The short answer: Overnight on October 11-12, 2026, attackers seized remote control of Danfoss refrigeration controllers in roughly 500 French supermarkets and forced the systems into continuous defrost mode at 50°C (122°F), spoiling fresh and frozen food worth millions of euros. Paris prosecutors and the national cybersecurity agency ANSSI are investigating; no group has claimed responsibility.
What Happened Overnight on October 11-12
Charles Dezon, who owns an Intermarché supermarket in Gradignan in southwestern France, had never imagined throwing away nearly a dumpster’s worth of frozen food because of a cyberattack. Yet that is exactly what he faced on the morning of Monday, October 12, 2026.
His store was one of hundreds across France hit by a large-scale cyberattack that targeted refrigeration systems overnight from Sunday to Monday. According to BFMTV, which first reported the attack, the intrusion was probably launched around 11 pm. It went unnoticed for hours. Dezon told Le Monde that staff only realized something was wrong at 4 am, when a delivery driver found the storeroom flooded. The cold room had reached 50°C (122°F), hot enough to set off the sprinkler system.
The attackers had not just raised the temperature. They extended the defrost cycle from one hour to eight hours, delaying the alarms that would normally alert staff. The tactic bought the attackers time and multiplied the damage. At an Intermarché in La Haye, Normandy, some equipment reportedly melted as temperatures climbed toward 80°C (176°F).
Which Stores Were Hit
Early estimates put the total at roughly 400 to 500 stores out of about 15,000 supermarkets in France. The reported numbers, compiled from BFMTV, AFP, the BBC and Le Parisien, break down like this:
- Intermarché and Netto: at least 300 stores (both brands belong to Groupement Mousquetaires; Les Mousquetaires said fridges at around 150 of its stores ran at 50°C for six hours overnight)
- Coopérative U (Super U, Hyper U): about 100 stores
- Carrefour: 80 of its roughly 6,000 stores
- E.Leclerc and Monoprix: named as affected, with Monoprix reporting problems at about 5% of its roughly 490 stores
- Picard: not affected; the frozen-food chain controls its cooling store by store, so remote takeover is not possible
Figures remain estimates, and the national count may rise as assessments continue.
How the Attack Worked: A Forced Defrost at 50°C
The attackers went straight for the equipment that keeps food safe. Instead of hitting payment terminals or customer data, they took over refrigeration-regulation controllers supplied by Danish engineering firm Danfoss, which let retailers monitor and manage cold units remotely.
They forced the systems into continuous defrost mode with the temperature setpoint fixed at 50°C. Defrost cycles are a routine part of refrigeration: they run briefly, usually overnight, to clear frost from evaporator coils. In this attack, the heaters stayed engaged for hours, turning freezers and cold rooms into warming cabinets.
Intermarché told Reuters, via the BBC, that its fridges ran at 50°C for six hours. BFMTV showed an ice cream aisle at 26.5°C. Staff arriving Monday morning opened freezer doors and met a wave of hot air.
Security analysts note the attack’s simplicity. No sophisticated malware was required. Access to the controllers alone was enough to issue the destructive commands. The remote management feature, convenient for operators who manage thousands of stores centrally, became the attackers’ entry point.
The Danfoss Controllers and the Unpatched Flaws
Danfoss confirmed that the incidents involved older models of its controllers, including the AK-SM800 and AK-SC355 series. The company told BFMTV and Le Parisien that the affected units had reached end of life and no longer received software or security updates, so they could not be patched against a risk the company had already identified.
Warning signs were public. On August 9, 2026, researchers at Claroty’s Team82 published an analysis of the Danfoss AK-SM 800A titled “Freeze the Controller, Defrost the Food.” They described a hidden code-of-the-day login mechanism that could bypass authentication entirely, and reported finding thousands of publicly accessible management interfaces on the internet.
Three CVEs cover the AK-SM 8xxA series:
- CVE-2025-41450: authentication bypass, CVSS 8.2 (fixed in firmware 4.2)
- CVE-2025-41451: remote code execution after login, CVSS 8.7 (fixed in 4.3.1)
- CVE-2025-41452: web server configuration injection after login, CVSS 6.8 (fixed in 4.3.1)
Neither Danfoss nor ANSSI has named the exact flaw used in this attack. Le Parisien reported that the attackers exploited a vulnerability documented in the summer and left unpatched in old software versions. How the attackers reached the controllers, whether through a central management platform or weak remote-access credentials, remains under review.
The Damage: Spoiled Food, Lost Money and Fires
No national loss figure exists yet, but the local numbers are stark. Two supermarkets in Alsace, an Intermarché and a Super U in Haguenau, reported €270,000 in losses between them, according to BFMTV. Ouest-France reported €60,000 in losses at one Super U in Maine-et-Loire. Dezon’s Intermarché in Gradignan lost €21,000 at purchase price, confirmed by a bailiff. Nationwide, the bill could reach several million euros.
