Attackers remotely took over refrigeration controllers made by Danfoss overnight from Sunday into Monday, forcing fridges and freezers at hundreds of French supermarkets to heat up instead of cool. French authorities opened an investigation, and no group has claimed responsibility.
Danfoss Controller Hijack Triggered Forced Defrost Cycles Across French Retail Chains
The attackers took control of refrigeration controllers running older Danfoss software and triggered forced, prolonged defrost cycles. Cold-storage units warmed rather than chilled, with temperatures reportedly reaching up to 50 C (122 F) in some units, according to French broadcaster BFMTV as relayed by several outlets. Retailers named as affected include Intermarche, Netto, Cooperative U (the Super U and Hyper U banners), Carrefour, Monoprix and E.Leclerc. Stores discarded spoiled stock on Monday.
Conflicting Store Counts From Intermarche, Carrefour and Monoprix
The scale of the disruption varies by source. BFMTV reported about 300 Intermarche and Netto stores and fewer than 100 Cooperative U stores. Other French outlets put the total at 250 to 350 stores. An Intermarche spokesperson said 150 of its stores were affected. Carrefour said the attack “primarily affected 80 out of our 6000 stores,” and Groupe Casino said 5% of Monoprix stores were hit.
Financial figures are early. Two stores in Haguenau, Alsace, reportedly lost about 270,000 euros (about $302,000) of stock between them, and nationwide losses could reach several million euros.
Electrical Fires and Political Condemnation After the Danfoss Attack
Some stores reported electrical fires caused by overheating refrigeration units, and the Paris prosecutor’s statement referred to fires among the consequences under investigation. Cooperative U president Dominique Schelcher confirmed the attack on X, calling it “of utmost gravity, unprecedented” and “unacceptable.” EU agriculture commissioner Christophe Hansen condemned the attack and named Leclerc as a victim.
Earlier Claroty Team82 Research Described Danfoss AK-SM Weaknesses
Danfoss has not publicly confirmed the technical cause, and the attack vector remains unconfirmed. Intermarche said consoles with remote-control capability lacked a properly secured communication channel. Public research shows the product family had known problems. CISA published advisories in May and August 2025 on Danfoss AK-SM 8xxA flaws: CVE-2025-41450, an authentication bypass, and CVE-2025-41451, a command injection. Claroty Team82 found both.
Claroty Demonstrated Cooling Shutdown With Falsified Temperatures at DEF CON 34
In August 2026, Claroty Team82 showed at DEF CON 34 that a compromised AK-SM 800A could disable cooling while falsifying temperature readings. A Shodan search on August 19 found 3,726 such controllers exposed to the internet. A patch for three Danfoss controllers became available on September 18.
It is not confirmed whether the 2025 or 2026 vulnerabilities were used in this attack. Predicta Lab CEO Baptiste Robert found 2,752 Danfoss systems exposed online on Monday, 1,590 of them in France.
Paris Prosecutor and ANSSI Lead the Response to the Refrigeration Attack
The Paris prosecutor’s office opened an investigation into what it called a “large-scale cyberattack,” including the link to food losses and fires. ANSSI is coordinating the response nationally and with European counterparts. Authorities held a crisis meeting with Danfoss and installer Axima. Retailers are isolating systems and reviewing remote-access logs and firmware.
Groupement Mousquetaires said it is up to the supplier to file a criminal complaint. That position leaves open who will formally bring the case: the retailers whose stock spoiled, or Danfoss, whose controllers were manipulated.
The incident differs from most operational-technology attacks in how directly it reached consumers. Instead of encrypting files or stealing data, the attackers changed physical conditions inside stores across several competing chains at once. A patch has been available since September, and the exposure counts above show thousands of Danfoss systems reachable online, so the open question for investigators is how many of those units still ran older software on the night of the attack.
