The French supermarket cyberattack forced refrigeration units at hundreds of stores into continuous defrost overnight on 11 October 2026. Intermarché owner Les Mousquetaires said cases at about 150 of its stores reached 50°C for six hours. Danfoss, the Danish maker of the controllers, said the affected units were running outdated firmware.
What Happened Overnight on 11 October
Attackers reached the systems that regulate temperature in supermarket cold rooms and display cases, then left them heating rather than cooling. Staff arriving on the morning of Monday 12 October found thawed stock.
- Sunday evening, 11 October: Co-opérative U chief executive Dominique Schelcher said refrigeration systems had been affected from Sunday evening onwards.
- Overnight: Les Mousquetaires said units at roughly 150 Intermarché stores ran at 50°C for about six hours.
- Monday morning: Chains began confirming the attack publicly. Intermarché said affected stores would have to “throw away all their products”, fresh and frozen.
- Monday, 12 October: The Paris prosecutor’s office confirmed to AFP that it had opened an investigation into a “large-scale cyberattack affecting the cold rooms” of several major French food retail chains.
Help Net Security reported that some stores saved part of their stock, either because they were hit closer to opening time or because managers received alerts about the temperature changes. One French trade outlet reported that the attack also disabled the alerting system at some sites, leaving on-call staff unaware; that claim has not been confirmed elsewhere.
Which Chains Were Hit, and How Many Stores
No single official total exists. The figures below are what each company has itself confirmed, which is why they are lower and more reliable than the “hundreds of stores” in most reporting.
| Chain | Stores affected | Source of the figure |
|---|---|---|
| Intermarché and Netto (Les Mousquetaires) | About 150 | Les Mousquetaires |
| Co-opérative U (Super U, Marché U) | Close to 100 | Co-opérative U |
| Carrefour | 80, out of roughly 6,000 stores | Carrefour |
| Monoprix | 5% of its stores | Monoprix |
| E.Leclerc | Several stores reported | BFM TV; not confirmed by E.Leclerc |
Some outlets, including CBS News, put the Intermarché and Netto figure at “at least 300” rather than about 150. That higher number has not been confirmed by Les Mousquetaires. Reporting that Carrefour Market was also affected comes from the specialist site jebosseengrandedistribution.fr and has not been confirmed by the company.
As of 13 October 2026, no chain has published a financial estimate of its losses. Early press estimates put the immediate cost in the hundreds of thousands of euros, with the possible national total in the millions. Intermarché warned that insurance policies may not “cover this type” of incident.
How the Attack Worked
The attackers did not switch the cooling off. According to BFM TV, they remotely triggered the forced defrost cycle, a routine maintenance function that briefly warms a unit to clear ice from its coils.
Holding that cycle on indefinitely turns a freezer into a slow oven. Because defrost is a legitimate, expected command, the change does not necessarily look like an intrusion to the equipment, which is what let the units run hot for hours.
The Danfoss Controllers at the Centre of It
Danfoss is a Danish manufacturer whose refrigeration system managers run the cold chain in a large share of European supermarkets. The company confirmed it was aware of incidents in France affecting what it called a limited number of refrigeration management systems.
In its statement to AFP, Danfoss said most of the affected equipment consisted of “legacy” products that “no longer receive software or security updates”, and that the affected units “were running outdated firmware”. It named its AK-SM800 and AK-SC355 system managers, referring to an older firmware version of the former, and said it had long advised supermarkets to update those models. Danfoss has not published how many systems were involved.
Separately, a person close to French Prime Minister Sébastien Lecornu said the national cybersecurity agency ANSSI had identified a vulnerability in software supplied by the Danish company and had contacted the vendor. The same person said France was coordinating with European counterparts because other countries could be affected. ANSSI has not published the flaw.
The Flaws Researchers Disclosed Two Months Earlier
Security researchers had already published detailed vulnerabilities in these exact controllers, with a patch, two months before the attack. On 9 August 2026, Team82, the research arm of industrial cybersecurity firm Claroty, released findings on the Danfoss AK-SM 800A series.
| Identifier | Flaw | CVSS |
|---|---|---|
| CVE-2025-41450 | Hidden “code-of-the-day” login that validates a password derived from the device’s current date instead of the administrator password, bypassing authentication | 8.2 |
| CVE-2025-41451 | Operating system command injection through unsanitised email alarm settings, allowing remote code execution after login | 7.6 |
| CVE-2025-41452 | Nginx configuration injection via an uploaded file, allowing web traffic manipulation and denial of service | 5.4 |
Claroty also reported, from a Censys scan, 2,765 AK-SM 800A devices exposed directly to the internet. Danfoss fixed the three issues in firmware R4.3.1 and published advisory DSA-2025-08-01. On the same day, Claroty disclosed 23 vulnerabilities in Copeland XWEB Pro supervisory controllers, 21 of them rated high severity.
