Cyberattack warms fridges at hundreds of French stores

A cyberattack on the night of October 11-12, 2026 raised the temperature inside fridges and freezers at hundreds of French supermarkets. Many stores had to throw away their fresh and frozen food. The attackers changed settings on refrigeration controllers made by Danfoss, a Danish company. Danfoss says most of the affected devices are old models that no longer get security updates.

What happened in the stores

The attack began overnight from Sunday to Monday. According to Je Bosse en Grande Distribution, a retail trade site, the attackers changed temperature setpoints on Danfoss controllers remotely. A setpoint is the temperature a fridge is told to hold. The site says some settings rose by up to 50 degrees, and one freezer went from -20 °C to +30 °C.

Intermarché's parent group, Les Mousquetaires, told franceinfo that freezers and fridges were set to 50 °C. The reports differ on whether 50 was the rise or the new setting. BFM TV reported that the hackers also forced fridges into defrost mode in many stores, according to AFP.

Intermarché told AFP that affected stores must throw away all fresh and frozen products. Several Intermarché stores said they had lost all their fresh goods, the trade site reports. The AFP report says the Paris prosecutor's office confirmed the attack and opened an investigation. The office also said the attack had caused fires.

Loss estimates vary. Early internal figures cited by the trade site put losses at several hundred thousand euros for some stores. A source close to the case told France Inter that the total runs to several million euros, franceinfo reports.

Which supermarket chains were hit

The reports agree on the chains but not on the store counts.

Chain	What was reported	Reported by
Intermarché and Netto (Les Mousquetaires)	About 150 stores, per a sector source; 200 to 300, per France Inter; at least 300, per AFP	Trade site, franceinfo, AFP
Coopérative U (Système U)	Fewer than 100 stores, per franceinfo; more than 100, per AFP	franceinfo, AFP
E.Leclerc	An attack on one of its refrigeration suppliers hit several stores	franceinfo, AFP
Monoprix	About 5% of its stores, per franceinfo; not confirmed to AFP	franceinfo, AFP
Carrefour Market	Named by the trade site; not confirmed	Trade site, AFP

Dominique Schelcher, chief executive of Coopérative U, confirmed the attack on X. He wrote that a cyberattack had been hitting the group's cooling equipment "since last night." He also called it "unacceptable." Les Mousquetaires told franceinfo that an attack of this scale was unprecedented.

What Danfoss says about its controllers

Danfoss described "incidents in France affecting a limited number of refrigeration management systems," franceinfo reports. That is far smaller than the store counts the retailers and the press gave.

The company says most of the affected devices are legacy products. It named two system managers, the AK-SM800 and the AK-SC355. These are the boxes that run a store's fridges, cold rooms and cooling plant. Danfoss says they no longer receive software or security updates. AFP adds that one version of the AK-SM800 ran outdated firmware, the software built into a device. The energy news site Enerzine reports that software versions earlier than version 4 are involved.

Danfoss advises customers to update firmware and harden their networks. It also advises removing direct internet access "where applicable" and moving to newer products. Enerzine says the company planned a meeting with refrigeration service firms on October 12.

How the attackers got in is not yet known

None of the reports says how the attackers reached the controllers. The Prime Minister's office sent the case to ANSSI, France's national cybersecurity agency. People close to Prime Minister Sébastien Lecornu said ANSSI had found a flaw in software from a Danish company. None of the reports names a public advisory for it. AFP says ANSSI is working with its European counterparts and looking for other affected French companies.

The trade site points to earlier research. Claroty's Team82 lab once found flaws in Danfoss AK-SM 800A controllers, which Danfoss fixed. It is not known whether this attack used them. No group has claimed the attack.

Antoine Hautin of the security consultancy Almond told AFP the attack showed "a certain level of sophistication." Christophe Hansen, the EU commissioner for food and agriculture, wrote that "food security requires more attention at all levels."

What this means for developers

For people who build, buy or run connected building equipment, the attack gives a clear checklist:

• Find what can be reached from the internet. Danfoss's own advice is to remove direct internet access. Check every refrigeration, heating and building controller for a public address or open remote login.
• List end-of-life devices. The AK-SM800 and AK-SC355 no longer get security fixes. Put old controllers behind a firewall or VPN, and budget to replace them.
• Do not rely on the controller as the only alarm. One store got no alert, and another's alarm came after temperatures had risen, the trade site reports. A separate temperature sensor with its own alerts gives a second warning.
• Review central management platforms. One employee claimed that every store watched by the Danfoss platform was hit, though some stores were spared. A platform that can change settings in many stores at once needs its own access review.
• Watch for ANSSI's findings. An advisory that names the flaw would tell other operators exactly what to patch.