A cyberattack targeting Danfoss-made refrigeration control systems has struck multiple major French supermarket chains, reportedly forcing cooling units into a continuous defrost cycle at 50 degrees Celsius. The attack, which began overnight Sunday, has hit stores in the Intermarché, Leclerc, and Coopérative U networks. It represents a direct assault on operational technology — the physical infrastructure that keeps food cold — rather than the customer-facing IT systems that typically make headlines. Coopérative U president Dominique Schelcher confirmed the attack Monday morning, calling it "extremely serious" and saying teams had been mobilized to address the issue. The disruption extends beyond refrigeration: electronic shelf labels and delivery logistics systems are also reportedly affected, suggesting the attackers either found a shared control network or executed a coordinated multi-vector campaign. The single-vendor dependency is the structural story here. Danfoss refrigeration controllers appear to be the common thread across all three retail chains. When one vendor's control systems serve as the backbone for perishable food storage at scale, a vulnerability in that vendor becomes a vulnerability in the food supply chain. This is a monoculture problem — the same class of risk that hit SolarWinds in IT now manifesting in operational technology. The 50°C defrost setting is not a nuisance — it is potentially destructive. Prolonged exposure at that temperature can spoil entire cold chains, from dairy to meat to pharmaceuticals stored in supermarket fridges. The financial cost will be measured not just in immediate spoilage but in consumer confidence and the insurance and compliance fallout that follows. The incident exposes a gap in how European retail infrastructure is secured. Refrigeration systems, electronic shelf labels, and delivery logistics are increasingly networked, but they often sit outside the security perimeter that protects payment systems and customer data. These are industrial control systems (ICS) bolted into commercial environments without the hardening that utilities or manufacturing plants receive. Attribution remains unknown, and the article provides no detail on the attack vector — whether this was a supply-chain compromise of Danfoss firmware, an exploit of exposed network interfaces, or a targeted intrusion through retailer IT networks that pivoted to OT. The absence of detail this early is normal, but the response speed and scope will matter enormously for what comes next. The broader signal is unmistakable: critical infrastructure is no longer limited to power grids and water treatment. The cold chain that keeps food safe from warehouse to shelf is infrastructure, and it is now a proven attack surface.
