Cyberattack Disrupts Refrigeration Systems Across French Supermarket Chains
On the night of October 11, 2026, attackers remotely compromised refrigeration controllers in multiple French supermarket chains, triggering automatic defrost cycles that raised internal temperatures and threatened food safety. The incident, reported by BleepingComputer on October 12, 2026, affected major retailers including Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U. According to French outlet reports, between 250 and 350 stores were impacted, leading to significant financial losses and widespread food waste due to cold chain disruption.
The threat actors specifically targeted Danfoss refrigeration controllers running outdated versions of control software. By exploiting these systems, they activated built-in automatic defrosting mechanisms, effectively disabling cooling functions in refrigerated units across the affected stores. This manipulation of essential food preservation equipment prompted immediate responses from supermarket operators and government officials.
Coopérative U Confirms Impact, Calls Attack 'Unprecedented'
Dominique Schelcher, president of Coopérative U, publicly confirmed the incident the following morning. He stated that since the previous night, a cyberattack had been affecting refrigeration systems in several stores within the Coopérative U network. Schelcher emphasized that the company’s teams were fully mobilized, collaborating with refrigeration specialists to restore operations as quickly as possible. He added that a formal investigation would be launched to determine the full scope and origin of the attack.
"Targeting equipment essential for preserving fresh produce and supplying food to the French people is an extremely serious matter and is unprecedented. It is unacceptable."
— Dominique Schelcher, President of Coopérative U
EU Officials Condemn Attack, Paris Prosecutor Opens Investigation
EU Agriculture and Food Commissioner Christophe Hansen also condemned the cyberattack, explicitly naming Leclerc — France’s largest supermarket chain — as one of the victims. Hansen underscored the gravity of targeting critical food infrastructure, noting the potential risks to public health and supply chain stability.
In response, the Paris prosecutor’s office informed AFP that it had opened a formal investigation into "the large-scale cyberattack affecting the refrigerators of several major food retail chains across France." The investigation aims to identify all victims, establish a clear link between the attack and reported damages — including foodstuff losses and potential fire outbreaks — and determine how the threat actors gained access to the systems.
Danfoss Vulnerability Noted, But No Direct Link Established
While the exact method of compromise remains unknown, the article references a prior warning from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). In May 2025, CISA issued an alert about a high-severity authentication bypass vulnerability (CVE-2025-41450) in the Danfoss AK-SM 8xxA Series hardware platform. This platform is commonly used to manage refrigeration and HVAC systems in food retail environments.
Officials have stated there is currently no evidence connecting the French supermarket attack to CVE-2025-41450. However, the presence of this known flaw in similar systems has raised concerns about the security of legacy industrial control equipment still in use across critical sectors.
Broader Retail Sector Faces Cyber Threats
The incident occurred amid a broader wave of cyber threats targeting retail organizations. On the same day as the French supermarket reports, retail giant Ahold Delhaize announced it had taken some systems offline following a "cybersecurity incident." As one of the world’s largest food retail chains, Ahold Delhaize’s disclosure highlighted that the supermarket sector remains a frequent target for cyber adversaries seeking to disrupt operations or extract sensitive data.
The attack on French supermarkets marks a notable escalation in cyber threats against physical infrastructure, particularly those responsible for maintaining food safety. By manipulating environmental controls rather than stealing data or deploying ransomware, the threat actors demonstrated a capability to cause direct physical and economic harm through digital means — a development that experts warn may signal a shift in tactics toward more disruptive, impact-driven operations.
Source: BleepingComputer