Attackers Trigger Remote Defrost on Danfoss Units, Spoiling Produce in 300 French Grocery Stores

Attackers remotely manipulated refrigeration controllers overnight Sunday, causing fresh food to spoil at hundreds of French supermarkets. Retailers confirmed the incident on Monday, describing it as a coordinated attack on operational technology that resulted in physical damage to inventory across major grocery chains.

Which stores were affected by the attack?

BFMTV reported that approximately 300 Intermarché and Netto stores were impacted by the disruption. Additionally, fewer than 100 Coopérative U stores experienced similar issues. Groupement Mousquetaires, which owns the Intermarché and Netto brands, stated that Danfoss manages the affected systems. The group indicated that the supplier would be responsible for filing any criminal complaints regarding the incident.

How did the attackers compromise the systems?

According to BFMTV, the attackers targeted older versions of software running on Danfoss refrigeration controllers. They remotely triggered the defrost function on these units, which stopped the cooling process. This action caused temperatures to rise, leading to the spoilage of perishable goods. It remains unclear if previously known vulnerabilities were exploited in this specific incident.

What is the official response to the incident?

Dominique Schelcher, CEO of Coopérative U, confirmed the cyberattack was affecting cold production facilities at several stores in his network. He described the targeting of essential food preservation equipment as unprecedented and unacceptable. France’s national cybersecurity agency, ANSSI, stated it is mobilized to support potential victims nationally and coordinate with European counterparts. Danfoss has not publicly confirmed its systems were the target.

What context exists for this type of threat?

Security researchers have previously identified weaknesses in Danfoss refrigeration controllers. The U.S. Cybersecurity and Infrastructure Security Agency published an advisory last year regarding three such vulnerabilities. Researchers at Claroty’s Team82 demonstrated that compromised controllers could disable cooling while reporting normal temperatures. They found more than 2,700 of these devices exposed to the internet, though their involvement in Sunday’s attack is unknown.

What to do and how to stay safe: Danfoss

• Inventory all operational technology devices connected to corporate networks.
• Verify that firmware on industrial controllers is updated to the latest version.
• Monitor network traffic for unexpected commands sent to cooling equipment.
• Isolate critical refrigeration systems from general internet-facing networks.

Step-by-step guide: Browser Security Settings for Small Business Teams

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Danfoss confirm its devices were hacked?

Danfoss has not publicly confirmed that its systems were the target of the attack.

How many stores were impacted in total?

About 300 Intermarché and Netto stores and fewer than 100 Coopérative U stores were affected.

What did the attackers do to the refrigerators?

Attackers remotely triggered the defrost function, stopping the cooling process and spoiling food.