Key takeaways
- Attackers forced defrost cycles on Danfoss refrigeration controllers, pushing temperatures as high as 50°C at stores across France.
- Intermarché said 150 stores were hit and Carrefour said 80, with French outlets estimating 250 to 350 stores in total.
- The Paris prosecutor's office opened an investigation, and it is still unknown how the controllers were accessed.
A supermarket cyberattack in France turned refrigerators into heaters overnight, forcing stores to throw out food and pushing prosecutors to open a criminal case. Attackers took control of refrigeration controllers at hundreds of stores belonging to some of the country's biggest grocery chains on Sunday night, October 11, and triggered defrost cycles that sent temperatures soaring, according to reports from BleepingComputer and Infosecurity Magazine.
It is one of the clearest recent examples of a hack that leaves the screen and lands in the physical world. No ransom note, no stolen passwords, just spoiled yogurt, warm freezers and empty shelves on a Monday morning.
What happened in the French supermarket cyberattack
The intrusions targeted refrigeration control systems made by Danfoss, the Danish company whose equipment manages cooling in many food retail stores. BFMTV first reported the Danfoss link, and an Intermarché spokesperson later confirmed it to Infosecurity Magazine.
According to those reports, the attackers went after stores running outdated versions of Danfoss refrigeration control software. These consoles could be operated remotely, and the communication channel was not properly secured. Once inside, the attackers used a feature that every commercial fridge already has: the automatic defrost cycle. By forcing defrost mode, they pushed temperatures as high as 50°C (122°F), BFMTV reported.
BleepingComputer said it is still unknown how the attackers first got access to the controllers.
Which chains were hit
Reports name a long list of familiar French grocery brands:
- Coopérative U, which runs Hyper U, Super U, U Express and Utile stores
- Intermarché, part of Groupement Mousquetaires
- Carrefour, mostly its Carrefour Market supermarkets
- E. Leclerc, France's largest supermarket chain
- Monoprix
Infosecurity Magazine also reported that supermarkets in Belgium and the Netherlands may have been affected.
How many stores
French outlets cited by BleepingComputer put the total at 250 to 350 stores. An Intermarché spokesperson told Infosecurity Magazine that 150 of its stores were affected, and a Carrefour spokesperson said the incident mainly touched 80 supermarkets out of its roughly 6,000 locations.
The cost so far
The financial damage is still being counted. BFMTV reported that just two stores in Haguenau, in the Alsace region near the German border, lost about €270,000 (around $302,000) worth of merchandise. Intermarché said it could not yet estimate how much food would be wasted and that its legal and insurance teams were already looking into the losses.
Dominique Schelcher, who leads Coopérative U, confirmed the attack in a post on X on October 12. He said the refrigeration systems in several of the group's stores had been affected since the night before, that teams were working with refrigeration specialists to get things running again, and that a full investigation would be needed. He called the targeting of food preservation equipment unprecedented and unacceptable.
EU agriculture and food commissioner Christophe Hansen also condemned the attack and named Leclerc as one of the victims, BleepingComputer reported.
Prosecutors open an investigation
The Paris prosecutor's office told AFP it had opened an investigation into what it called a large scale cyberattack affecting the refrigerators of several major food retail chains. According to BleepingComputer, investigators want to identify all of the victims and connect the attack to reported food losses and to fires that broke out.
That last detail matters. A refrigeration system pushed far outside its normal range is not only a food safety problem. Compressors, heaters and wiring are not built to run that way for hours, which is why the prosecutor's mention of fires stands out.
Why this attack matters
Most people think of cyberattacks as data breaches or ransomware that locks up computers. This one is different. It shows how building and equipment controls, often installed years ago and rarely updated, can be turned against the businesses that rely on them.
Danfoss products have had serious security flaws before. Infosecurity Magazine listed several, including CVE-2023-25915, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452. In May 2025, the US Cybersecurity and Infrastructure Security Agency (CISA) warned about CVE-2025-41450, a high severity authentication bypass in the Danfoss AK-SM 8xxA series, a platform that manages refrigeration and HVAC in food retail. Neither outlet has confirmed that any of these flaws was used in the French attack.
Researchers had also shown how bad things could get. At DEF CON 34 in August 2026, Claroty's Team82 showed that a compromised Danfoss AK-SM 800A controller could switch off cooling while sending fake temperature readings, according to Infosecurity Magazine. In other words, a store could believe its cold chain was fine while food was quietly warming up.
The pattern will sound familiar to anyone who followed the recent wave of attacks on network gear. Old devices that face the internet and no longer get patches are an easy target, as we saw with the Citrix NetScaler zero days and the flood of bugs found in connected devices at Pwn2Own Ireland 2026.
Who is affected
The most direct victims are the stores and their staff, who had to deal with warm cases, spoiled stock and shoppers walking into empty aisles. Food suppliers may also feel it if orders are disrupted while stores restock.
For shoppers, the main risk is food safety. Stores that lost refrigeration should remove anything that sat at unsafe temperatures. If you shop at an affected chain in France, Belgium or the Netherlands and something chilled seems off, do not take the chance.
US readers are not directly affected, but the equipment involved is sold worldwide. Grocery stores, restaurants, cold storage warehouses and pharmacies everywhere use networked refrigeration and HVAC controllers.
A separate incident at Ahold Delhaize
On Monday, Ahold Delhaize, the parent company of several US grocery brands, said it had taken some systems offline after a cybersecurity incident. BleepingComputer noted there is no evidence so far that this is linked to the French refrigeration attack.
What businesses should do now
Security teams and store operators who run connected cooling or HVAC equipment can take a few practical steps today:
- Find every controller. Make a list of refrigeration and building management devices, including the software version each one runs.
- Take them off the open internet. Remote access should go through a VPN or another secure gateway, never a console exposed directly to the web.
- Update or replace. Apply vendor firmware updates. Devices that no longer get security fixes should be isolated or replaced.
- Change default credentials. Use strong, unique passwords and turn on multi factor login where the system allows it. Our guide to protecting your online accounts in 10 minutes covers the basics.
- Watch temperatures independently. A separate sensor that is not tied to the main controller can catch a problem even if the controller is reporting false readings.
Homeowners can take a smaller lesson from this. The same logic applies to smart thermostats, cameras and routers. Keep them updated and avoid exposing them to the internet without a reason, a point we also make in our smart home starter guide.
What to watch next
Several questions are still open. Investigators have not said who was behind the attack or how the controllers were reached. Danfoss had not commented when Infosecurity Magazine published its report. The final count of affected stores and the total cost of lost food are still unclear.
Danfoss had planned to show a drive with what it calls integrated cybersecurity features at the Chillventa trade fair in Nuremberg on October 13, Infosecurity Magazine reported, so the company may face questions there.
For more on attacks, breaches and the security news that affects your devices, visit our tech section.
Frequently asked questions
What happened in the French supermarket cyberattack?
Attackers took control of Danfoss refrigeration controllers at grocery stores across France on the night of October 11 and forced defrost cycles that pushed temperatures as high as 50°C, spoiling food.
Which supermarkets were affected?
Reports name Coopérative U stores (including Super U and Hyper U), Intermarché, Carrefour, E. Leclerc and Monoprix. Stores in Belgium and the Netherlands may also have been hit.
Was a known Danfoss vulnerability used?
That has not been confirmed. Danfoss products have had several published flaws, but reports say it is still unknown how the attackers got access.
Could this happen in the United States?
The same type of networked refrigeration and HVAC equipment is used in US stores and warehouses. Outdated controllers that are reachable from the internet carry the same kind of risk.
Share this story
Spotted an error? Tell us
