Hackers Disrupt French Supermarket Refrigeration Systems

A cyberattack disrupted refrigeration systems at French supermarkets on October 12, 2026, after attackers remotely altered cooling controls managed by Danfoss systems. The incident affected food preservation operations at multiple retailers and caused major inventory losses.

According to BFMTV, the attack began overnight from October 11 into October 12, targeting outdated versions of Danfoss control software. Hackers triggered forced defrost cycles and pushed temperature settings as high as 50°C.

Coopérative U CEO Dominique Schelcher confirmed the incident and said his teams were working with refrigeration specialists to restore operations.

"Attacking equipment essential to the preservation of fresh products and to supplying food to the French public is of utmost gravity and is unprecedented," wrote Dominique Schelcher, CEO of Coopérative U.

Schelcher said the affected equipment involved critical refrigeration operations rather than checkout systems or customer databases. The company continued coordinating with specialists during the recovery process.

"Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible," wrote Dominique Schelcher, CEO of Coopérative U.

He added that an investigation would be needed to determine the full details of the attack. French authorities and affected companies had not identified the attackers.

Losses increased as stores assessed spoiled inventory. BFMTV reported that an Intermarché and a Super U in Haguenau recorded combined losses of €270,000, while Groupement Mousquetaires estimated total losses at several million euros.

"Several million euros," according to Groupement Mousquetaires.

BFMTV reported that around 150 Intermarché stores were affected, along with reported impacts at E.Leclerc, Carrefour, Monoprix, Metro stores, and independent businesses. The full number of impacted locations remained unclear.

Security research from Claroty's Team82, presented at DEF CON 34 in August 2026, had identified vulnerabilities in AK-SM 800A controllers. The research found authentication weaknesses and command injection risks that could enable remote control.

Claroty's findings showed that affected management interfaces were publicly accessible in some cases. Danfoss released firmware version R4.3.1 to address three vulnerabilities and advised operators to update affected controllers.

The attack appeared destructive rather than extortion-based, with no ransomware note publicly reported. Investigations into the technical cause and responsible parties were ongoing.