European Supermarkets Hit by Cyberattack Targeting Danfoss Refrigeration Controllers
Hackers remotely raised freezer temperatures to 50C in hundreds of stores across Europe, spoiling food and causing significant losses for major retail chains.
Key points
- Attackers exploited vulnerabilities in Danfoss refrigeration controllers to defrost freezers overnight.
- Over 300 locations in France were affected, with impacts in Belgium, Germany, Netherlands, Poland, Portugal, and Spain.
- Major chains including Auchan, Carrefour, and E.Leclerc reported significant monetary damages and food spoilage.
Cybercriminals executed a coordinated attack against hundreds of supermarkets across Europe, remotely altering refrigeration settings to defrost freezers. The intrusion caused temperatures to rise to 50 degrees Celsius, spoiling perishable goods and inflicting substantial financial harm on retail operators. This incident represents a significant breach of operational technology infrastructure within the food supply chain.
The attack primarily impacted French retailers, with more than 300 locations suffering damage according to French outlet BFM TV. However, the scope extended beyond France to include affected stores in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain. The perpetrators reportedly accessed systems during the night, allowing temperatures to remain elevated for approximately six hours before staff discovered the issue upon opening.
Technical Context and Vulnerabilities
Security researchers identified the compromised hardware as refrigeration controllers manufactured by the Danish company Danfoss. The attackers remotely took control of these devices, overriding standard cooling protocols. This method of intrusion aligns with vulnerabilities previously disclosed by cybersecurity firm Claroty. The firm had identified flaws in the Danfoss AK-SM 800A management platform that could permit unauthorized access.
Claroty reported that these vulnerabilities allowed attackers to bypass authentication mechanisms and execute arbitrary code. The flaws also enabled the injection of arbitrary configuration directives, which attackers likely utilized to change temperature settings. Claroty noted that thousands of these management interfaces were publicly accessible on the internet, creating a wide attack surface for malicious actors.
Affected Retailers and Response
Several major European supermarket chains confirmed they were victims of this cyberattack. Reuters reports that Auchan, Carrefour, E.Leclerc, Intermarché, and Monoprix were among the affected entities. Intermarché is owned by the Groupement Mousquetaire cooperative. The sheer scale of the operation suggests a sophisticated effort to disrupt food preservation systems across multiple national borders.
Dominique Schelcher, CEO of Cooperative U, confirmed that stores under the Hyper U, Super U, U Express, and Utile brands were impacted. Schelcher stated on X that teams were working with refrigeration specialists to restore normal operations. He described the targeting of equipment essential to food preservation as unprecedented and of extreme gravity, calling the attack unacceptable.
What should you do?
Organizations relying on industrial control systems should verify the security posture of their operational technology networks. The incident highlights the risks of exposing management interfaces to the public internet. Companies must ensure that firmware is updated to address known vulnerabilities in control hardware. Monitoring for unusual configuration changes can help detect unauthorized access early.
What to do and how to stay safe: Danfoss
- Audit all operational technology devices for publicly exposed management interfaces or web portals.
- Verify that all refrigeration and HVAC control firmware is updated to the latest patched versions.
- Implement network segmentation to isolate critical infrastructure from general corporate networks.
- Monitor system logs for unexpected configuration changes or authentication bypass attempts.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which companies were affected by this refrigeration controller hack?
Auchan, Carrefour, E.Leclerc, Intermarché, Monoprix, and Cooperative U brands were affected.
What specific vulnerability was exploited in this attack?
Attackers exploited vulnerabilities in Danfoss AK-SM 800A management platform controllers.
How much damage was caused by this cyberattack?
Losses are estimated in the millions of euros due to spoiled food products.
