Danfoss Refrigeration Controller Hack Forces Hundreds of French Supermarkets to Dump Fresh and Frozen Stock

A coordinated cyberattack on in-store refrigeration management systems forced hundreds of French supermarkets to discard fresh and frozen products on Monday, in an attack that one retail chief executive called unprecedented for the in-store food cold chain.

During the night of Sunday 11 October into Monday 12 October, attackers remotely triggered forced defrost cycles on refrigeration controllers supplied by Danish manufacturer Danfoss, according to BFM Business, which first reported the incident. Instead of running a short cycle to clear ice, the units were held in continuous defrost with a target temperature of around 50°C. Display cases and freezers warmed for hours before staff arrived; one ice-cream cabinet was photographed reading 26°C.

Which retailers were hit

Store counts differ by source and are still moving. Groupement Les Mousquetaires told BFM that 300 of its Intermarché and Netto stores were affected, while Intermarché gave AFP a range of 150 to 200 stores. Coopérative U said fewer than 100 outlets were hit. E.Leclerc confirmed that refrigeration equipment had been disrupted in several stores, and Carrefour told Infosecurity Magazine the incident mainly affected around 80 of its 6,000 French stores. Trade site Je bosse en grande distribution also named Monoprix, which had not confirmed. Infosecurity reported that stores in Belgium and the Netherlands may also have been affected.

Coopérative U chief executive Dominique Schelcher called the attack unprecedented and unacceptable, saying equipment that preserves fresh food and supplies French households had been targeted.

Losses and investigation

Intermarché said affected stores had to throw away all impacted fresh and frozen products. BFM cited single-store losses of roughly €50,000 at an Intermarché in Haguenau and about €220,000 at an E.Leclerc in Wasselonne, with an industry source estimating national losses in the millions of euros. Intermarché also warned that some insurance policies may not cover this type of in-store incident.

The Paris prosecutor’s office opened an investigation through its cybercrime section, handled by France’s anti-cybercrime office (OFAC), to identify victims and link the attack to reported food losses and several fire outbreaks.

Legacy controllers at the centre

France’s national cybersecurity agency ANSSI identified a vulnerability in Danfoss software and contacted the company, according to the Prime Minister’s office. Danfoss acknowledged incidents affecting “a limited number” of refrigeration management systems in France. It said most affected units were older AK-SM800 and AK-SC355 systems that have reached end of life and no longer receive software or security updates, and that affected AK-SM800A units were running outdated firmware. The company said it has long advised customers to keep supported systems updated.

Intermarché told Infosecurity that the stores hit ran vulnerable consoles with remote-control functions that lacked a properly secured communication channel. The risk was not new: Danfoss controllers have been tied to several published vulnerabilities, including CVE-2023-25915 and CVE-2025-41450 to 41452. At DEF CON in August, Claroty’s Team82 showed how a compromised AK-SM 800A could switch off cooling while sending false temperature readings, hiding a cold-chain failure from monitoring staff.

Why this matters for food retail technology

Store refrigeration has been networked for years to support energy optimisation, remote alarm handling and service contracts. That connectivity brought efficiency gains, but it also put long-lived operational technology, often installed for 10 to 15 years, onto networks it was never designed to defend. When a controller can be reached remotely, a defrost command becomes a tool for destroying stock.

For grocers, cold-storage operators and refrigeration contractors, the immediate actions are practical:

• Inventory exposure. Identify every refrigeration and building-management controller reachable from the internet or vendor networks, including end-of-life models.
• Patch or replace. Update firmware where support exists and budget replacement for unsupported units.
• Segment and authenticate. Put remote access behind VPNs or zero-trust gateways with strong credentials, and remove direct exposure.
• Verify independently. Use separate wireless temperature loggers so that a compromised controller cannot mask a failure.
• Review cover and food safety plans. Check whether cyber-physical stock loss is insured, and update HACCP and disposal procedures for this scenario.

The timing is pointed: Danfoss is presenting its iC7-HVACR drive with integrated cybersecurity features at the Chillventa refrigeration trade fair in Nuremberg, which opens on 13 October. Expect operational-technology security to move up the procurement checklist for food retail refrigeration across Europe.

Update — 14 October 2026: CERT-FR alert widens, exposure data and revised store counts

Alert extended beyond Danfoss. CERT-FR, the incident response team within France’s cybersecurity agency ANSSI, published alert CERTFR-2026-ALE-012 on 12 October and updated it on 13 October. It says the agency is aware of numerous compromises of remote controllers for refrigeration installations, covering the Danfoss AK-SM and AK-SC series as well as Copeland XWEB and Dixell XWEB units. The alert names no CVE or confirmed entry method, and warns that attack campaigns against this equipment are probably still in progress.

CERT-FR’s guidance for operators is to remove internet exposure for every affected unit and any controller on a public IP address, restore remote access only through a secure VPN or protected network, and fully check configurations, especially defrost schedules. It also advises checking insurance and service contract terms before cutting the data link to the refrigeration contractor. Source-IP filtering on a firewall is acceptable only as a short-term emergency measure. For compromised end-of-life units, a factory reset alone is not enough, because the device will remain vulnerable and is likely to be compromised again.

Scale of exposure. Félix Aimé, a senior threat intelligence analyst at Sekoia, told FoodNavigator that his team identified more than 2,700 Danfoss StoreView systems reachable from the internet, about 1,700 of them in France. Nearly half of the exposed French installations are now offline, accounting for almost 90% of offline systems seen across Europe. Aimé said that pattern points to direct attacker action rather than incident responders unplugging equipment, and that some systems may have been wiped, which would force a full rebuild of refrigeration control set-ups. He said indicators suggest the campaign specifically targeted France, although units are also exposed in Spain, Portugal, Poland, Germany and Belgium.

Revised store counts. Figures continue to shift. The Register reported that Groupement Les Mousquetaires now puts the number of affected Intermarché supermarkets at around 150, Carrefour confirmed about 80 stores, and Monoprix said roughly 5% of its 490 stores had the same problem. Coopérative U chief executive Dominique Schelcher said 80 of its 2,000 stores were hit, but told RTL that the group is not a Danfoss customer, which is consistent with CERT-FR’s inclusion of other vendors’ controllers. As of 13 October, no group had claimed responsibility and no ransom demand had been reported.

For food retailers and cold-chain operators outside France, the practical takeaway is unchanged but more urgent: audit every refrigeration and building-management controller for public exposure, regardless of manufacturer, and treat end-of-life units as candidates for replacement rather than reset.