Major French Supermarket Chains Hit by Cyber-Attack, Food Stock Impacted
Cyberattack on Danfoss refrigeration software hit French supermarket chains, triggering forced defrosts and spoiling food stock.
A cyber-attack from October 11, 2026 targeted refrigeration installations at multiple French supermarket chains including Coopérative U, Intermarché, E. Leclerc, Carrefour and Monoprix. Attackers reportedly compromised outdated Danfoss refrigeration control software, remotely triggering forced defrost cycles with temperatures up to 50°C. Two stores in Haguenau alone lost €270,000 in merchandise, and roughly 150 Intermarché stores are affected. Danfoss controllers have known critical CVEs (CVE-2023-25915, CVE-2025-41450/41451/41452) and Claroty demonstrated similar attacks at DEF CON 34.
- Attack hit refrigeration systems at major French supermarket chains from October 11
- Attackers compromised outdated Danfoss refrigeration control software, forcing defrost cycles up to 50°C
- Two stores lost €270,000; about 150 Intermarché stores affected
- Danfoss controllers have prior critical CVEs and DEF CON research showed exploitable cooling manipulation
Vulnerabilities mentionedAll →
- CVE-2023-259158.81%Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target systempublished · danfoss ak-sm 800a firmware
- CVE-2025-414508.2<1%Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2
Full article504 words · extracted from infosecurity-magazine.com · click to collapse
Several chains of supermarkets in France have reportedly been hit by a cyber-attack targeting the refrigeration facilities of several stores across the country.
One of the affected companies is Coopérative U, a retail cooperative encompassing supermarkets branded as Hyper U, Super U, U Express and Utile.
In a post on X published on October 12, Dominique Schelcher, CEO of Cooperative U, confirmed the cyber-attack affected several stores in the network from October 11.
Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre r�seau @CooperativeU. Nos �quipes sont pleinement mobilis�es, en lien avec les frigoristes, pour r�tablir la situation au plus vite. Une enqu�te devra permettre de faire toute la lumi�re sur cette attaque. S’attaquer � des �quipements essentiels � la conservation des produits frais et � l’approvisionnement alimentaire des Fran�ais est d’une extr�me gravit� et est in�dit. C’est inacceptable.
— Dominique Schelcher (@schelcher) October 12, 2026
“Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be needed to shed full light on this attack,” he said.
He also highlighted that refrigeration systems are “essential to preserving fresh products and supplying food to the French public” and said this attack is “of utmost gravity, unprecedented [and] unacceptable."
Attackers May Have Compromised Refrigeration Software Provider
French news channel BFMTV reported that the compromised systems are administered by Danish refrigeration systems provider Danfoss.
The media outlet reported the attackers targeted outdated versions of the manufacturer’s refrigeration control software.
“Hackers reportedly managed to remotely trigger forced defrost cycles in refrigeration systems at numerous supermarkets, with temperatures programmed to reach as high as 50 °C (122°F),” BFTV reported.
BFTV reported that two supermarkets alone, an Intermarché and Super U, already recorded losses of €270,000 ($302,000) worth of merchandise in Haguenau, in the Alsace region, as a result of the incident.
The media outlet assessed that 150 of Intermarché stores, part of Groupe Mousquetaire, are affected.
Other reportedly affected supermarket networks include some of the major retail chains in the country, such as E. Leclerc, Carrefour and Monoprix, Jonathan Le Borgne, author of the specialized retail news website Je bosse en grande distribution, has reported.
Claroty Research Exposed Security Risks in Danfoss Refrigeration Controllers
Danfoss products have been found to contain critical cybersecurity vulnerabilities in the past, such as CVE-2023-25915, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, some of which could allow attackers to gain privileged access to refrigeration control systems and manipulate physical equipment.
Additionally, research presented by Claroty’s Team82 at DEF CON 34 in August 2026 demonstrated how a compromised AK-SM 800A controller could disable cooling while falsifying temperature readings, potentially concealing failures in the cold chain. These findings highlight the real-world risks of exposing industrial refrigeration systems to the public internet without adequate security controls, authentication, and firmware updates.
This is a developing story. Coopérative U, E. Leclerc, Intermarché and Danfoss have been contacted with a request for comments.
Image credits: NeydtStock / Pierre-Olivier / Shutterstock.com