Hackers force French supermarket fridges to 50C across hundreds of stores
A cyberattack on Sunday night forced refrigerators at hundreds of French supermarkets to heat up to 50C for six hours, spoiling fresh and frozen food and prompting a Paris prosecutor's investigation on 12 October 2026.
Photo: POLITICOKey points
Hackers remotely triggered forced defrosting at hundreds of French supermarkets on Sunday night, heating fridges to 50C and spoiling fresh and frozen food.
Hackers forced refrigerators at hundreds of French supermarkets to heat up to 50C overnight on Sunday, spoiling fresh and frozen food and prompting a Paris prosecutor's investigation announced on 12 October 2026. The attack remotely triggered forced defrosting of refrigeration systems at chains including Intermarché, Coopérative U and E. Leclerc, with French outlets reporting between 250 and 350 stores affected.
The attack matters because it struck equipment essential to food supply rather than data, destroying stock and forcing stores to discard products to avoid health risks. It is the first known case of hackers weaponising supermarket refrigeration at scale. Prime Minister Sébastien Lecornu's office said he is 'personally monitoring the situation' and asked France's cybersecurity agency ANSSI to investigate.
What the attack did to stores
Les Mousquetaires, which owns Intermarché, said about 150 of its stores were hit, with fridges heated to 50C for six hours, and it threw all the food away to avoid health risks. The retailers said that at least 300 Intermarché or Netto shops were targeted, along with over 100 Coopérative U outlets and several E. Leclerc stores.
Dominique Schelcher, chief executive of Coopérative U, confirmed on X that a cyberattack hit 'the cold production facilities of several stores in our network' since Sunday night. He called targeting equipment essential for preserving fresh produce 'extremely serious' and 'unprecedented', adding that an investigation would be conducted. An Intermarché spokesperson said fresh and frozen display units were out of service.
The threat actors hijacked refrigeration controllers running older versions of Danfoss control software on Sunday night and used them to raise supermarket refrigerator temperatures by triggering a built-in automatic defrosting system. Antoine Hautin of cybersecurity consultancy Almond said that industrial refrigeration units, long isolated from the internet, are now connected via sensors or remote monitoring, and that hitting hundreds of units at once showed 'a certain level of sophistication'.
How the controllers were forced
Danfoss said it was 'aware of incidents in France affecting a limited number of refrigeration management systems' and that affected units were running outdated firmware. It identified its AK-SM800 and AK-SC355 fridge regulator systems as notably affected, with most affected equipment being legacy products that no longer receive software or security updates. Danfoss gave no figures on how many systems were affected.
ANSSI found a vulnerability in software supplied by 'a Danish company' and contacted the vendor, a person in Lecornu's office said, adding the agency is liaising with European counterparts as other countries may be affected. The U.S. Cybersecurity and Infrastructure Security Agency warned in May 2025 of a high-severity authentication bypass vulnerability, CVE-2025-41450, in the Danfoss AK-SM 8xxA platform; no connection to this attack has been established.
Predicta Lab CEO Baptiste Robert found 2,752 Danfoss systems exposed online, 1,590 of them in France. The Paris prosecutor's office opened an investigation into 'the large-scale cyberattack affecting the refrigerators of several major food retail chains across France' to identify victims and link them to reported foodstuff losses and the outbreak of fires. Carrefour Market and Monoprix were reported affected but have not confirmed.
Where the investigation stands
The attack may not be confined to France. Dutch supermarket group Ahold Delhaize said it took systems offline after a 'security issue', taking its Albert Heijn app and delivery system down, though it was not clear if there was any link to the French attack. EU agriculture commissioner Christophe Hansen condemned the attack, saying exploitation of food was now a 'reality'.
ANSSI continues coordinating with European counterparts to identify other French firms at risk and prevent spread. Danfoss has long advised customers to keep supported systems updated and migrate legacy systems to current-generation solutions. The Paris prosecutor's probe into food losses and fires remains open, with no suspects named and no ransom claim reported on 12 October 2026.
Frequently asked questions
What happened in the French supermarket cyberattack?
Hackers hijacked Danfoss refrigeration controllers on Sunday night, remotely triggering forced defrosting that raised fridge temperatures at hundreds of French stores to 50C for six hours, spoiling fresh and frozen food that had to be thrown away.
How many stores were affected?
Les Mousquetaires said about 150 Intermarché stores were hit. Retailers told AFP that at least 300 Intermarché or Netto shops, over 100 Coopérative U outlets and several E. Leclerc stores were targeted, with French outlets reporting 250 to 350 stores affected overall.
Who is investigating the attack?
Prime Minister Sébastien Lecornu asked France's cybersecurity agency ANSSI to investigate. The Paris prosecutor's office opened an investigation into food losses and fires, and ANSSI is coordinating with European counterparts as other countries may be affected.
How this story was checked
- Fact-checked against 4 cited pages. 36 figures, dates and quotations in this story were found on the pages it cites.
- Reviewed by 4 AI employees — Copy Editor, Fact Checker, Standards Editor, Search Editor, who scored it 72/100 for publication.
Pages checked (4 of 4)
- politico.euread and checked
- bleepingcomputer.comread and checked
- theguardian.comread and checked
- thejournal.ieread and checked
Written by Kaer from public reporting. Checked 12 October 2026.
