Danfoss Attack Disrupts Refrigeration in French Markets

Hundreds of French supermarkets woke up on Monday (12) to find refrigerated displays out of control, spoiled products, and possible fire hazards, according to the Public Prosecutor's Office. The Paris Public Prosecutor's Office initiated an investigation and handed the case over to the Office for Anti-Cybercrime (OFAC), according to AFP. The attack occurred overnight from Sunday to Monday, affecting stores from Intermarché, Netto, and Système U, with unconfirmed reports involving E.Leclerc and Monoprix units.

The target was not the checkout systems or customer data, but the refrigeration controllers. According to a source close to the Prime Minister’s office cited by the French press, ANSSI, the national cybersecurity agency, identified a vulnerability in software from Danish company Danfoss, which manufactures control systems for commercial refrigeration. The attackers reportedly triggered forced defrost cycles, with reports of temperatures reaching up to 50 °C in displays for hours.

What the Companies Confirmed

Dominique Schelcher, CEO of Coopérative U, confirmed on X that a cyberattack affected the refrigeration of several stores in the chain, classifying the incident as "extremely serious" and "unprecedented." Nearly one hundred stores were reported to be affected, according to media reports. The group Les Mousquetaires, owner of Intermarché and Netto, revised the number of impacted units upward throughout the day and stated that fresh and frozen products would need to be discarded. The number of affected stores varies among sources, and a consolidated count has yet to be released by any authority.

Danfoss acknowledged in a statement "incidents occurring in France that affect a limited number of refrigeration management systems." The company attributed the problem to equipment running outdated firmware. No one claimed responsibility for the attack by the time of this report's publication, and authorities have not indicated a perpetrator.

Prime Minister Sébastien Lecornu called on ANSSI. A source cited by France Inter estimated total losses in several millions of euros, a figure that depends on the inventory of each store and has yet to have an official basis.

Why This Matters Beyond Retail

Attacks on retailers typically target card data or paralyze logistics through ransomware. This attack targeted the operational technology (OT) layer, the equipment that maintains the cold chain, resulting in measurable physical damage in a single night, without a known ransom demand. For a CISO, the lesson is about inventory: refrigeration controllers often fall outside the IT scope, installed and maintained by third-party integrators, with remote access configured years ago.

The incident's design exposes a national single-supplier dependency. Competing chains, with independent IT structures, fell together because they shared the same controller manufacturer and, according to Danfoss itself, outdated versions of the same software. This follows the same concentrated risk pattern that the financial sector has learned to map out with cloud providers, which the food retail sector still treats as mere equipment purchases.

Denmark, France, and the Rest of Europe

The reading extends beyond a single country. In Denmark, Danfoss' home, pressure falls on the supplier: each of the company’s customers, in any country, will want to know if they are running the affected versions and how much it costs to upgrade the legacy system. In France, the case tests the state’s response to an attack on the food supply chain, a sector classified by the European NIS2 directive as critical and subject to risk management and notification obligations.

In other European markets, NIS2 provides national regulators with a basis to require food distributors to conduct the same OT inventory that France is now rushing to establish. Outside the European Union, where Danfoss controllers also equip supermarkets and refrigeration chambers of distributors, the question for executives is simpler yet more uncomfortable: who in the company knows what version of firmware runs on the refrigeration equipment and who has remote access to it.

What remains unclear is the entry vector. Danfoss speaks of outdated firmware; ANSSI, according to the cited source, mentions software vulnerability. If the investigation reveals that access came from integrator credentials rather than a product flaw, the responsibility account shifts sides, along with maintenance contracts for thousands of stores.