OVERNIGHT from Sunday to Monday, a large cyberattack disrupted refrigeration systems across hundreds of French supermarkets, with Danfoss’s cooling controls remote‑manipulated to raise temperatures to 50°C. BFMTV reported that the attack caused fresh and frozen stock to be destroyed and, in some cases, fires were noted. The disruption affected Intermarché, Netto and Coopérative U stores, with Reuters and national outlets citing hundreds of outlets impacted and losses running into millions of euros.
Specific stores cited included an Intermarché in Haguenau that lost its entire frozen stock and a Leclerc nearby that discarded around €220,000 worth of goods. Several U stores and other chains such as Carrefour Market and Monoprix were also mentioned in reporting, though not all firms confirmed numbers.
The infrastructure at issue hinges on Danfoss AK‑S M800/SC355 refrigeration controllers, some of which are end‑of‑life and running outdated firmware on AK‑SM800A units. ANSSI has identified a vulnerability in Danfoss software and is coordinating with European partners while Danfoss says affected equipment was largely legacy hardware and that it has advised customers to keep systems updated.
Claroty’s Team82 research has highlighted flaws in Danfoss refrigeration controllers, including a hidden authentication mechanism, and notes that vulnerable interfaces were publicly exposed prior to patches in firmware version R4.3.1. Authorities have launched an independent inquiry, with the anti‑cybercrime unit leading and OFAC counting victims. The full extent of damage and the precise number of affected sites remain evolving as the investigation continues.