The French Supermarket Fridge Hijacking: How Attackers Exploited Danfoss Controllers

On the night of October 11, retail chains across France reported unusual temperature readings in their refrigeration units. Overnight, the systems that keep supermarket food fresh were hijacked and deliberately overheated. Multiple chains confirmed that hundreds of stores were affected simultaneously, suggesting a coordinated and well-researched operation. Staff discovered the damage only when they arrived the next morning to find spoiled meat, dairy, frozen goods and fresh produce ruined. The financial impact was immediate and severe, forcing chains to discard entire inventory sections and deal with supply disruptions.

The attack persisted long enough to cause material damage but short enough to avoid triggering immediate emergency responses. The attackers understood the operational rhythm of their targets and timed the intrusion to maximize chaos and loss.

The weak link was a Danfoss climate control unit, a industrial refrigeration controller that monitors and adjusts temperatures across all the fridges and freezers in a store. These devices are designed to be managed remotely by maintenance technicians from Danfoss or authorized service providers. They speak to each fridge, freezer and display case in the store, forming a central nervous system for the cold chain. The controller is convenient for facility managers: a technician can troubleshoot a faulty compressor or adjust setpoints without visiting the store in person.

But convenience and security are often enemies in industrial systems. If an attacker gains access to the controller, they control everything downstream. There is no secondary lock, no air-gapped backup system, and store staff typically have no way to override the automated climate settings in real time. The controller becomes a single point of failure for the entire refrigeration infrastructure.

Danfoss controllers are accessed by maintenance firms over the internet, usually through a web interface or dedicated software. The attackers obtained credentials, likely through one or more of these vectors: phishing emails sent to maintenance personnel, weak default passwords that were never changed, an unpatched vulnerability in the Danfoss software itself, or compromise of a third-party maintenance account that had broad access to multiple sites.

Supply chain attacks on industrial equipment have become common practice. An attacker targeting a retail chain often finds it easier to compromise the equipment vendor or a service provider who has blanket access to hundreds of customer sites. In this case, the attackers may have obtained credentials from Danfoss documentation, a leaked password database, or a compromised service technician account. Once they had valid login credentials and the IP address or domain of the controller, they could log in from anywhere and manipulate the system like a legitimate operator.

According to security research on operational technology networks, industrial control systems in retail and food storage are rarely isolated from the internet or monitored for unauthorized access changes (research by vendors monitoring ICS threats, such as Claroty and Forescout reports on operational technology visibility). This matters because it means attackers can operate inside these systems for hours without alerting defenders. Most supermarket chains do not have continuous monitoring of their SCADA or climate-control networks; alarms are triggered only when a sensor fails or a temperature threshold is crossed, not when a login happens or a configuration is changed.

Law-enforcement agencies and critical infrastructure regulators have warned repeatedly that ransomware and extortion groups are expanding beyond data theft and are now targeting physical infrastructure to cause real-world harm (U.S. CISA and European NIS directives document this trend). Food supply chain attacks are attractive because they cause immediate, visible damage and economic pressure without requiring data exfiltration. Restaurants and supermarkets are less likely to be defended at the infrastructure level than banks or power utilities, making them soft targets.

Third-party remote access is a documented attack surface in industrial settings (academic research on supply chain vulnerabilities in IoT and ICS environments). Maintenance credentials are often shared, reused, or poorly tracked, turning service providers into a weak point in the security chain. The reason this matters to ordinary users is that it affects food availability, prices, and trust in supply chain security.

This incident demonstrates that attackers are no longer confined to stealing data or demanding ransom in cryptocurrency. They can now target the physical systems that keep society functioning: food storage, power distribution, water treatment, and transportation. A supermarket can recover from a data breach; spoiled inventory is harder to replace on short notice. The attack also reveals a governance gap: retailers often have better security for their point-of-sale systems and customer databases than they do for the industrial controllers that run their core operations.

The incident serves as a proof of concept. If one group successfully hit hundreds of stores by compromising a single Danfoss controller interface, others will replicate the tactic. Extortionists now have a new leverage point: damage the cold chain, force spoilage, and demand payment to restore operations.

Retailers and facility managers can reduce this risk by implementing the following steps:

1. Segment refrigeration controllers onto a separate network with no direct internet access, using a jump server or VPN gateway as the only remote-access point.
2. Enforce multi-factor authentication on all maintenance accounts and rotate credentials regularly, especially after staff turnover.
3. Change all default passwords and disable unused user accounts on climate-control systems immediately upon installation.
4. Monitor login attempts and configuration changes to climate controllers in real time, with alerts for off-hours access or unusual patterns.
5. Coordinate with Danfoss and maintenance providers to receive security patches and vulnerability notifications promptly.
6. Implement manual override capabilities so store staff can recover from a compromised controller without waiting for remote support.

For ordinary users, the lesson is that retail supply chains depend on industrial systems that are often less secure than the websites and apps we use daily. Supermarket security is not just about cameras on the floor; it includes the security posture of equipment vendors and their maintenance partners.

What is a Danfoss climate controller? It is an industrial refrigeration management system that monitors and controls temperatures across all fridges, freezers and cold displays in a store, usually with remote access for maintenance technicians.

Could this attack have been prevented with better passwords? Partially. Weak credentials were likely one vector, but the core issue is that remote access to critical infrastructure is often not isolated, monitored or defended as aggressively as it should be.

Is this the first time a supermarket refrigeration system has been attacked? No. Physical infrastructure attacks on retail and food storage have been documented in security incident reports, but this appears to be one of the largest coordinated incidents against a supermarket cold chain in France.

How long does it take to spoil food at 50°C? Most perishable food begins to deteriorate rapidly within a few hours at that temperature, becoming unsafe or unusable within 4-8 hours depending on the product.

What should I do if I suspect my local supermarket's refrigeration has been compromised? Notify store management and avoid purchasing refrigerated items that may have been exposed to temperature fluctuations. Food safety authorities in your country can investigate if multiple stores report similar incidents.

Source: The Hacker News