France supermarket cyberattack fridges
No ransom note. No stolen data. Just hundreds of French supermarkets waking up to spoiled food, millions in losses — and a few fires — after attackers hijacked the fridges themselves.
Overnight between Sunday and Monday, hackers hijacked refrigeration controllers at French supermarket chains across the country, forcing continuous defrost cycles with temperature setpoints reportedly pushed to 50°C — 122°F — for roughly six hours. The attack hit an estimated 250 to 350 stores: around 150 to 200 Intermarché outlets, about 100 Coopérative U stores, and locations from chains including E. Leclerc, Carrefour Market, Monoprix, and Auchan. Fresh and frozen stock spoiled en masse, all of it ordered destroyed over sanitary risk, and in some stores the overheated equipment sparked fires. The Paris prosecutor's cybercrime division has opened a criminal investigation, and Prime Minister Sébastien Lecornu has tasked France's cybersecurity agency ANSSI with the response.
Why this matters
Most cyberattacks you read about steal data or lock files for ransom. This one did something different and, in a way, more alarming: it reached through the network and broke things in the physical world. The attackers did not touch payment terminals or customer databases. They went after the operational technology — the controllers that keep food cold — and turned a safety feature, the defrost cycle, into a weapon. A refrigerator forced to hold a 50°C setpoint for six hours is not a malfunctioning appliance; it is a heater full of food, and in some stores it became a fire hazard.
That shift — from data crime to physical sabotage — is the story. Security researchers have warned for years that industrial controllers are the soft underbelly of modern infrastructure: built for reliability, not security, often running outdated software, and increasingly connected to networks for remote management. This weekend, that abstract warning became several million euros of rotting food across France. The head of Coopérative U, Dominique Schelcher, called the attack "unprecedented" and "of extreme gravity," and said targeting equipment essential to feeding the French public was "unacceptable." EU agriculture and food commissioner Christophe Hansen condemned the attack and named Leclerc among the victims. When a cyberattack on fridges draws condemnation from a European commissioner, the category has officially changed.
What happened: the scale of the damage
The attack was detected overnight on October 11–12. Intermarché's owner, Les Mousquetaires, confirmed about 150 stores affected; French outlets put the Intermarché figure at 150 to 200. Coopérative U — which runs Hyper U, Super U, U Express, and Utile — confirmed around 100 of its stores were hit, with Schelcher announcing it publicly on Monday morning and saying teams were working with refrigeration specialists to restore normal operations. Reports also named E. Leclerc, Carrefour Market, Monoprix, and Auchan locations among the victims, bringing the commonly cited total to between 250 and 350 stores nationwide. No Intermarché stores in Belgium were reported affected, suggesting the campaign was aimed specifically at French infrastructure.
The financial damage is still being tallied, but the early numbers are stark. Two stores alone — an Intermarché and a Super U in Haguenau, Alsace, near the German border — recorded about €270,000 (roughly $302,000) in destroyed merchandise. Extrapolate even conservatively across hundreds of stores and national losses run into the millions of euros. Every gram of affected fresh and frozen food is being discarded: once the cold chain breaks, food safety rules leave no room for judgment calls, and retailers cannot legally sell stock that spent hours at unsafe temperatures. An Intermarché spokesperson told reporters it was not yet possible to estimate the total food waste, and said the company's legal and insurance teams had begun investigating.
How they got in: outdated controllers, abused by design
According to French broadcaster BFMTV and multiple security outlets, the attackers targeted outdated versions of refrigeration control software from Danfoss, the Danish manufacturer whose controllers are widely deployed across French retail. The compromised systems were Danfoss consoles with remote-control capabilities that lacked adequately secured communication channels — in plain terms, controllers reachable from the network without proper protection. Once inside, the intruders did not need exotic malware. They abused a legitimate function: the automatic defrost cycle, normally run briefly to clear ice buildup, was forced to run continuously with the temperature setpoint cranked to around 50°C. The equipment did exactly what it was told. That is the signature of an operational-technology attack — no software bug required, just legitimate commands issued by illegitimate operators.
The unsettling part is that this exact scenario was demonstrated publicly two months ago. At DEF CON 34 in August 2026, researchers from Claroty's Team82 showed that Danfoss AK-SM 800A controllers could be compromised to disable cooling while falsifying temperature readings — meaning operators would see normal numbers on their dashboards while the food warmed. Danfoss products have also been associated with several reported vulnerabilities, including CVE-2023-25915 and CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452, which could allow privileged access and manipulation of physical equipment. That CVE link must be stated carefully: the vulnerabilities have been reported in connection with Danfoss products, but none has been confirmed as the entry point for this specific attack. What is confirmed is the pattern — internet-reachable controllers running old software — which needed no zero-day to exploit.
A second incident across the border
France may not be alone. Dutch retail group Ahold Delhaize — owner of Albert Heijn and Delhaize — reported a separate "security issue" over the weekend and took systems offline: the Albert Heijn app and delivery services went down and electronic price tags displayed wrong prices. It is not yet established whether the Dutch incident is connected to the French refrigeration attacks or a coincidence of timing, and the company has not attributed it. But investigators and European counterparts are now coordinating precisely because the attack method — commodity controllers, remote access, physical effects — is portable. The same Danfoss equipment sits in supermarkets across Europe. France's government said it is working with European partners as other countries may be affected.
