Full Breakdown
French Supermarket Refrigeration Cyberattack Sparks Fires and Massive Food Losses
By Drooid · · How we work
Core Event
During the night of October 11–12 2026, hackers accessed internet-connected control panels that manage supermarket refrigeration. By overriding authentication, they forced defrost cycles to run continuously, raising temperatures in fridges and freezers to 50 °C (122 °F) for up to six hours. The overheating caused food spoilage, triggered small fires in several locations, and forced staff to discard perishable stock.
Background & Context
Modern supermarket cold aisles are operated by remote-management software supplied by Danish engineering firm Danfoss. In August 2026, cybersecurity firm Claroty published a report detailing authentication flaws in Danfoss controllers (AK-SM 800A series). Danfoss later confirmed many compromised units were running outdated firmware. Similar refrigeration disruptions were reported at U.S. military commissaries in late August 2026, showing a growing trend of operational-technology sabotage.
Timeline
- October 11, 2026 – Hackers manipulate refrigeration controllers across hundreds of stores.
- October 12, 2026 – Paris prosecutor’s office announces the attack; Prime Minister Sébastien Lecornu orders the National Cybersecurity Agency (ANSSI) to investigate.
- August 9, 2026 – Claroty’s vulnerability report on Danfoss controllers is released.
- October 12, 2026 – Danfoss acknowledges “limited incidents” involving outdated systems.
Data & Statistics
- Intermarché/Netto: ? 150–200 stores reported temperature spikes.
- Coopérative U: ? 80–100 stores affected.
- Carrefour: 80 of its ~6,000 French outlets impacted.
- Monoprix: 5 % of ~490 stores (? 30 locations).
- Reported losses include €270,000 in two Alsace stores and €50,000 at an Issy-les-Moulineaux Intermarché.
Official Statements & Responses
Prime Minister Lecornu’s office directed ANSSI to lead a criminal investigation and coordinate with European counterparts. ANSSI identified a vulnerability in Danfoss software and urged operators to isolate or patch affected controllers. EU Agriculture and Food Commissioner Christophe Hansen condemned the attack, emphasizing that “food security requires more attention at all levels.” Cooperative U CEO Dominique Schelcher called the targeting “extremely serious and unprecedented” and pledged that teams were “fully mobilised” to restore operations.
Criticism & Opposition
Cyber-security experts highlighted systemic weaknesses. Kevin Beaumont, a security analyst, warned that “several thousand” Danfoss devices are directly internet-facing, making them easy targets. They argued that reliance on legacy firmware and default credentials constitutes negligent risk management.
On-the-Ground Reports
Paris resident Geert de Clercq observed staff at an Intermarché loading cartfuls of thawed frozen food into a large trash container, with molten ice-cream spilling onto the street.
Conflicting Reports & Gaps
Sources differ on the exact number of impacted stores: Intermarché figures range from 150 to 200, while some outlets cite “around 180.” Loss estimates also vary, with some retailers providing only qualitative statements (“tens of millions of euros”) and others offering specific regional totals. No group has claimed responsibility, and investigators have not disclosed the attack vector beyond the Danfoss software vulnerability.
Verbatim Quotes
- “Food security requires more attention at all levels,” — EU Food Commissioner
- “Attacking equipment that is essential to the preservation of fresh products and the food supply of the French people is extremely serious and unprecedented. It is unacceptable,” — Dominique Schelcher, CEO
- “Our teams are fully mobilised, in coordination with refrigeration specialists, to restore the situation as quickly as possible,” — Les Mousquetaires
What’s Next
The Paris prosecutor’s cyber-crime division will continue probing the incident to identify perpetrators and assess damage. ANSSI is liaising with European agencies to audit other Danfoss-controlled installations and issue mitigation guidance. Danfoss has pledged firmware updates and advice on removing direct internet exposure for legacy units. Retailers are expected to complete inventory checks and restore cold-chain operations over the coming days, with some stores aiming to resume normal sales by October 13, 2026.