Hackers Target Danfoss Systems in French Supermarket Refrigeration Attack

Attack Overview

A cyberattack targeting internet-connected refrigeration systems has hit around 400 French supermarkets, forcing defrost systems to run continuously and pushing some units to 50°C. According to French broadcaster BFMTV, about 300 Intermarché and Netto stores and nearly 100 Coopérative U outlets were affected. E.Leclerc, France's largest supermarket chain, was also reportedly targeted, though it has not confirmed any disruption.

The attack began overnight on Sunday and affected refrigeration control software, reportedly running older versions of systems supplied by Danish manufacturer Danfoss. Hackers tricked the defrost feature, normally used to clear frost, into running nonstop instead of keeping the units at safe cold temperatures. Food was reportedly exposed to heat for several hours. Two supermarkets in Alsace suffered combined losses of €270,000 ($302,000), and nationwide damage could reach several million euros.

Investigation Underway

The Paris prosecutor's office confirmed it opened an investigation into the large-scale attack, including reported food losses and an outbreak of fire. Coopérative U president Dominique Schelcher confirmed the incident on X, calling the targeting of equipment essential to food preservation and supply unacceptable. He said teams were working with refrigeration specialists to restore affected systems.

Les Mousquetaires, which operates Intermarché and Netto, told BFMTV that some refrigeration equipment was out of service and affected products were being removed as a precaution. An internal communication reportedly warned stores about the loss of frozen products, while crisis teams coordinated emergency supplies and technical assistance.

Software Flaws and Wider Response

France's national cybersecurity agency, ANSSI, has reportedly identified a software component as part of its response. According to BFMTV, the agency has contacted the supplier and is coordinating with European counterparts over potential risk in other countries.

In August, security researcher Amir Zaltzman at Claroty identified several flaws in Danfoss refrigeration controllers, warning that an attacker could modify how requests are handled by the web server and potentially manipulate clients interacting with the device. A patch for three Danfoss controllers has been available since September 18th. The attack follows a cybersecurity incident at Dutch retailer Albert Heijn, which took its website, app, and online delivery services offline. It is not known whether the two incidents are related.

Sources: Cybernews