Danfoss Moves To Mitigate Cyberattack

TL;DR

Before you orderOffer from Amazon

Get backup power and energy gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Danfoss says it is working with French supermarket customers after a cyberattack disrupted refrigeration controllers and forced systems into continuous defrost cycles. Reports indicate about 500 stores may have been affected, but the total is unconfirmed; the company says many impacted systems were legacy models or running outdated firmware.

Danfoss says it is working with supermarket customers in France to mitigate a cyberattack on refrigeration controllers that reportedly forced some systems into continuous defrost cycles. Reports suggest around 500 stores may have been affected, but the exact number has not been confirmed, and claims of food losses have not been independently quantified in the available report.

In a statement to the Cooling Post, Danfoss said it was in close contact with affected customers and helping them apply mitigation measures. The company said these may include firmware updates where available, stronger network protections and removing direct internet exposure when applicable. It said it continues to issue firmware and security updates for products that remain supported.

Danfoss said most of the affected units were either legacy products or current products operating with outdated firmware. The report identified the AK-SM800, declared end-of-life in 2021, and the AK-SC355, phased out in 2016, as affected models that no longer receive software or security updates. Some current AK-SM800A systems were also affected while running outdated firmware, according to the company.

The reported attack changed refrigeration settings and put systems into a continuous defrost cycle, raising temperatures in affected stores. The Cooling Post report said millions of euros’ worth of fresh and frozen food had been lost, but the number of stores, scale of damage and value of any losses remain unverified in the source material.

Risks to Store Refrigeration

The incident shows how a cyberattack on operational equipment can disrupt a basic supermarket function, not just digital services. Refrigeration controls help keep perishable food within required temperature ranges; if those controls are altered, stores may face food spoilage, operational disruption and costs associated with checking or replacing stock. The available reporting does not establish the full financial or food-safety impact.

The affected equipment details also point to a practical security issue for operators: unsupported systems cannot receive new security updates, while supported devices may still carry risk if firmware is not current or network access is insufficiently restricted. Danfoss says it has advised customers to update supported systems and migrate legacy equipment, but the report does not say how many affected stores had followed that guidance or how the attackers gained access.

Affected Controller Generations

The Cooling Post report dates the attack to Sunday night but does not give a calendar date in the supplied account. A related report was listed as published on October 12, 2026, describing cyberattackers taking control of refrigeration systems in hundreds of French supermarkets. That report says temperature settings were changed and produce was defrosted; the available source does not provide technical evidence about the method of access.

Danfoss’s response distinguishes between equipment that is no longer supported and newer equipment that may still be supported but was running outdated firmware. The AK-SM800 was declared end-of-life in 2021, while the AK-SC355 was phased out in 2016, according to the report. Danfoss says customers with supported products can continue to receive firmware and security updates. These distinctions matter because the remedies available differ: a supported system may be updated, while a retired model may require stronger network controls or replacement.

“We are working with affected customers to implement appropriate mitigation measures, including firmware updates where available, stronger network protections and removing direct internet exposure where applicable.”

— Danfoss, in a statement to the Cooling Post

Scope and Cause Still Unknown

The precise number of affected supermarkets remains unconfirmed. The report cites incidents suggesting around 500 stores, but Danfoss did not give a total in the supplied statement. It is also unclear how many locations experienced elevated temperatures, how much food was discarded, and whether reported losses in the millions of euros have been independently assessed.

The available material does not identify the attackers, explain how they accessed the controllers, or say whether the attack was contained across all affected networks. It also does not provide a detailed timeline for restoring systems or confirm whether any customers’ operations remain disrupted. No attribution or motive is established in the report.

Customer Mitigation and Updates

Danfoss says it is continuing to work with affected customers on firmware, network protections and internet exposure. The next useful updates would clarify how many sites have been secured, whether any systems remain affected, and whether investigators have determined how the controllers were compromised.

Supermarket operators and relevant authorities may also need to establish the scale of food losses and assess any implications for stock handling. The supplied report does not give a date for a further Danfoss announcement or describe a formal investigation timetable, so those developments remain pending.

Key Questions

What happened to the supermarket refrigeration systems?

The Cooling Post reported that a cyberattack altered refrigeration controller settings, forcing some systems into a continuous defrost cycle and raising temperatures.

How many French supermarkets were affected?

The exact number is unknown. Reports cited by the Cooling Post suggest around 500 stores, but that figure has not been confirmed by Danfoss in the supplied statement.

Which Danfoss systems were involved?

The report identified the discontinued AK-SM800 and AK-SC355 models, as well as some AK-SM800A systems running outdated firmware. Danfoss said most affected units were legacy products or products with outdated firmware.

What is Danfoss doing to respond?

Danfoss says it is working with customers on firmware updates where available, stronger network protections and removing direct internet exposure where applicable. It has not reported how many sites have completed those steps.

Who carried out the attack, and how?

The available report does not identify the attackers or explain how they accessed the refrigeration controllers. The method, motive and full extent of the incident remain unclear.

Source: rss