How Attackers Hijacked Danfoss Refrigeration Controllers at French Supermarkets

On October 11, a coordinated attack targeted refrigeration systems across multiple French supermarket chains operated by Les Mousquetaires and other retailers. The attackers gained remote access to Danfoss climate control devices that manage all cooling units in affected stores. Instead of triggering an immediate alert or shutdown, the controllers were instructed to raise internal temperatures to approximately 50 degrees Celsius. The attack went undetected until store staff arrived and discovered spoiled inventory. Preliminary reporting suggests hundreds of locations were affected simultaneously, indicating either a shared vulnerability or compromised credentials across multiple installations.

Danfoss controllers are networked devices that run the refrigeration logic for entire supermarkets. They sit between the physical compressors and freezers and the maintenance interfaces that technicians use to monitor performance, adjust temperature setpoints and diagnose faults. These controllers are accessible remotely so that service firms can provide after-hours support without sending a technician to every location. The attackers likely obtained valid credentials or exploited an authentication weakness in the remote management portal. Once inside, they had write access to the setpoint parameters that determine how cold the units maintain. Raising the setpoint from its normal 2 to 5 degrees Celsius to 50 degrees would trigger gradual warming while the system continued to report normal operation to local monitoring displays, or the displays themselves may have been compromised. The lag between the attack and discovery allowed several hours of spoilage.

This incident is not primarily about stealing data or demanding cryptocurrency. Instead, it demonstrates the weaponization of supply chain infrastructure for direct economic harm. Supermarkets depend on cold chains; losing a night's worth of inventory can cost hundreds of thousands of euros in wasted goods and lost sales. More importantly, the attack highlights a structural vulnerability in industrial control systems. Danfoss controllers are used in hospitals, pharmaceutical storage facilities, data centers and food manufacturing plants. Any environment where temperature is critical depends on devices like these. If the same vulnerability or credential compromise affects medical refrigeration, vaccine storage or server room cooling, the consequences shift from economic damage to public health risk. The targeting of retail first may indicate attackers are testing tactics before escalating to higher-value targets.

Maintenance interfaces exist because dispatching technicians 24/7 is expensive and slow. Vendors and system operators have traded physical security for convenience. Remote access typically requires authentication, but implementation varies. Some Danfoss installations may use weak default credentials that were never changed. Others might expose management interfaces directly to the internet with outdated authentication protocols. Compromised credentials could come from a breach at a maintenance company, from social engineering of support staff or from leaked documentation. Once an attacker has valid login credentials to a widely deployed system, they can pivot across dozens or hundreds of installations. This is the core of the supply chain risk: one weak link in the maintenance ecosystem compromises all dependent customers.

Industrial control devices like Danfoss controllers were designed in eras when network security was not prioritized. They run for years with minimal patching because downtime is costly and disruptive. Staff who operate them are often trained on the device itself, not on cybersecurity. Unlike consumer software, industrial control systems cannot be trivially rebooted or updated without stopping production. This creates a strong disincentive to deploy security patches. Additionally, many organizations inherit these systems from previous operators and do not maintain complete asset inventories or credential management. Penetration testers regularly find industrial control networks that are segmented from the general company network but still lack strong authentication, encryption or intrusion detection. The Danfoss breach is not unusual in this respect; it is a reminder that old vulnerabilities are still present.

Industrial control vendors are under increasing pressure to redesign systems with security as a core requirement, not an afterthought. Danfoss and competitors will likely push security updates and recommend credential rotation across affected customer bases. Organizations that depend on critical refrigeration, server cooling or process control are now re-evaluating their remote access policies. Some may restrict maintenance access to scheduled windows, require multi-factor authentication or add a physical approval step before setpoint changes. Supply chain managers are asking vendors harder questions about security testing and incident response. Regulatory bodies in the EU and elsewhere are accelerating standards for industrial IoT security. The immediate response will be technical; the longer-term response will be organizational and regulatory.

This attack demonstrates that physical infrastructure damage can be inflicted without touching hardware, through compromised administrative credentials and poor access controls. Any organization that operates critical systems remotely should assume that maintenance interfaces are a target. If you work in a related field, review whether your remote access uses encrypted transport, strong authentication and activity logging. If you manage third-party maintenance contracts, verify that vendors are using multi-factor authentication and that they are restricting access to specific devices and functions. Check whether your organization has an incident response plan for anomalous control system behavior, such as sudden temperature changes or setpoint modifications. Start with one concrete step today: audit the maintenance credentials across one critical system and ensure they are not shared across multiple platforms and that they are rotated regularly.