French Supermarket Freezers Hijacked in Cyberattack on Danfoss Systems
Attackers remotely altered Danfoss refrigeration controls, spoiling goods at hundreds of French stores while Ahold Delhaize faces separate disruptions.
Key points
- Remote attackers hijacked Danfoss refrigeration controllers at French supermarkets overnight, causing freezers to heat up.
- Major chains including Intermarché, Super U, and Leclerc reported significant product loss and financial damage.
- Ahold Delhaize stores in the Netherlands and Belgium experienced separate disruptions due to an unspecified security issue.
Cyberattackers remotely hijacked refrigeration control systems manufactured by Danish firm Danfoss, causing hundreds of French supermarket freezers to malfunction. The incident occurred over the weekend, leading to widespread spoilage of chilled and frozen products across multiple retail chains in France.
According to French news channel BFMTV, the attack took place on Sunday night and early Monday morning. Workers arriving for their shifts on Monday found that the temperature controls had been altered, turning freezers into heating units. This remote manipulation resulted in the destruction of inventory that would have otherwise remained safe and sellable for customers.
Context and Background
BFMTV reported that the cyberattack targeted the regulation systems supplied by Danfoss, a key vendor in the refrigeration sector. An internal communication from the Intermarché network, dated Monday, October 12, confirmed the existence of the cyberattack during the night. The company held a crisis meeting at 11 a.m. involving service providers such as Axima, which specializes in installation and maintenance, alongside Danfoss.
Security researchers with Claroty’s Team82 disclosed multiple vulnerabilities in early August 2026 affecting Danfoss AK-SM 800A refrigeration controllers. These flaws impacted the web-based management interfaces of the devices. While similar issues were found in Copeland XWEB Pro supervisory controllers, the source material does not confirm a direct link between those known flaws and the current French attacks.
Who Is Affected
Several major French grocery retailers suffered damage estimated in the tens or hundreds of thousands of euros. Stores operated by Groupement Mousquetaires, including Intermarché and Netto, were among those hit. The Coopérative U network, which runs Super U and Marché U locations, also experienced disruptions. Leclerc stores were similarly affected by the remote tampering of their refrigeration infrastructure.
Jonathan Le Borgne, creator of the podcast Je Bosse En Grande Distribution, confirmed that hackers took control of the remotely controllable Danfoss systems. He noted that Carrefour Market and Monoprix stores were also affected. In some cases, managers received alerts about the destructive changes, allowing staff to salvage some products before they spoiled completely.
Separately, workers at stores owned by Dutch multinational Ahold Delhaize in the Netherlands and Belgium have been dealing with disruptions. These issues stem from an unspecified “security issue” and are distinct from the Danfoss-related attacks in France. No details were provided regarding the nature or cause of the Ahold Delhaize disruptions.
What should you do?
Organizations using industrial control systems should monitor for unauthorized configuration changes, particularly in temperature or environmental controls. Network segmentation can limit the ability of attackers to move laterally from IT networks to operational technology. Regular audits of web-based management interfaces for known vulnerabilities are essential, especially for devices like Danfoss controllers that have previously disclosed flaws.
What to do and how to stay safe: Danfoss
- Monitor network traffic for unusual commands sent to industrial control systems or refrigeration units.
- Verify that web-based management interfaces for critical infrastructure devices are patched against known vulnerabilities.
- Segment operational technology networks from standard corporate IT networks to limit remote access.
- Establish incident response procedures for physical asset damage caused by cyber incidents.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which companies were affected by the French refrigeration cyberattack?
Intermarché, Netto, Super U, Marché U, Leclerc, Carrefour Market, and Monoprix were affected by the Danfoss system hijacking.
Is the Ahold Delhaize disruption linked to the Danfoss attack?
No, the source material states that European food retailers were affected by two separate disruptive cyberattacks.
Were known vulnerabilities used in this attack?
Claroty disclosed vulnerabilities in Danfoss controllers in August 2026, but no confirmed link to this specific incident was stated.
