French supermarket cyberattack: hackers heated fridges at hundreds of stores via outdated Danfoss controllers

Overnight from Sunday, October 11 to Monday, October 12, 2026, attackers took control of the refrigeration systems in hundreds of French supermarkets. Fridges and freezers were driven to temperatures as high as 50°C, and stores had to throw away their fresh and frozen food. The Paris prosecutor's office called it a "large-scale" attack on "connected refrigerators in several major food retailers across France," Reuters reported, and said it caused "food losses and fires." Networked cooling controls like these run facilities from grocery stores to datacenters.

This report is based on Reuters, AFP and Bloomberg reporting, company statements to the press, and CISA and Danfoss advisories, checked October 12, 2026. Figures are still moving.

The short version

• When: the night of October 11–12, 2026.
• What: attackers remotely changed refrigeration settings. Les Mousquetaires, which owns Intermarché, told Bloomberg that fridges ran at 50°C for about six hours.
• Who was hit: Intermarché and Netto, Coopérative U (Super U and U Express), E.Leclerc, Monoprix and Carrefour stores, according to the companies and press reports.
• Equipment: refrigeration controllers from the Danish company Danfoss. Danfoss says the affected units ran outdated firmware.
• Response: the Paris prosecutor opened an investigation. Reuters reported that Prime Minister Sébastien Lecornu asked France's cybersecurity agency, ANSSI, to investigate.
• Unknown: how the attackers got in, who they are, and the total losses.

What happened overnight?

According to the retailers, attackers changed temperature settings remotely during the night. BFMTV reported that they triggered a forced defrost (dégivrage forcé). A Les Mousquetaires spokesperson told Bloomberg the cooling systems were set to defrost and that temperatures reached 50°C for roughly six hours. Intermarché told AFP that affected stores must throw out all the fresh and frozen products concerned, and that insurance doesn't usually cover this kind of incident. AFP also reported that no data was stolen.

Dominique Schelcher, CEO of Coopérative U, called the attack "unprecedented" and of "extreme gravity" in a post on X, and said teams were working with refrigeration engineers to get stores running again.

How many stores were affected?

The counts come from the companies themselves, and several changed during the day.

Last verified: October 12, 2026

Added together, the companies' own figures come to more than 400 stores. That is well above the 150–300 range in early reports, because the counts grew during the day and some chains confirmed late. There is no official national total yet. Trade site Je bosse en grande distribution and BFMTV mentioned other banners, including Metro and independent shops, but those weren't confirmed by the companies. E.Leclerc and Auchan didn't respond to Reuters' requests for comment.

What does Danfoss say?

Danfoss told Reuters it is "aware of incidents in France affecting a limited number of refrigeration management systems" and that the affected units "were running outdated firmware." It said it had "long advised customers to keep supported systems updated with the latest firmware" and to move legacy systems "to current-generation solutions."

Danfoss told AFP that most affected units are older models, notably the AK-SM800 and AK-SC355 system managers. It said these have reached end of life and no longer receive software or security updates. Les Mousquetaires said the refrigeration systems were managed by Danfoss and that the supplier is responsible for filing a complaint, Bloomberg reported. As of October 12, Danfoss's public security-advisory page had no notice about the incident.

Were known Danfoss vulnerabilities used?

That hasn't been established. A source close to the prime minister told Reuters that ANSSI had found a vulnerability in Danfoss software, but didn't say which one.

There is a documented history. On May 20, 2025, CISA published an advisory for an authentication bypass in Danfoss's newer AK-SM 800A series (CVE-2025-41450), fixed in version R4.2. Danfoss's own advisories also cover command-injection flaws fixed in version 4.3.1. In August 2026, Claroty's Team82 published research on those flaws and reported finding 2,765 AK-SM 800A management interfaces exposed to the internet in a Censys scan.

Those advisories cover the AK-SM 800A, not the older AK-SM800 and AK-SC355 that Danfoss says made up most of the affected units. Neither the retailers nor Danfoss have said how the attackers got access. Treat any link to a specific CVE as unconfirmed.

What are the authorities doing?

• Paris prosecutor: opened an investigation on its own initiative, handled by its anti-cybercrime section and assigned to the Office anti-cybercriminalité (OFAC). It aims to identify the victims and link them to the reported losses.
• Government: Reuters reported that Prime Minister Lecornu instructed ANSSI to investigate, that France is coordinating with European counterparts because other countries may be affected, and that officials are checking whether other French companies are at risk. The ministry responsible for commerce said it was in contact with the retailers.
• Industry: Snefcca, the French refrigeration trade body, alerted the interior and economy ministries at the first warnings, according to the trade publication La RPF.

On the same day, Ahold Delhaize reported a separate "cybersecurity incident" that disrupted Albert Heijn's online orders in the Netherlands. Reuters said it was unclear whether the two incidents are linked.

What should operators of connected equipment do?

The recommendations in CISA's and Danfoss's advisories apply to any networked controller, from store refrigeration to building and datacenter cooling:

• keep control-system devices off the public internet;
• put them behind firewalls, separated from business networks;
• use an up-to-date VPN for remote access;
• install supported firmware, and replace end-of-life units that no longer get security fixes.

For a parallel in AI infrastructure from the same week, see how the PoeLLM botnet hijacked exposed AI servers. For how the UK is responding to AI-era cyber risk, see our report on its new AI security push. For the scale of the cooling systems behind AI, see the gigawatt datacenter race.

What's confirmed, reported and uncertain

• Confirmed by the companies or the prosecutor:
  • the overnight timing
  • store counts from Les Mousquetaires, Coopérative U, E.Leclerc, Monoprix and Carrefour (as given to AFP, Bloomberg and Reuters)
  • the prosecutor's investigation and its report of fires
  • Danfoss's statements that the affected units ran outdated, mostly end-of-life firmware
• Reported:
  • the forced-defrost method (BFMTV)
  • Lecornu's instruction to ANSSI, and ANSSI finding a Danfoss vulnerability (Reuters, citing a source close to the prime minister)
  • the 50°C for six hours figure (Les Mousquetaires, via Bloomberg)
• Unknown:
  • the attackers' identity and motive (no group had claimed responsibility in the sources reviewed)
  • how they got access
  • the total financial losses (estimates of "several million euros" are unattributed)
  • whether stores outside France were affected