Cyberattack forces defrost cycles and spoils food at 300 French supermarkets

On the morning of Monday, October 12, 2026, employees at supermarkets across France opened refrigerator and freezer doors and found warm air instead of cold. Fresh produce, meat, dairy and frozen goods had spoiled overnight after attackers remotely forced defrost cycles on refrigeration controllers manufactured by the Danish company Danfoss. The result was not a blackout or a ransomware lock screen, but a wave of food waste that emptied shelves and raised questions about the security of the systems that keep groceries cold.

Three retail groups, Intermarché, E.Leclerc and Coopérative U, confirmed the cyberattack to the news agency AFP. Dominique Schelcher, the chief executive of Coopérative U, described the incident as unprecedented and unacceptable, saying that targeting equipment essential to the preservation of fresh products and to the food supply of the French people was extremely serious. The Paris prosecutor's office opened an investigation, and France's national cyber security agency, ANSSI, was drawn into the response. The attack also followed an order from President Emmanuel Macron last month to protect France's critical infrastructure against Russian hybrid attacks.

Refrigeration systems rarely appear on lists of critical national infrastructure alongside power grids, hospitals or water treatment plants. Yet the French case shows how deeply food retail now depends on networked industrial control equipment, often built by a small number of vendors and managed remotely. When that layer is manipulated, the consequences are measured in spoiled food, insurance disputes and consumer anxiety.

Key Facts

AFP reported on October 12 that at least 300 stores of Intermarché or its Netto brand were targeted, along with more than 100 Coopérative U outlets and several E. Leclerc stores. The Paris prosecutor's office confirmed the attack, which reportedly also affected other major chains, and said it had sparked fires. BFM TV reported that hackers managed to remotely trigger the forced defrosting of refrigeration systems in numerous stores, and a source close to the case said control systems from Danfoss were the target.

BFM TV reported on October 12 that the attackers diverted a function normally intended to protect refrigeration installations, setting a target temperature of 50 degrees Celsius and forcing continuous defrosting instead of the usual automatic cycle of two hours in 24. Euronews reported on October 12 that around 150 to 200 Intermarché stores were hit, along with nearly 100 Coopérative U outlets, while The Independent reported on October 12 that more than 150 supermarkets faced millions of euros in damage.

The losses at individual sites were severe. In Haguenau in the Bas-Rhin department, an Intermarché lost its entire frozen stock, estimated at 50,000 euros, while a Leclerc store in Wasselone reported losses of 220,000 euros from discarded frozen and fresh products. Two supermarkets in Alsace alone reported 270,000 euros in losses, and BFM TV reported that the national bill could reach several million euros.

Danfoss told AFP that most of the affected equipment was legacy product that no longer receives software or security updates. The company named its AK-SM800 and AK-SC355 fridge regulator systems, saying a version of the AK-SM800 used outdated firmware, and noted that it had long advised supermarkets to update. BFM TV reported that the compromised software versions were older than version 4. A person close to Prime Minister Sebastien Lecornu said ANSSI had already identified a vulnerability in software supplied by a Danish company and had contacted the vendor, while liaising with European counterparts because other countries may be affected.

The Paris prosecutor opened an investigation into what it called the large-scale cyberattack affecting the refrigerators of several major food retail chains across France. The stated aims were to identify the victims and establish the link with the damage they reported in terms of foodstuff losses and the outbreak of fires. The EU food and agriculture commissioner, Christophe Hansen, said on X that food security requires more attention at all levels and that such exploitation of food was now a reality.

Analysis

The French supermarket attack is a reminder that cyber risk does not need to steal money or personal data to cause serious harm. The attackers did not encrypt cash registers or demand a ransom. They changed a temperature setpoint and overrode an automatic defrost schedule, and the damage showed up as spoiled meat, melted ice cream and discarded dairy. Operational and reputational consequences far exceeded the technical simplicity of the intrusion.

What this really means is that the security of food supply chains now depends on the maintenance practices of industrial equipment vendors and their customers. Danfoss told AFP that most affected devices were legacy products that no longer receive software or security updates, and it named the AK-SM800 and AK-SC355 regulators, with a version of the AK-SM800 running outdated firmware. The attackers appear to have exploited software older than version 4, according to BFM TV. That is an industrial hygiene problem at scale: one widely deployed controller family, many units past their support window, and a control function that can be abused when remote access is not tightly governed.

Antoine Hautin of the cybersecurity consultancy Almond told AFP that the attack, likely affecting hundreds of units simultaneously, showed a certain level of sophistication. The simultaneity matters. Forcing defrost cycles at hundreds of sites within a single night requires either broad access to a remote management platform or a repeatable technique that can be pushed across many targets. The fact that BFM TV reported possible effects at Metro stores and independent butchers suggests the vulnerable population may be wider than the three chains that confirmed the incident, which would make the final count of victims a moving target for investigators.

The bigger picture here is that attacks on physical processes are becoming a mainstream criminal and hybrid tactic rather than a theoretical scenario. The incident follows President Macron's order last month to protect critical infrastructure against Russian hybrid attacks, and it echoes earlier breaches in France, including the August intrusion into the internal tax agency systems that compromised income and property records for 678,000 taxpayers and businesses, and the early 2024 compromise of payment processors Viamedis and Almerys that exposed the personal data of 33 million healthcare policyholders. Different sectors, same lesson: third party software and legacy equipment create systemic exposure that individual retailers cannot easily price or insure.

Why It Matters

Food security is the most immediate concern. Intermarché told AFP that stores would throw away all fresh and frozen products, and the EU commissioner for food and agriculture said food security requires more attention at all levels. When refrigeration fails across hundreds of outlets at once, the effect is not only commercial. It reduces the availability of fresh food and forces consumers to question cold chain integrity, a system they normally never consider.

The financial exposure is also unusual. Intermarché warned that insurance policies do not cover this type of incident, raising the prospect that individual franchisees and small operators will absorb losses that run from tens of thousands of euros at a single store to several million euros nationally. The Paris prosecutor's investigation into foodstuff losses and fire alarms suggests that authorities are treating the case as more than vandalism, and the involvement of ANSSI points to a national security dimension that could lead to new guidance for industrial control systems in retail.

Finally, the attack weakens the assumption that only data rich targets attract sophisticated adversaries. Refrigeration controllers are unglamorous devices, but they are networked, remotely manageable and widely deployed. If a single vendor's legacy firmware can disrupt food distribution in France, similar equipment elsewhere deserves the same scrutiny, and the case is likely to be cited in European discussions about supply chain security.

Next Up

Investigators from the Paris prosecutor's office and ANSSI will now try to determine who was behind the attack and how many stores were truly affected. The inquiry will focus on identifying victims and linking the intrusion to foodstuff losses and fire alarms. Danfoss has said it advised supermarkets to update for years, and the coming weeks will show whether retailers accelerate replacement of older AK-SM800 and AK-SC355 units or push for remote access controls and network segmentation around refrigeration systems.

The broader European response will matter too. A person close to Prime Minister Lecornu said ANSSI is liaising with counterparts because other countries may be affected, and the EU food commissioner has already signalled that food security needs more attention at all levels. If similar controllers are in use outside France, the October 12 attack could become a template for how physical infrastructure is targeted, and a test of whether the retail sector can secure its cold chain before the next defrost cycle is forced.