The cyberattack triggers forced defrosting, spoiled food, and fires, exploiting outdated refrigeration controllers across multiple European retail chains
From Sunday, 11 October 2026 into Monday, 12 October, hackers remotely took control of refrigeration systems at hundreds of French supermarkets overnight, heating fridges and freezers, forcing retailers to discard fresh and frozen food, and causing small fires at some locations, according to an AFP report.
Paris prosecutors have opened an investigation into what they described as “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France.”
The episode highlights a growing risk to food supply chains: refrigeration equipment that once operated in isolation can now be reached and manipulated remotely, potentially turning essential store infrastructure against the retailers that depend on it. No group has claimed responsibility for the attacks, according to CBS News.
BFM TV has reported that the attackers “managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores.” Also:
- Intermarché has told Reuters that its units rose to 50 degrees Celcius for six hours, after which the chain discarded all affected food.
- According to AFP, at least 300 Intermarché and Netto stores, more than 100 Coopérative U locations, and several E Leclerc outlets had been targeted.
- A Mousquetaires spokesperson has told the BBC that 180 Intermarché and Netto stores were affected, while another 100 were urgently disconnected from the internet.
- Carrefour said 80 of its 6,000 stores had been hit.
- Monoprix has said roughly 5% of its more than 400 stores have been affected.
- BFM TV reported that two supermarkets in Haguenau, in the Alsace region, had lost a combined €270,000 worth of goods.
- Coopérative U CEO Dominique Schelcher has written on X that attacks on equipment “essential to the preservation of fresh products and to the food supply of the French people” were extremely serious, unprecedented, and unacceptable
Device vulnerabilities exploited
The attack had targeted refrigeration control systems made by Danish manufacturer Danfoss, which said the most affected units were legacy products, including AK-SM800 and AK-SC355 systems that had reached end of life and no longer receive software or security updates.
The firm added that affected AK-SM800A units were running outdated firmware. Notably, in August this year, Claroty’s researchers had disclosed vulnerabilities in AK-SM 800A controllers, and Danfoss had issued patched firmware. Predicta Lab CEO Baptiste Robert had identified 2,752 Danfoss systems exposed online on Monday, including 1,590 in France, according to CBS News.
The office of Prime Minister Sébastien Lecornu has said France’s cybersecurity agency, ANSSI, had identified a vulnerability in the vendor’s software and was coordinating with European counterparts because other countries could also be affected.
Separately, Ahold Delhaize has reported a “security issue” affecting stores in the Netherlands and Belgium and has taken its refrigeration systems offline, although it saw no connection to the French attacks. The incident follows President Emmanuel Macron’s order, one month earlier, for measures to protect critical infrastructure from Russian “hybrid attacks.”
EU food commissioner Christophe Hansen has condemned the attack on X, writing that food security requires greater attention because “the weaponisation of food has become a reality.”
