Cyberattack Hits French Supermarkets After Danfoss Refrigeration Systems Compromised
On Monday, October 12, 2026, a widespread cyberattack struck the refrigeration systems of hundreds of supermarkets across France, affecting major retail groups including Intermarché, Système U, and E.Leclerc, as franceinfo reported. Several hundred supermarkets were victims in the night from Sunday, October 11, to Monday, October 12, of a cyber operation targeting their refrigeration setups, with 150 to 200 Intermarché locations and fewer than a hundred Coopérative U sales outlets initially declared, before figures climbed to 300 stores for Intermarché and Netto combined. Beyond major retail groups, Metro stores and independent businesses, notably butcher shops, might also have been impacted.
Scale of the Refrigeration Breakdown Across French Retailers
The unauthorized remote intrusion targeted equipment managed by Danish manufacturer Danfoss, specifically older software versions such as the AK-SM800 and AK-SC355 systems that have reached end-of-life and no longer receive security or firmware updates, according to Danfoss’s official confirmation cited by franceinfo. The cyberattack triggered a forced defrost mechanism that remotely altered temperatures in display cases and cold rooms, sending refrigeration units up to 50 degrees Celsius in certain locations. Hackers succeeded in remotely triggering the forced defrost of refrigeration installations across numerous stores, forcing operators to discard all affected fresh and frozen goods. At the Chauvigny Intermarché, remote take-control of cold rooms drove temperatures above 80 degrees Celsius.
Figures released by the affected retail groups highlight the breadth of the disruption. Le Figaro and franceinfo noted that Intermarché and Netto emerged as the hardest hit, with the Groupement Mousquetaires initially reporting between 150 and 200 stores affected before revising estimates upward to 300 locations. Coopérative U confirmed that fewer than 100 of its member stores experienced temperature spikes, while E.Leclerc acknowledged that an IT attack on a refrigeration hardware supplier disrupted operations across multiple outlets.
Financial losses are mounting rapidly. While the Groupement Mousquetaires estimated initial damages at several million euros without providing a precise national total, individual store owners faced immediate operational write-offs. Sophie Matt, manager of an Intermarché in Haguenau, reported losses reaching 50,000 euros after morning staff discovered refrigeration units running dangerously hot, as detailed by Le Figaro. In the Vienne department, local reporting by La Nouvelle République recorded disrupted stock at the Poitiers route de Gensay Leclerc and the Chauvigny Intermarché, where management described spoiled goods as considerable. In Alsace, two Intermarché and Super U supermarkets alone recorded 270,000 euros in losses. At a Wasseloon Leclerc outlet in the same sector, damages reached 220,000 euros after discarding frozen and fresh goods.
French Authorities Intervene to Map Exposed Enterprises
The incident drew an immediate response from French authorities. The Prime Minister directed the national cybersecurity agency, the Agence nationale de la sécurité des systèmes d’information (Anssi), to intervene. Anssi identified a vulnerability in the Danish software provider’s architecture and initiated direct contact with the vendor while working to map and alert other potentially exposed French enterprises before the technical failure spread further. The Ministry of Commerce stated it is in contact with distributors without possessing additional information at this stage.
Concurrently, the Paris public prosecutor’s office initiated an independent investigation into the large-scale cyberattack targeting connected commercial refrigerators. BFM TV and Le Figaro reported that investigators noted isolated instances of localized fire outbreaks linked to the sudden thermal surges in the equipment. Retailers deployed maintenance crews and refrigeration technicians to isolate networks, unplug vulnerable remote-management connections, and discard compromised fresh and frozen food.
Stores Disconnect Networks to Secure Refrigeration Inventory
Stores caught in the intrusion scrambled to secure remaining inventory. At the Intermarché in Naintré, management disconnected the remote internet control cable at 7:30 a.m. to isolate the refrigeration network from external access, relying instead on internal store alarms to monitor baseline cooling functions, according to La Nouvelle République. Similar emergency containment steps played out across regional outlets as operators emptied display cases.
Danfoss advised clients using legacy refrigeration management controllers to migrate immediately to modern generation solutions and apply available firmware mitigations. Dominique Schelcher, CEO of Coopérative U, condemned the intrusion on the social platform X, characterizing an attack directed at food supply chains and temperature-sensitive preservation units as an unprecedented act of extreme gravity.