The response: prosecutors, ANSSI, and Brussels
The official reaction has been swift and unusually high-level for a retail cyberattack. The Paris prosecutor's office told AFP it opened an investigation into "the large-scale cyberattack affecting the refrigerators of several major food retail chains across France," tasked with identifying the victims and establishing the link between the intrusion and the reported damage — the food losses and the fires. Prime Minister Lecornu assigned ANSSI, France's national cybersecurity agency, to the case. The framing matters: this is being treated not as a commercial IT incident but as an attack on essential infrastructure, with the criminal inquiry explicitly connecting the network intrusion to physical destruction.
That framing has consequences. Under French law, cyberattacks causing physical damage and endangering food safety sit in a different category from data breaches, with heavier penalties and broader investigative powers. The European coordination adds another layer: if the same controllers are compromised in other member states, the incident becomes a test case for the EU's NIS2 cybersecurity directive, which imposes security obligations on essential and important entities — including, arguably, the food retail chains that feed tens of millions. Retailers' legal and insurance teams are already circling, and the liability questions will be thorny: was Danfoss responsible for shipping insecure-by-default remote management? Were the chains negligent in running outdated software on internet-reachable controllers? Were integrators who installed the systems supposed to segment them from the network? Expect those questions to be litigated for years.
Who loses, who gains, and what the critics say
The losers are obvious and numerous. The supermarket chains absorb millions in destroyed stock, emergency remediation, and reputational damage — customers do not love learning their grocer's freezers were remotely hijacked. Insurers face a new category of claim: cyber-physical food spoilage, which most retail cyber policies were not clearly written to cover. Shoppers in affected areas faced disrupted stores and discarded stock. And Danfoss, named in every report as the vector, takes a reputational hit regardless of where fault ultimately lands — "outdated Danfoss software" is now a phrase attached to burning freezers.
The winners, such as they are, are the operational-technology security vendors who have spent years warning that industrial controllers are exposed. Claroty's August demonstration looks prescient now, and every CISO with connected refrigeration, HVAC, or manufacturing equipment just got budget leverage. There is also a grim commercial logic for the attackers, whoever they are: no ransom demand has been reported and no group has claimed responsibility, which points away from financially motivated ransomware and toward either sabotage, a demonstration of capability, or an operation whose payoff is not public. Attribution is the great unknown, and investigators have said nothing publicly about who is behind it.
The critics' question is the one the industry least wants to answer: why were refrigeration controllers remotely reachable at all? Remote management of store equipment is convenient — a technician can adjust hundreds of stores from a desk — but every remote console is an attack surface, and "outdated software" on a food-safety-critical controller is a choice, not an accident. The DEF CON demonstration in August gave the entire industry two months' notice that these controllers could be weaponized. Somebody, somewhere, decided patching and network segmentation could wait. This weekend was the bill coming due.
What happens next: three scenarios
1. Containment and hardening. The most likely near term: ANSSI and the chains identify the entry point, push emergency patches, pull controllers off open networks, and the incident becomes an expensive lesson. Expect a wave of OT security audits across European retail, and expect Danfoss to ship hardened updates under intense scrutiny. The insurance industry will rewrite retail cyber policies to price physical-effect attacks explicitly.
2. Copycats and escalation. The attack method is now public knowledge, and the barrier to entry is low — no zero-day required, just scanning for exposed controllers. Copycat attacks on other chains or other countries are a real risk in the coming weeks, which is why the European coordination matters. Watch for disclosures from retailers in neighboring countries and for ANSSI or EU advisories naming specific Danfoss versions to patch.
3. Attribution with geopolitical weight. If investigators attribute the attack to a state actor, the incident escalates from crime to confrontation — sabotage of food supply infrastructure is the kind of act that draws sanctions or worse. The absence of a ransom demand keeps this scenario alive. Watch for careful official language in the coming days: governments signal attribution through word choice long before they name names.
The deeper lesson is structural. The modern supermarket is a network of computers that happens to sell food — controllers, sensors, price tags, apps, logistics — and its security posture was built for an era when the worst case was a stolen credit card database. This weekend proved the worst case is now a warm freezer. Every industry with connected physical equipment just got the same memo France received at 50 degrees Celsius: the network is the factory floor now, and it needs to be defended like one.
Related coverage
Sources
- BleepingComputer — Cyberattack shuts down refrigerators at French supermarkets (October 12, 2026)
- Reuters (via krro.com) — French supermarket chain Intermarché hit by cyberattack, 150 stores targeted (October 12, 2026)
- hwbusters — Supermarket cyberattack hijacks fridge controls across France, running defrost cycles at 50°C (October 12, 2026)
- ZeroHedge — Cyberattack disrupts refrigeration systems at hundreds of French supermarkets (October 12, 2026)