A supermarket cyberattack has caused refrigeration failures and food losses across hundreds of stores in France. Coopérative U and Intermarché confirmed that the incident affected their refrigeration systems overnight on 11 to 12 October 2026.
The attackers reportedly changed temperature settings and forced equipment into defrost cycles. Fresh and frozen stock had to be discarded after stores could no longer guarantee that it had remained within safe temperature limits.
French supermarket cyberattack disrupts refrigeration
The supermarket cyberattack targeted the systems responsible for controlling refrigerators, freezers, display cabinets and cold rooms. Rather than disrupting payment terminals or customer-facing websites, the incident interfered directly with equipment needed to preserve food.
Early reports put the impact at between 150 and 200 Intermarché stores. Fewer than 100 Coopérative U stores were reported to have experienced similar disruption, although figures varied as information emerged during 12 October.
Intermarché confirmed that the attack affected its cold systems, a description covering both freezers and refrigerators. Coopérative U’s chief executive also confirmed that several stores in its network had been affected and described the event as unprecedented.
Several reports also identified E.Leclerc stores as likely victims. However, the initial AFP reporting focused on Intermarché and Coopérative U, and direct confirmation from E.Leclerc was not available at the time of writing. Reports naming Carrefour Market and Monoprix were also based mainly on accounts from store staff rather than formal company statements.
Food stock lost after forced defrosting
The supermarket cyberattack had an immediate physical effect. Refrigerated cabinets and freezers began warming after their control parameters were remotely altered, compromising the cold chain on which food safety depends.
Multiple French media reports said attackers raised temperature set-points, with some systems reportedly set to approximately 50 C. Other accounts described forced or extended defrost cycles. Both actions can make refrigeration equipment stop cooling for long enough to spoil fresh and frozen products.
Once temperatures move outside approved limits, retailers may be unable to verify that meat, dairy products, frozen goods and prepared food remain safe. Affected stores therefore faced substantial disposal requirements, reduced product availability and disruption while refrigeration settings and stock were checked.
How the refrigeration system attack worked
Modern supermarkets often use networked supervisory controllers to manage refrigeration across an entire store. These platforms allow staff or maintenance providers to monitor temperatures, adjust set-points, schedule defrost cycles and respond to alarms through central management interfaces.
That connectivity creates an operational risk if an attacker obtains remote access. A compromised supervisory account or controller can allow changes to be applied across numerous cabinets and cold rooms without anyone physically entering the store.
Press coverage attributed the affected refrigeration regulation systems to Danfoss, a major supplier of supermarket cooling controls. Neither the retailers nor Danfoss had publicly identified the precise controller models, firmware versions, entry point or technical root cause by 12 October 2026.
The reported effects are consistent with someone gaining control of refrigeration management functions. However, it remains unclear whether the attackers exploited a software vulnerability, used stolen credentials, accessed an exposed management interface or compromised a third-party remote maintenance connection.
Danfoss vulnerabilities remain unconfirmed as the cause
Danfoss AK-SM 8xxA devices are used as supervisory platforms for supermarket refrigeration. A Danfoss security advisory issued in 2025 covered vulnerabilities affecting AK-SM 8xxA systems running firmware earlier than version 4.3.1, including command injection and configuration control weaknesses.
Security researchers have also demonstrated how flaws in AK-SM 800A controllers could allow unauthorised changes with physical consequences, including altered refrigeration settings. Danfoss issued fixes, and relevant guidance recommended updating affected systems to corrected firmware.
This background helps explain the potential attack surface, but it does not establish how the French supermarket cyberattack occurred. There is no confirmation that an AK-SM 800A or AK-SM 8xxA vulnerability, or any related public proof of concept, was used in this incident.
Timeline, affected stores and investigation
The attack took place during the night of Sunday 11 to Monday 12 October 2026. The first identified public report appeared at 11:45 CEST on 12 October, followed by further national and regional coverage shortly afterwards.
By early afternoon, AFP-based reports had confirmed the involvement of Intermarché and Coopérative U. The reported scale had reached 150 to 200 Intermarché stores and fewer than 100 Coopérative U locations, while some later reports suggested a higher Intermarché total.
- 11 to 12 October 2026: Attackers target supermarket refrigeration controls overnight.
- 12 October, late morning: Initial reports describe altered settings, defrosting and widespread food losses.
- 12 October, early afternoon: Intermarché and Coopérative U impacts are independently confirmed.
- 12 October: The Paris prosecutor opens an investigation into the cyberattack.
The incident constitutes confirmed exploitation in the wild because the retailers reported real operational disruption and spoiled stock. However, the identity and motive of the threat actor remain unknown, and no credible group had claimed responsibility at the time of writing.
No indicators of compromise had been published by the retailers, Danfoss or French national authorities. This limits the ability of other operators to search for the same activity and makes vendor updates particularly important as the investigation develops.
Why this supermarket cyberattack matters
The incident shows how interference with operational technology can translate quickly into physical and financial damage. The supermarket cyberattack did not need to close every business system to disrupt trading. Manipulating one critical facilities function was enough to spoil stock and reduce availability across numerous stores.
Networked refrigeration, heating, ventilation and building management systems can be overlooked because they are maintained separately from conventional IT. Yet these platforms may have web interfaces, remote support connections and access to equipment that directly controls business operations.
Steps for organisations using refrigeration controls
Retailers and other organisations operating networked cold storage should review their exposure while the precise cause remains under investigation. Checks should focus on the control layer affected in this event rather than assuming refrigeration equipment is isolated.
- Identify supervisory controllers, their models, firmware versions and remote access routes.
- Check whether management interfaces are exposed directly to the internet and remove unnecessary exposure.
- Apply current vendor firmware, including relevant Danfoss updates where affected products are present.
- Separate refrigeration controls from corporate and point-of-sale networks.
- Require monitored, authenticated access for employees and third-party maintenance providers.
- Alert on unusual set-point changes, forced defrost commands and disabled temperature alarms.
Organisations should also retain controller and remote access logs so suspicious changes can be investigated. Further technical conclusions should wait for information from the affected retailers, Danfoss or French authorities, as the exploited weakness has not yet been established.
Originally reported by infosecurity-magazine.com.
