The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, cybercriminals exploited unpatched vulnerabilities in Danfoss and XWEB refrigeration controllers across over 400 European grocery stores, converting refrigerators and freezers into heating units that reached 50°C (120°F). The attackers manipulated defrost cycles to mask the sabotage, causing complete spoilage of perishable inventory and estimated losses exceeding several million euros. The attacks leveraged CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 affecting end-of-life Danfoss AK-SM 800A platforms, along with 23 vulnerabilities in XWEB Pro systems disclosed by Claroty researchers in August 2026.

This incident highlights the growing threat to operational technology (OT) environments where legacy industrial control systems remain Internet-exposed and unpatched. As critical infrastructure increasingly relies on connected IoT devices for remote monitoring and control, attackers are shifting focus from traditional IT networks to industrial systems that can cause immediate physical and financial damage.

Why This Matters Now

The European refrigeration attacks demonstrate how threat actors are weaponizing disclosed OT vulnerabilities within months of publication, targeting Internet-exposed industrial control systems that organizations often overlook in their security programs.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers exploited CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 in Danfoss AK-SM 800A platforms, plus 23 vulnerabilities in XWEB Pro systems, all disclosed by Claroty researchers in August 2026.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely reduce the attack's blast radius by constraining lateral movement between refrigeration systems and limiting access to critical OT controllers across the 400+ affected grocery stores.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Initial exploitation would likely succeed against vulnerable controllers, but CNSF microsegmentation policies could limit the attacker's ability to discover and reach additional refrigeration systems within the same network infrastructure.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Administrative compromise of individual controllers would likely occur, but Zero Trust principles could constrain the scope of elevated privileges by limiting access to segmented network zones containing critical refrigeration infrastructure.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Lateral movement between refrigeration systems would likely be constrained through east-west traffic inspection and policy enforcement, potentially limiting the attackers' ability to reach all 400+ stores through shared management infrastructure.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Command and control channels would likely be established on compromised systems, but multicloud visibility could detect and limit unauthorized communication patterns across the distributed refrigeration network infrastructure managed by third-party providers.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Since no data exfiltration was attempted in this operationally-focused attack, egress security controls would not have been directly tested, but could provide additional monitoring of outbound communications from compromised OT systems.

Impact (Mitigations)

Despite CNSF protections potentially reducing the attack's overall scope, compromised refrigeration controllers could still cause significant operational impact within their isolated network segments, though the blast radius across the entire grocery chain infrastructure would likely be constrained.

Impact at a Glance

Affected Business Functions

  • Cold Chain Management
  • Food Safety Compliance
  • Inventory Control
  • Store Operations
Operational Disruption

Estimated downtime: 3 days

Financial Impact

Estimated loss: $10,000,000

Data Exposure

No customer or employee data exposure reported. Attack focused solely on operational technology controlling refrigeration systems, resulting in spoilage of perishable inventory across 400+ stores in multiple European countries.

Recommended Actions

  • • Implement Zero Trust Segmentation to isolate OT systems from Internet exposure and restrict third-party vendor access to least privilege principles
  • • Deploy Multicloud Visibility & Control to monitor anomalous interactions between OT controllers and detect suspicious automation patterns across refrigeration networks
  • • Establish Egress Security & Policy Enforcement to prevent unauthorized outbound communications from OT devices and block command-and-control traffic
  • • Enable East-West Traffic Security to detect and prevent lateral movement between refrigeration controllers within the same network segment
  • • Implement Inline IPS (Suricata) to identify and block exploit traffic targeting known CVE vulnerabilities in Internet-facing OT systems

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image