A cyberattack targeting refrigeration equipment has cut food storage capacity at more than 700 stores in France, creating safety and economic concerns. The attack, which involved Danfoss Group’s refrigeration controllers and caused hundreds of refrigerators to burn up, leaving food to rot and threatening to cause fires, is being investigated by the Paris prosecutor’s office. ANSSI, the French cybersecurity agency, is working with European authorities to probe the hacking of Danfoss’s industrial systems.
Among the affected retailers are Intermarché, Carrefour Market, Monoprix, Leclerc, Super U and Coopérative U, with at least 180 Les Mousquetaires stores and over 100 Coopérative U stores affected. The impact is particularly dire for stores reliant on the refrigeration systems, which are forced to throw away spoiled food and suffer losses in produce.
Stores have taken various measures to mitigate the impact of the attack, including disconnecting the affected systems and removing food from them.
Some stores, however, continued to operate and serve customers. Refrigeration experts were called in to help investigate and identify the source of the problem. The incident has also raised concerns about how widespread the issue was, with food storage facilities in Spain, Portugal, Poland and Germany, as well as Belgian retail giant Delhaize and Dutch supermarket chains Stop & Shop, Albert Heijn, Etos and Gall & Gall also affected by the attack.
It is still unclear how the attackers gained access to the refrigeration controllers, but many of the affected systems were running old versions of Danfoss’s industrial control software, which could not be updated. Danfoss confirmed that it had warned customers of the vulnerabilities, recommending they upgrade to newer systems. U.S. Cybersecurity and Infrastructure Security Agency issued an alert last month, warning of two vulnerabilities in Danfoss’s refrigeration controllers, including one that allowed unauthorized remote access (CVE-2025-41450) and another that allowed command injection (CVE-2025-41451).
It is not yet known whether the two vulnerabilities had been exploited.
While many manufacturers of industrial equipment and components utilize some form of remote monitoring and control, analysts say that connected systems are a growing cybersecurity concern as they can be hijacked by malicious actors. Over 4,500 Danfoss units are exposed online, according to Shodan, including over 1,500 in France. CISA advises operators of industrial control systems to limit remote access to administrative or maintenance personnel and use virtual private networks and other restricted means to access systems remotely if it cannot be avoided.
Industrial equipment hacking has become a frequent occurrence, with malicious actors targeting operational technology that runs critical infrastructure. Earlier this year, hackers attacked agricultural operations, fuel pumps and water treatment plants in Europe and the United States, prompting the EU’s agriculture and food commissioner to call for stronger cybersecurity measures for the food chain.
“When it comes to food security, it is always a priority,” EU Commissioner Christophe Hansen said. Coopérative U director Dominique Schelcher called the attack “absurd,” adding that the targeted system is used to preserve food. No cybercriminal group has claimed responsibility for the French hacking, but investigators are still determining whether any of the known ransomware groups was responsible.