Stores had to empty entire freezers and throw away every affected product. Breaking the cold chain means food can no longer be guaranteed safe, so retailers discarded whole stocks of meat, dairy, vegetables and frozen goods. Some stores, like the Intermarché in Haguenau, stayed closed through Monday morning while shelves were cleared. A Hyper U in Bourgueil told customers no fresh products would be on sale that day.
The Paris prosecutor’s office also confirmed that fires broke out at some locations, apparently from overheated units. Beyond the money, the food waste on this scale carries environmental and disposal costs that will take weeks to tally.
How France Responded
The response moved fast. On Monday, the Paris prosecutor’s office opened an investigation on its own initiative into what it called a large-scale cyberattack affecting refrigerators at major food retail chains across France. The case was handed to the national anti-cybercrime office.
Prime Minister Sébastien Lecornu asked ANSSI, the national cybersecurity agency, to take up the case. His office said ANSSI had found a vulnerability in software supplied by a Danish company and was coordinating with European counterparts because other countries could be affected.
At the European level, Food Commissioner Christophe Hansen condemned the hack on X, saying food security required more attention at every level and that the weaponization of food had become a reality.
Coopérative U chief executive Dominique Schelcher posted on X early Monday confirming the attack on his network’s cold-production equipment and calling it extremely serious and unprecedented, unacceptable to target equipment essential to the French food supply.
Why This Attack Stands Apart
Most cyberattacks steal data or demand ransom. This one simply destroyed value. No ransom demand has been reported, and no group has claimed responsibility, according to every major outlet covering the story. That leaves the motive an open question: a criminal demonstration, an ideological statement about food systems, or a test run for something larger.
The incident also exposes how thin the defenses are around operational technology in retail. Supermarkets run thousands of sensors and controllers to keep food at precise temperatures. Many connect to central platforms for efficiency, and in an industry with thin margins, legacy installations resist quick, expensive upgrades. Danfoss has urged customers to review their deployments and move to newer systems, but installed bases change slowly.
As analysts have pointed out in similar cases, the same pattern applies across industrial control systems in energy, manufacturing and logistics. A compromise at a single supplier level can ripple across an entire sector. For a related look at how attackers are weaponizing everyday infrastructure, see our coverage of the Warlock ransomware campaign that turned one unpatched SharePoint server into a nine-day network takeover.
Could It Happen Elsewhere?
Authorities are not ruling that out. France said it was coordinating with European counterparts to assess whether other countries could be affected. Felix Aime, a senior cyber threat intelligence analyst at Sekoia, said Spain, Portugal, Poland, Germany and Belgium had also been affected. Help Net Security reported that Ahold Delhaize stores faced a separate security issue disrupting operations.
For shoppers, the practical fallout is limited: by Monday afternoon many stores had restored cooling and new stock was arriving. Intermarché advised stores to keep affected systems disconnected from the network while restoration work continued. Retailers say prices could rise locally if supply tightens, and emptied aisles may take days to refill.
The longer lesson is for every business wiring software into physical equipment. As the Zammad zero-day case and the SonicWall SMA 1000 SSRF flaw both showed, operational systems increasingly sit where outsiders can reach them. Three questions now belong in every audit: which devices can be controlled from outside the building, which settings can a remote session change, and who gets alerted when a setpoint changes overnight. If the answer to the third is nobody, the next attack will look a lot like this one.
Frequently Asked Questions
What happened in the French supermarket cyberattack?
Overnight on October 11-12, 2026, attackers remotely took control of Danfoss refrigeration controllers in roughly 500 French supermarkets, forced the systems into continuous defrost at 50°C (122°F), and spoiled fresh and frozen food worth millions of euros. The attack was first reported by BFMTV and later covered by the BBC, Reuters, Le Monde and The Guardian.
Which supermarket chains were affected?
Intermarché and Netto (at least 300 stores), Coopérative U including Super U and Hyper U (about 100), Carrefour (80), plus E.Leclerc and Monoprix locations. Picard was not affected because it controls cooling store by store, with no remote access.
How did the hackers control the fridges?
They seized Danfoss refrigeration-regulation controllers, older models at end of life that no longer received security updates. They forced a continuous defrost with the temperature setpoint at 50°C and extended the defrost cycle from one to eight hours to delay alarms. The exact vulnerability used has not been publicly named; Danfoss’s AK-SM 8xxA series has three CVEs on record (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452).
How much money did the attack cost?
No national figure has been published. Two supermarkets in Alsace reported €270,000 in combined losses, one Super U in Maine-et-Loire reported €60,000, and one Intermarché owner confirmed €21,000 in losses. Nationwide estimates run into the millions of euros.
Who is investigating, and has anyone claimed responsibility?
The Paris prosecutor’s office opened an investigation through the national anti-cybercrime office, and Prime Minister Sébastien Lecornu asked ANSSI to take up the case. No group has claimed responsibility and no ransom demand has been reported.
Could the same attack hit other countries?
French authorities are coordinating with European counterparts because other countries could be affected. A Sekoia analyst reported effects in Spain, Portugal, Poland, Germany and Belgium, and Ahold Delhaize reported a separate security issue at its stores.