A cyberattack targeting Danfoss refrigeration controllers has caused over 700 French Supermarkets to defrost, overheat, and even cause smoke and fires, resulting in financial losses and food waste. While refrigerators defrost overnight, the cyber attack caused them to overheat, reaching up to 122 degrees Fahrenheit (50 degrees Celsius).
Several food distributors, including Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, have confirmed the attacks. At least 180 Les Mousquetaires stores and over 100 Coopérative U outlets were affected.
Food distributors are among critical infrastructure organizations whose disruption could affect supply chains, leading to food shortages. Christophe Hansen, the EU’s Commissioner for Agriculture and Food, condemned the cyber attack.
“Food security requires more attention at all levels. Because the weaponization of food has become a reality,” said Hansen.
Food distributors use Danfoss refrigeration controllers to remotely manage and monitor their cold storage units, which requires exposing the controllers to the internet.
Cyber attack affects numerous French supermarkets
The attackers targeted refrigeration controllers running older versions of Danfoss industrial control software, which could not be updated.
Some of the affected French supermarkets, including Ahold Delhaize, reacted by taking the affected systems offline and removing food products from the affected refrigerators. However, the cyber attack did not disrupt operations at many of the affected food distributors.
Nevertheless, some of the affected French supermarkets launched an investigation and hired refrigeration specialists to respond to the cyber attack. The Paris prosecutor’s office has also launched an investigation into the cyber attack.
“Ahold Delhaize is experiencing a security issue within its network. Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers,” the food chain stated.
According to Coopérative U’s CEO Dominique Schelcher, the cyber attack on refrigeration equipment was extremely serious, unprecedented, and unacceptable.
“Attacking equipment that is essential to the preservation of fresh products and the food supply of the French is extremely serious and unprecedented. This is unacceptable,” said Schelcher.
The attack has also affected food chains beyond French supermarkets, spreading as far as the United States and Belgium. U.S.-based Stop & Shop and Netherlands-based Albert Heijn, Etos, and Gall & Gall, and Belgium-based Delhaize were affected. The cyber attack also affected cold refrigeration facilities in Spain, Portugal, Poland, and Germany.
It remains unclear how the attackers compromised Danfoss refrigeration controllers to target French supermarkets. However, in May 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that Danfoss refrigeration controllers were affected by authentication bypass and command injection vulnerabilities, CVE-2025-41450 and CVE-2025-41451, respectively. CISA recommends disconnecting industrial control systems from the internet unless necessary, or using a secure VPN to connect and allowlisting IP addresses.
According to Shodan, over 4,500 Danfoss refrigeration systems are exposed online, with more than 1,500 located in France. So far, no cybercrime gang has taken responsibility for the cyber attack on the refrigeration provider serving numerous French supermarkets.
France’s national cybersecurity agency, ANSSI, is also investigating the cyber attack, while the country is coordinating with other European counterparts to investigate the incident.
Danfoss has acknowledged the cyberattack affecting numerous French supermarkets but said it involved older systems that the company had previously advised customers to upgrade to newer versions.
“This attack is another stark reminder that cyberattacks against operational technology can have immediate, real-world physical consequences,” said Louis Eichenbaum, Federal CTO at ColorTokens. “We are no longer talking simply about stolen data or disrupted computer systems. We are talking about attackers manipulating physical equipment, destroying inventory, potentially creating fire hazards, and disrupting essential services.”
Industrial control systems targeted worldwide
Internet-facing industrial control systems have become prime targets for cybercriminals seeking access to critical infrastructure. In April 2026, U.S. federal authorities warned of Iranian hackers targeting critical infrastructure by exploiting exposed industrial control systems.
“This highlights a fundamental weakness in how many organizations approach OT security,” added Eichenbaum. “Operational systems were traditionally designed for reliability and availability, not to withstand sophisticated cyberattacks.
“Many still rely on legacy software, outdated authentication mechanisms, and network architectures that provide far more connectivity than is operationally necessary. Organizations need to adopt an ‘assume breach, assume vulnerable’ approach to OT security.”
In October 2025, Canadian authorities warned of hacktivists targeting internet-accessible ICS to compromise critical infrastructure. In one case, the attackers compromised a grain-drying silo on a Canadian farm, causing unsafe conditions.
In May 2026, Iranian hackers compromised automatic tank gauges (ATGs) via unprotected, exposed internet interfaces.
In July 2026, a coordinated cyber attack targeted more than 30 water treatment facilities in Minnesota by compromising programmable logic controllers. The cyber attack also affected hundreds of water treatment facilities across the United States.
