Check Danfoss Refrigeration Controls After European Supermarket Cyberattacks

European food retailers are addressing two distinct cyber incidents that disrupted operations across multiple countries. In France, attackers remotely hijacked refrigeration control systems manufactured by Danish firm Danfoss. The intrusion occurred during the night, causing freezers to warm instead of cool. Staff arrived at work on Monday to find defrosted and spoiled products in affected stores.

Which retailers were affected by the French attack?

BFMTV reported that hundreds of stores across France were impacted by the cyberattack on Danfoss systems. Major chains included Groupement Mousquetaires, which operates Intermarche and Netto, as well as Coopérative U, which runs Super U and Marche U. Leclerc stores were also among those affected. Jonathan Le Borgne, who runs a grocery retail blog, confirmed that Carrefour Market and Monoprix stores experienced similar issues with their remotely controllable Danfoss units.

What damage did the attackers cause?

Attackers took control of the Danfoss refrigeration control systems on Sunday night and early Monday morning. They altered settings so that fridges and freezers warmed up rather than maintaining cold temperatures. This resulted in the destruction of chilled and frozen products. According to BFMTV, the damage reached tens or even hundreds of thousands of euros for some shops. Some staff managed to salvage products because the attack hit closer to opening hours or because managers received alerts about the destructive changes.

Are other countries experiencing similar problems?

Dutch multinational Ahold Delhaize reported disruption in its stores in the Netherlands and Belgium. Workers are dealing with an unspecified security issue. Help Net Security stated that this is a separate incident from the French cyberattack. The nature of the disruption and the specific systems affected in these countries were not detailed in the reports. The focus remains on the confirmed hijacking of cooling systems in France.

Is there a link to known vulnerabilities?

Security researchers from Claroty’s Team82 disclosed multiple vulnerabilities in early August 2026. These flaws affected the web-based management interfaces of Danfoss AK-SM 800A refrigeration controllers and Copeland XWEB Pro supervisory controllers. However, no confirmed link has been established between these known flaws and the recent attack on French supermarkets. A crisis meeting was scheduled for Monday at 11 a.m. involving Danfoss and Axima, a specialist in refrigeration equipment installation and maintenance, to address the incident.

What to do and how to stay safe: Danfoss

• Audit all remote management interfaces for refrigeration and cooling equipment to ensure they are not exposed to the public internet.
• Verify that all Danfoss and Copeland controllers are updated to the latest firmware versions available from the vendor.
• Implement network segmentation to isolate industrial control systems from general corporate networks and user devices.
• Monitor system logs for unusual changes in temperature settings or unauthorized access attempts during off-hours.

Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the attackers steal data or just disrupt operations?

The reports indicate the attackers hijacked controls to warm freezers, destroying products. No data theft was mentioned in the source material.

Is there a patch for the Danfoss vulnerability?

The source material does not confirm if a fix has been released for the vulnerabilities disclosed by Claroty.

Which specific Danfoss systems were targeted?

The attack targeted remotely controllable Danfoss refrigeration control systems. Specific model numbers for the attacked units were not provided.