Cyberattack on Danfoss fridge controllers forces food waste across hundreds of French stores

Hundreds of French stores lost cold storage

Three of France's biggest supermarket groups — E. Leclerc, Intermarché and Cooperative U — confirmed to AFP that a cyberattack on Monday pushed refrigeration temperatures up in hundreds of stores, forcing the disposal of fresh and frozen food and raising alarm about food security. Cooperative U's chief executive described the incident as “unprecedented”.

According to BFM TV, the attackers managed to remotely trigger forced defrosting of refrigeration systems in numerous stores — an approach that ruins inventory without necessarily touching tills or payment systems.

The scale, per the retailers' own statements to AFP: at least 300 Intermarché or Netto branches were affected, along with more than 100 Cooperative U outlets and several E. Leclerc stores. Intermarché said affected branches would have to throw away all fresh and frozen products. Paris prosecutors confirmed the attack and indicated it also sparked fires. The specialist retail news site jebosseengrandedistribution.fr reported that Carrefour Market and Monoprix were hit as well, though neither company has confirmed this.

Legacy Danfoss controllers at the centre

E. Leclerc traced the incident to “one of its refrigeration equipment suppliers”, which had repercussions on how cooling systems operated in several of its stores. A source close to the matter told AFP that the targeted equipment was refrigeration control systems from Danish manufacturer Danfoss.

In a statement to AFP, Danfoss said most of the affected equipment consisted of “legacy” products that “no longer receive software or security updates”. It named its AK-SM800 and AK-SC355 fridge regulator systems as affected, including a version of the former running “outdated firmware”, and said it had long advised supermarkets to move on from those models. The company gave no figures for how many systems were compromised.

France coordinates with European counterparts

A person close to French Prime Minister Sébastien Lecornu said the country's cybersecurity agency had already identified a vulnerability in software supplied by a Danish company and had contacted the vendor. The agency is liaising with European counterparts because other countries may be affected, and is working to identify other French companies involved so it can alert them and prevent the intrusion from spreading.

The EU's food and agriculture commissioner, Christophe Hansen, condemned the attack, writing on X that “food security requires more attention at all levels” and that the “exploitation of food” is now a “reality”.

Why it matters

The incident is a compact demonstration of how a single third-party vendor can become a single point of failure across an entire sector. Chains that compete fiercely on price evidently share the same refrigeration controllers, and one intrusion cascaded into hundreds of stores and an as-yet-unquantified volume of food waste.

It also highlights the gap between IT security and operational technology. The compromised devices were not payment terminals or databases but fridge regulators running firmware that no longer receives patches — hardware that is easy to overlook precisely because it quietly works for years. The consequences were unusually physical: spoiled inventory and, reportedly, fires.

Finally, the episode is being treated at EU level as a matter of food security rather than a purely technical breach. If similar legacy controllers are deployed elsewhere in Europe, as France's outreach to its counterparts suggests, other countries' food supply chains may carry the same exposure — and long-standing vendor advice to retire ageing equipment is likely to get far more attention.