions remain relevant even after a password change or firmware update. They determine how much opportunity an attacker has before a vulnerability is exploited, and how far a compromise can spread afterward.

Patching alone can’t protect these systems

Patching alone could not have closed the gap these attackers used. Danfoss had already released patches for high-severity flaws in its web management interface, and Copeland said the affected units were end-of-life: a fix protects a controller only once it is applied, and end-of-life equipment will never receive one. 

Even a fully patched controller becomes vulnerable again the day a new flaw is discovered, and AI is shortening that window: as attackers use it to find and exploit weaknesses faster, every connected asset will become as exposed as an aging controller that can’t be patched in time. Retailers should still apply available updates and replace unsupported equipment, but an asset-protection strategy has to protect the equipment operating today, whatever its patch level. That makes hiding assets from attackers the baseline for every system, new or old.

Refrigeration cannot simply stop while an organization completes a replacement program, so the operational question is how to keep necessary monitoring and maintenance running while eliminating unnecessary exposure. The answer is to place enforceable controls in front of the asset rather than requiring the asset itself to supply every security capability. With those controls in place, an unauthenticated requester hits an enforced access boundary before ever reaching the controller’s login page or vulnerable management service.

How Xage protects the asset

Xage Asset Protection combines identity-based access control, segmentation, and virtual patching to protect modern and legacy environments. Xage Extended Protection (XEP) can enforce controls in front of devices or switches, allowing organizations to strengthen protection without first modifying each controller’s firmware. These controls compensate for exposure and access weaknesses; they do not repair the underlying software defect. 

For a retailer, the approach has four practical elements:

1. Hide assets from unauthorized discovery. Remove direct public access and cloak protected resources behind an enforced identity boundary. Unauthorized users should not be able to scan the controller or connect to its management interface through the protected path. If an attacker gets onto the network but can’t even see the refrigeration controls, they can’t turn up the heat.
2. Broker access to the approved resource. Give a technician a controlled connection to the system required for the job, rather than broad access to the store’s operational network.
3. Verify identity and limit duration. Apply authentication, authorization, and time limits outside the legacy device. A controller’s password should not be the only barrier protecting the equipment.
4. Contain compromise. Restrict communications between assets so that a compromised endpoint does not automatically provide access to neighboring controllers or other sites. See Xage’s Asset Protection model.

These protections depend on routing access through the enforcement layer and closing bypass paths. Leaving a separate public connection to the same controller would preserve the exposure the organization intended to remove.

What this looks like in a supermarket

In practice, a technician gets temporary access to the one system the job requires, while an external attacker has no direct path to it. A refrigeration technician responding to an alert at one store authenticates through an approved access service and reaches only the relevant management system. Other equipment stays outside that technician’s authorized reach, and access ends when the service window closes.

An external scanner, meanwhile, cannot directly contact the protected refrigeration interface, and discovering an old device password does not by itself provide an authorized path through the access layer. That is the operational goal: preserve the interaction the business needs while removing the access an attacker could exploit.

Start with the systems attackers can reach

Retailers should begin by identifying publicly reachable operational interfaces and coordinating their removal with facilities teams and refrigeration providers. Then validate the connections that remain: who needs access, to which assets, for what purpose, and for how long. Apply available patches, eliminate default credentials, verify equipment settings, and plan replacement of unsupported systems. In parallel, enforce access boundaries that remain effective when an endpoint cannot yet be updated.

Read our Asset Protection white paper to see how identity-based access control and asset-level microsegmentation limit which users, machines, and AI agents can reach critical systems.

About the author

Roman Arutyunov is the Co-Founder and Chief Product Officer at Xage Security. Roman leads the product vision and go-to-market with experience in security, networking, and industrial applications. Prior to Xage, led Product and Engineering at ABB, Tropos Networks, and Blue Coat Systems solving security, networking and data analytics challenges for industrial and commercial enterprises enabling millions of IoT devices in production today. Earlier in his career, Roman worked on the first generation of Content Distribution Networks (CDN) and Proxy Servers at Blue Coat Systems (Symantec). Roman holds a Bachelor’s in Applied Mathematics with an emphasis in Computer Science from the University of California, Berkeley and an MBA from Columbia University.