Cyberattack Forces Refrigerators Into Defrost Mode at Hundreds of French Supermarkets

Attackers remotely forced refrigerators into defrost mode at hundreds of French supermarkets overnight, hijacking the controllers that regulate cold storage and spoiling large quantities of fresh and frozen food across the country.

The attack, detected overnight on October 11-12, hit stores operated by Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix, according to French outlets, which put the number of affected stores at between 250 and 350. Supermarkets in Belgium and the Netherlands were also reportedly affected.

According to French broadcaster BFMTV, the attackers targeted refrigeration control systems administered by Danish manufacturer Danfoss, hijacking controllers running outdated versions of the company’s control software. By remotely triggering a built-in automatic defrosting function, they forced refrigeration systems into continuous defrost cycles with temperatures programmed to reach as high as 50°C (122°F) — effectively turning refrigerated display units into heaters and making the stored food unsafe to consume.

“Of utmost gravity, unprecedented and unacceptable”

Coopérative U president Dominique Schelcher confirmed the incident in a post on X on October 12, saying a cyberattack had been affecting refrigeration systems in several stores within the cooperative’s network since the previous night. “Our teams are fully mobilized, working alongside refrigeration specialists, to resolve the situation as quickly as possible. An investigation will be conducted to shed full light on this attack,” he said. He called targeting equipment essential for preserving fresh produce and supplying food to the French people “an extremely serious matter” that is “unprecedented” and “unacceptable.”

An Intermarché spokesperson told Infosecurity Magazine that 150 of the chain’s stores were affected, with financial losses estimated at “at least thousands of euros,” adding that it was not yet possible to estimate how much food would be wasted. A Carrefour spokesperson said the incident “primarily affected 80 supermarkets out of our 6000 stores.” BFMTV reported that two stores alone, an Intermarché and a Super U in Haguenau in the Alsace region of eastern France, recorded losses of 270,000 euros ($302,000) worth of merchandise.

European Union agriculture and food commissioner Christophe Hansen condemned the attack and named Leclerc, France’s largest supermarket chain, as one of the victims. The Paris prosecutor’s office told AFP it has opened an investigation into “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France” to identify the victims and establish the link with reported damage, including foodstuff losses and the outbreak of fires.

A known weak link

The compromised controllers have been flagged as a security risk before. The U.S. Cybersecurity and Infrastructure Security Agency warned in May 2025 of a high-severity authentication bypass vulnerability (CVE-2025-41450) in the Danfoss AK-SM 8xxA series hardware platform used to manage refrigeration and HVAC systems commonly found in food retail. In August 2026, security researchers from Claroty’s Team82 demonstrated at the DEF CON conference how a compromised Danfoss AK-SM 800A controller could disable cooling while falsifying temperature readings, potentially concealing failures in the cold chain.

Separately, retail giant Ahold Delhaize, one of the world’s largest food retail chains, announced on Monday that it had taken some systems offline after a “cybersecurity incident.” There is no evidence yet that the two incidents are connected, and the identity of the attackers, their means of entry and any possible demands had not been established publicly on Monday.

Reporting based on coverage by BleepingComputer and Infosecurity Magazine.