French supermarkets discard millions in stock after cyberattack spikes fridge temps
Attackers manipulated refrigeration controllers at hundreds of French stores, raising temperatures to unsafe levels and forcing the disposal of perishable goods.
Key points
- Cyberattacks affected refrigeration systems at hundreds of French supermarkets, including Carrefour, Intermarché and Coopérative U.
- Attackers raised cold-room temperatures to 50C and extended defrost cycles, spoiling food and causing losses estimated in the millions.
- The manufacturer stated affected equipment was running outdated firmware, while authorities investigate whether known vulnerabilities were exploited.
Cybercriminals manipulated the refrigeration controllers at hundreds of French supermarkets, causing temperatures to rise to unsafe levels and forcing retailers to discard spoiled food.
The incident disrupted operations at major chains including Carrefour, Intermarché, Coopérative U, Monoprix and E.Leclerc. Attackers raised cold-room temperatures to as high as 50 degrees Celsius, with one store reporting temperatures reaching 80 degrees. They also extended defrost cycles from one hour to eight hours, delaying alarms and preventing staff from intervening quickly.
What we know
According to Industrial Cyber, the attacks occurred overnight from 11 to 12 October 2026. Approximately 300 Intermarché and Netto stores, 100 Coopérative U outlets, 80 Carrefour locations and 30 Monoprix stores were affected.
Losses at a single Intermarché store in Gradignan reached €21,000. Nationwide financial damage is expected to total several million euros, potentially reaching tens of millions. Some stores temporarily closed to allow staff to clear hazardous products.
The affected equipment included refrigeration controllers supplied by Danish company Danfoss. Systems involved included the Danfoss AK-SC series, Danfoss AK-SM series, Copeland xweb and Dixell xweb.
Authorities have not confirmed how attackers gained access. However, Danfoss stated that the affected stores were running outdated firmware. The company had previously issued security alerts in March and August 2025 regarding vulnerabilities in its software.
Security researchers from Claroty had previously identified a hidden authentication mechanism in the AK-SM 800A platform. This flaw allowed access using a code generated from the device's current date, bypassing administrator passwords.
Experts described the vulnerability as easily exploitable. Security professional Kevin Beaumont noted that writing a script to generate the daily access code required minimal skill.
France’s National Cybersecurity Agency (ANSSI) opened an investigation into the incident. Affected supermarkets disconnected their refrigeration systems from networks as a precautionary measure against further attacks.
Defender's checklist
- Disconnect affected refrigeration units from the internet immediately if compromise is suspected.
- Verify contractual insurance conditions before cutting off data transmission to service providers.
- Check system configurations, including defrosting ranges and temperature thresholds, for anomalies.
- Restore access only through a secure virtual private network or a protected internal network.
The background in plain language
Refrigeration controllers are small computers that manage temperature settings in cold storage units. They often connect to networks to allow remote monitoring and updates. If these devices are not updated, they may contain known security flaws that attackers can exploit. Attackers can change settings remotely, such as raising temperatures or altering defrost cycles, which can spoil food or damage equipment. Keeping firmware updated and restricting remote access are standard defence measures. Teams usually segment industrial control systems from general corporate networks to limit exposure.
What to do and how to stay safe: Danfoss
- Monitor refrigeration systems for unusual temperature spikes or unexpected defrost cycle changes.
- Ensure all industrial control devices are running the latest available firmware versions.
- Restrict remote access to critical infrastructure using secure virtual private networks only.
- Disconnect vulnerable devices from public networks if they cannot be updated or secured.
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which supermarkets were affected by the cyberattack?
Major French chains including Carrefour, Intermarché, Coopérative U, Monoprix and E.Leclerc were affected, with hundreds of individual stores impacted.
Did the attackers use known vulnerabilities?
Authorities have not confirmed the entry point, but the manufacturer stated affected systems were running outdated firmware. Known vulnerabilities were disclosed by Claroty in 2025.
What was the financial impact of the attack?
Losses at one store reached €21,000, with nationwide damage estimated at several million euros, potentially reaching tens of millions.
