Hundreds of supermarkets across France have suffered major food losses after cybercriminals remotely interfered with refrigeration systems, causing refrigerators and freezers to heat up instead of keeping products cold. The attack, discovered on October 12, 2026, affected several major grocery chains and reportedly caused equipment fires at some locations.
The incident began overnight on October 11, when attackers gained control of connected refrigeration equipment and activated its automatic defrosting functions. Some units reportedly reached temperatures of 50°C (122°F), leaving fresh and frozen products unsuitable for sale.
Affected retailers include Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E. Leclerc. Reports indicate that approximately 300 Intermarché and Netto locations, more than 100 Coopérative U stores and 80 Carrefour supermarkets were affected, although estimates have varied as companies continue assessing the damage.
The disruption forced employees to remove and discard large quantities of meat, vegetables, frozen foods and other temperature-sensitive products. Industry estimates suggest that the financial impact could reach tens of millions of euros, with some retailers also facing uncertainty over whether insurance policies will cover their losses.
Investigators have linked the attack to refrigeration management equipment supplied by Danish manufacturer Danfoss. These controllers allow supermarkets and maintenance providers to monitor temperatures and adjust cooling equipment remotely, making them attractive targets when their management interfaces are insufficiently protected.
Danfoss acknowledged that older refrigeration controllers were affected, including equipment running outdated firmware. The company said it had previously advised customers to install available updates and replace legacy systems that no longer receive security support.
Security researchers had already identified serious vulnerabilities in Danfoss AK-SM refrigeration controllers during 2025. The weaknesses included authentication bypass and command injection flaws that could potentially allow attackers to manipulate connected equipment.
However, investigators have not established whether those specific vulnerabilities were exploited in the latest incident. Researchers have also identified thousands of Danfoss systems accessible through the internet, highlighting the potential exposure of remotely managed refrigeration infrastructure.