Danfoss systems used to control refrigeration equipment were targeted in a cyberattack that disrupted hundreds of French supermarkets overnight between 11 and 12 October. Hackers remotely raised the temperature of refrigerators and freezers, forcing retailers to discard large quantities of fresh and frozen food.
The attack affected several major supermarket chains, including Intermarché, Coopérative U and E.Leclerc. According to AFP, at least 300 Intermarché and Netto stores and more than 100 Coopérative U outlets were targeted. Reuters subsequently reported that Carrefour and Monoprix had also been affected.
In some stores, refrigeration temperatures reached 50°C, with equipment remaining overheated for several hours. The Paris prosecutor’s office confirmed that the incident had caused substantial food losses and fires at some locations.
The attack has also drawn attention to Danfoss, the Danish engineering company whose technology was used in the affected refrigeration systems.
Danfoss confirms older refrigeration systems were affected
Founded in 1933 and headquartered in Nordborg, southern Denmark, Danfoss is a major international manufacturer of heating, cooling and industrial control technologies.
Its refrigeration management systems allow supermarkets to monitor and adjust temperatures remotely, helping operators manage entire networks of refrigerators and freezers.
According to French media reports, hackers exploited weaknesses in these connected systems to activate forced defrosting functions, causing temperatures to rise and food to spoil.
Danfoss confirmed that it was aware of the incidents in France and was working with affected customers.
We take the situation seriously and are in close dialogue with the affected customers to help them manage it.
The company, whose statement was reported by Danish broadcaster DR, said that most of the affected equipment consisted of older products.
In particular, Danfoss identified its AK-SM800 and AK-SC355 refrigeration controllers among the affected systems. Many were legacy products that no longer receive software or security updates, while others were running outdated firmware.
The manufacturer said it had long advised customers to update supported equipment and replace obsolete systems with newer alternatives.
The number of Danfoss devices compromised has not been disclosed.
French authorities identify vulnerabilities in Danfoss systems
France’s national cybersecurity agency, ANSSI, identified a vulnerability in software supplied by Danfoss and contacted the manufacturer.
On 12 October, the French national computer emergency response team, CERT-FR, published a specific security alert concerning multiple compromises involving Danfoss AK-SM and AK-SC controllers.
The agency warned against exposing equipment management interfaces directly to the internet and recommended disconnecting or restricting remote access. It also advised affected operators to apply available security updates and review access credentials.
Security weaknesses in some Danfoss refrigeration controllers were already documented before the French attack. The company’s official security advisories describe vulnerabilities identified in 2025 that could allow unauthorised access or system compromise in certain AK-SM 8xxA models.
However, investigators have not established whether those specific vulnerabilities were exploited in the latest incident.
The attack is particularly significant because it targeted physical equipment rather than simply stealing information or disrupting digital services. By manipulating connected refrigeration systems, hackers were able to interfere directly with food storage and supermarket operations.
French authorities have opened an investigation, while cybersecurity officials are coordinating with European counterparts over concerns that systems in other countries could also be vulnerable.
The attack follows recent cybersecurity incidents in Denmark
The involvement of Danish technology comes amid heightened attention to cybersecurity following two major incidents reported in Denmark earlier this month.
On 2 October, the Technical University of Denmark (DTU) disclosed a cyberattack targeting its identity and access management system. Hackers accessed personal information, potentially affecting up to 200,000 current and former users, including students and employees.
Three days later, Danish authorities confirmed another major data breach involving the country’s Central Person Register (CPR), which stores personal information and identification numbers.
Unauthorised parties had obtained access to names, addresses and CPR numbers associated with approximately 8.8 million registered individuals, including people who are no longer alive.
Unlike the French supermarket attack, these incidents primarily involved the exposure of personal data.
