What happened
Overnight between Sunday and Monday, attackers took control of refrigeration controllers in hundreds of French supermarkets and locked them into a continuous defrost cycle. Instead of cooling, the units heated. Temperatures inside fridges and freezers climbed to 50°C (122°F) and stayed there for hours while the stores were closed.
By morning, the damage was physical: tonnes of fresh and frozen food ruined, emptied aisles, and in some stores, fires started by overheated equipment. Retailers put the losses in the millions of euros. One detail sticks with me: staff opening stores Monday morning described a wave of heat rolling out of the display fridges and freezers, as reported by Hardware Busters.
The controllers belong to Danfoss, a Danish manufacturer. The attackers reached them over the internet and triggered the systems’ built-in defrost cycle, a legitimate maintenance feature, then kept it running. Danfoss told AFP the affected units were legacy products running outdated firmware that no longer receives security updates, and that it had previously warned customers to migrate to supported systems.
Which stores were hit
Five retail groups have confirmed impact so far: Intermarché and its Netto brand (both owned by Les Mousquetaires), Coopérative U (which includes the Super U banner) plus Carrefour, Monoprix, and E.Leclerc, according to BleepingComputer.
The numbers are still moving, and outlets disagree. For Intermarché and Netto alone, estimates range from around 150 stores (BFMTV) to at least 300 (Al Jazeera). Coopérative U chief executive Dominique Schelcher put his group’s count at 80 stores, speaking on RTL on October 13. Carrefour reports 80. Monoprix reports about 30. E.Leclerc confirms “several stores” without giving a number. Add the high ends together and you pass 500, which does not match the 250-to-400 combined estimate circulating in French media. That combined figure is French media’s own estimate, not a sum of the parts (compiled AFP, Reuters and RTL figures are tabulated here). Treat every number here as provisional.
Coopérative U chief executive Dominique Schelcher confirmed the attack on X, calling it “unprecedented.” Intermarché told BleepingComputer its teams pulled every product from the affected units as quickly as possible.
What is confirmed and what is not
Confirmed: a coordinated remote attack on Danfoss refrigeration controllers; hundreds of French stores affected overnight October 11 to 12; temperatures reached 50°C; massive food losses and some fires; Paris prosecutors opened a cyber-crime investigation with ANSSI, France’s cybersecurity agency, involved.
Not confirmed: who did it and how they got in. Investigators have not named the attackers or confirmed the intrusion path. France’s cybersecurity agency has advised operators of the affected freezer models to disconnect them from the internet and apply software updates.
No evidence of a link: the Ahold Delhaize incident. The Dutch National Cyber Security Centre said it sees no reason to believe the French attack is connected to the cybersecurity incident that took Ahold Delhaize’s systems offline the same weekend.
Why this one is different
What surprises me most is how ordinary the weapon was. No data stolen. No ransom note. According to BFM TV’s reporting, the attackers simply told the equipment to defrost, a function it was built to perform, and never told it to stop.
I don’t know how they got in, and right now neither do the investigators. Malware, exposed management interfaces, weak credentials: all possible, none confirmed. ANSSI is on the case alongside Paris prosecutors. What I do know: researchers have warned about internet-facing industrial controllers for years. This is the clearest demonstration yet of why that warning mattered.
What to do now
If you are in France: do not buy fresh or frozen food from a store with visibly emptied or taped-off refrigerated aisles, and treat any “food recall” or “refund” message mentioning the attack as suspicious until you verify it with the retailer directly. Major cyberattacks are prime phishing bait, and scammers move within hours of the news breaking.
If you are in the US: this one is worth watching rather than acting on. The same class of internet-connected controllers runs cold chains everywhere, including American grocery distribution, and no US impact has been reported. The practical takeaway is the oldest one in security: equipment that can be reached from the internet can be attacked from the internet, and legacy systems that vendors no longer patch are the softest targets.
Last updated: October 13, 2026.
Correction, October 13, 2026: An earlier version listed Coopérative U and Super U as separate chains; Super U is a Coopérative U banner, so the count is five retail groups, not six. Store-count figures were clarified as varying estimates across outlets. The attack mechanism was corrected from “ran in reverse” to a forced defrost cycle, and the Dutch NCSC’s assessment reworded to match the source. Updated later on October 13: Coopérative U figure updated to 80 stores per Schelcher on RTL; clarified that the 250-400 combined estimate does not match summed high-end outlet figures; “What to do now” moved later in the article.
Is my food safe to buy in France right now?
The affected stores pulled all fresh and frozen products from the compromised units, according to Intermarché’s statement to BleepingComputer. If a store’s refrigerated aisles look normal and stocked, its cold chain was not hit. As a rule, skip any store with visibly emptied or taped-off fridge sections, and when in doubt, ask the staff. Our data breach guide covers the separate question of what to do when your personal information is exposed in any incident.
Was anyone’s personal data stolen?
No. This was not a data theft and not ransomware. The attackers targeted refrigeration control systems, not customer databases, and no personal information compromise has been reported by any retailer, AFP, or investigators.
Could this happen to US supermarkets?
No US impact has been reported. But the underlying weakness is not French: internet-connected industrial controllers from vendors like Danfoss are deployed in cold chains worldwide, and the attacked units were legacy models that no longer receive security updates. The same exposure exists wherever such equipment is reachable online and unpatched.