There was earlier warning too: in May 2025 the United States Cybersecurity and Infrastructure Security Agency issued an advisory on an authentication flaw in Danfoss AK-SM 800A system managers.
It has not been established that any of these flaws was used in the French attack. Neither Danfoss, the retailers, nor ANSSI has said how the attackers got in. Danfoss’s reference to outdated firmware is consistent with unpatched devices but is not a statement about which vulnerability was exploited.
Fires or Fire Alarms? What Prosecutors Actually Said
Coverage of this story splits on whether the attack started fires, and the difference is not trivial. Both versions trace back to the same Paris prosecutor’s statement.
Euronews, citing AFP, reported that the investigation is examining food losses and “the triggering of fire alarms”. CBS News, also drawing on the prosecutor, reported that the attack had “sparked fires” and that the probe would link victims to “the outbreak of fires”. CNN and US News carried headlines describing fires.
No outlet has reported a specific fire at a named store, with damage or injuries. Until the prosecutor’s wording is published in full, readers should treat “fires” as unresolved: what is documented is that fire-related alerts formed part of the reported damage.
What Operators of These Controllers Should Do Now
The published guidance from Claroty and the vendors is specific, and it does not depend on knowing which flaw was used in France.
- Identify every Danfoss AK-SM 800A, AK-SM800 and AK-SC355 system manager on the estate, including units installed by refrigeration contractors rather than IT.
- Upgrade affected AK-SM 800A controllers to firmware R4.3.1 or later, which is the version Danfoss says fixes the three flaws Claroty reported.
- Take management interfaces off the public internet. Claroty’s advice is to avoid exposing them directly, and Danfoss gives the same guidance.
- Restrict administrative access to a trusted management network, reached over a VPN with multi-factor authentication, and segment it from the store network.
- Check that temperature alarms reach a person who is not dependent on the same controller, so a tampered unit cannot also silence its own alert.
- Review Copeland XWEB Pro controllers on the same principles, given the 23 flaws disclosed for that product on the same day.
This pattern of a disclosed flaw, an available patch and an attack months later is not unusual. It repeated recently with the Dell System Update vulnerability that sat as an optional patch for 65 days and with the Zyxel GS1900 switches breached after disclosure. As with the TP-Link router flaws only ISPs could patch, the hardest part is that the owner of the building is often not the party able to apply the fix.
What Is Still Unconfirmed
- Attribution: No group has been named or claimed responsibility. President Emmanuel Macron ordered measures last month to protect French critical infrastructure against Russian “hybrid attacks”, but no official has attributed this incident to Russia or to any other actor.
- Entry method: Which vulnerability or credential was used has not been disclosed.
- Total scale: The Paris prosecutor’s office says other major chains are thought to have been affected beyond those that have confirmed it.
- The Dutch and Belgian outages: Ahold Delhaize confirmed a separate “security issue” that took down websites and apps for Albert Heijn, Etos, Gall & Gall and Delhaize in Belgium, and left electronic shelf labels showing old prices. Help Net Security reports there is currently no indication that incident and the French attack are connected.
- The US precedent: Refrigeration failures hit Defense Commissary Agency stores from 26 August 2026, and researchers have counted as many as 14 affected sites. Investigators have not confirmed a cyber intrusion there, and no link to the Danfoss or Copeland flaws has been established.
French Supermarket Cyberattack FAQ
Which Supermarkets Were Affected?
Intermarché and Netto, Co-opérative U, Carrefour and Monoprix have each confirmed affected stores. E.Leclerc was named by BFM TV but has not confirmed it.
Is the Food in French Supermarkets Safe to Buy?
Affected chains said they discarded the stock rather than sell it. Intermarché stated that affected stores would throw away all fresh and frozen products.
Was a Known Danfoss Vulnerability Exploited?
That has not been established. Three flaws in Danfoss AK-SM 800A controllers were disclosed on 9 August 2026 and patched in firmware R4.3.1, but no authority has said which weakness the attackers used.
How Did Hackers Make Fridges Heat Up?
By remotely holding the units in their forced defrost cycle, according to BFM TV. Defrost is a normal maintenance function that warms a unit briefly to clear ice; run continuously, it spoils the contents.
Were the Dutch and Belgian Supermarket Problems the Same Attack?
There is no indication that they were. Ahold Delhaize reported a separate security issue affecting its websites, apps and shelf labels, and no public evidence links the two.
What Should a Supermarket Operator Do About This?
Update affected Danfoss controllers to firmware R4.3.1 or later, remove their management interfaces from the public internet, and require VPN access with multi-factor authentication for remote administration.
