Danfoss Refrigeration Controller Hack Forces Hundreds of French Supermarkets to Dump Fresh and Frozen Stock

A coordinated cyberattack on in-store refrigeration management systems forced hundreds of French supermarkets to discard fresh and frozen products on Monday, in an attack that one retail chief executive called unprecedented for the in-store food cold chain.

During the night of Sunday 11 October into Monday 12 October, attackers remotely triggered forced defrost cycles on refrigeration controllers supplied by Danish manufacturer Danfoss, according to BFM Business, which first reported the incident. Instead of running a short cycle to clear ice, the units were held in continuous defrost with a target temperature of around 50°C. Display cases and freezers warmed for hours before staff arrived; one ice-cream cabinet was photographed reading 26°C.

Which retailers were hit

Store counts differ by source and are still moving. Groupement Les Mousquetaires told BFM that 300 of its Intermarché and Netto stores were affected, while Intermarché gave AFP a range of 150 to 200 stores. Coopérative U said fewer than 100 outlets were hit. E.Leclerc confirmed that refrigeration equipment had been disrupted in several stores, and Carrefour told Infosecurity Magazine the incident mainly affected around 80 of its 6,000 French stores. Trade site Je bosse en grande distribution also named Monoprix, which had not confirmed. Infosecurity reported that stores in Belgium and the Netherlands may also have been affected.

Coopérative U chief executive Dominique Schelcher called the attack unprecedented and unacceptable, saying equipment that preserves fresh food and supplies French households had been targeted.

Losses and investigation

Intermarché said affected stores had to throw away all impacted fresh and frozen products. BFM cited single-store losses of roughly €50,000 at an Intermarché in Haguenau and about €220,000 at an E.Leclerc in Wasselonne, with an industry source estimating national losses in the millions of euros. Intermarché also warned that some insurance policies may not cover this type of in-store incident.

The Paris prosecutor’s office opened an investigation through its cybercrime section, handled by France’s anti-cybercrime office (OFAC), to identify victims and link the attack to reported food losses and several fire outbreaks.

Legacy controllers at the centre

France’s national cybersecurity agency ANSSI identified a vulnerability in Danfoss software and contacted the company, according to the Prime Minister’s office. Danfoss acknowledged incidents affecting “a limited number” of refrigeration management systems in France. It said most affected units were older AK-SM800 and AK-SC355 systems that have reached end of life and no longer receive software or security updates, and that affected AK-SM800A units were running outdated firmware. The company said it has long advised customers to keep supported systems updated.

Intermarché told Infosecurity that the stores hit ran vulnerable consoles with remote-control functions that lacked a properly secured communication channel. The risk was not new: Danfoss controllers have been tied to several published vulnerabilities, including CVE-2023-25915 and CVE-2025-41450 to 41452. At DEF CON in August, Claroty’s Team82 showed how a compromised AK-SM 800A could switch off cooling while sending false temperature readings, hiding a cold-chain failure from monitoring staff.

Why this matters for food retail technology

Store refrigeration has been networked for years to support energy optimisation, remote alarm handling and service contracts. That connectivity brought efficiency gains, but it also put long-lived operational technology, often installed for 10 to 15 years, onto networks it was never designed to defend. When a controller can be reached remotely, a defrost command becomes a tool for destroying stock.

For grocers, cold-storage operators and refrigeration contractors, the immediate actions are practical:

• Inventory exposure. Identify every refrigeration and building-management controller reachable from the internet or vendor networks, including end-of-life models.
• Patch or replace. Update firmware where support exists and budget replacement for unsupported units.
• Segment and authenticate. Put remote access behind VPNs or zero-trust gateways with strong credentials, and remove direct exposure.
• Verify independently. Use separate wireless temperature loggers so that a compromised controller cannot mask a failure.
• Review cover and food safety plans. Check whether cyber-physical stock loss is insured, and update HACCP and disposal procedures for this scenario.

The timing is pointed: Danfoss is presenting its iC7-HVACR drive with integrated cybersecurity features at the Chillventa refrigeration trade fair in Nuremberg, which opens on 13 October. Expect operational-technology security to move up the procurement checklist for food retail refrigeration across Europe.