Cyberattack disrupts refrigeration at hundreds of Intermarché, U and Leclerc supermarkets

Overnight from Sunday, October 11, to Monday, October 12, 2026, a cyberattack targeted the refrigeration systems of several major retail chains in France. The Les Mousquetaires group (Intermarché) and Coopérative U confirmed the attack. E.Leclerc says that "one of its suppliers" of refrigeration equipment was hit, with repercussions in several stores. According to Les Mousquetaires, cited by franceinfo and ICI, the victim is Danfoss, the Danish manufacturer that supplies their refrigerated display cases. The temperature of freezers and refrigerators was reportedly set to 50°C (122°F).

Hundreds of stores and destroyed stock

Counts still vary. Franceinfo reports about a hundred Intermarché stores, out of roughly 3,600 in France, and fewer than a hundred U stores. ICI, for its part, reports 200 to 300 Intermarché stores affected, according to the group. According to Infosecurity Magazine, which cites in particular a specialized retail industry site, Carrefour and Monoprix stores may also be affected: these chains have not confirmed this at this stage.

Stores had to empty their freezers and display cases, have the losses recorded by a bailiff, or throw away fresh and frozen products. According to ICI, the Intermarché in Mur-de-Bretagne reports a loss of €50,000, and the one in Haguenau threw away all of its frozen goods. Les Mousquetaires say they have never before been the victim of a cyberattack on refrigeration systems. Dominique Schelcher, CEO of Coopérative U, called it "extremely serious" on X to "attack equipment essential to keeping fresh products safe."

A national investigation

According to ICI, the cybercrime unit of the Paris prosecutor's office has taken up the case, and the investigation has been assigned to the Office anti-cybercriminalité (Ofac, the French national anti-cybercrime office). Also according to ICI, which cites the Prime Minister's entourage, the Agence nationale de la sécurité des systèmes d'information (ANSSI, France's national cybersecurity agency) has already identified a vulnerability in software supplied by a Danish company and has contacted the vendor. It is also trying to identify other affected companies. No claim of responsibility has been made public, and Danfoss had not yet commented as of early Monday afternoon.

Known vulnerabilities in Danfoss controllers

The attackers' method has not been established. In particular, it is unknown whether the hackers got in through controllers installed in stores, a remote monitoring tool or a maintenance account. On August 9, 2026, Claroty Team82 researchers published findings on the Danfoss AK-SM 800A refrigeration controller. They describe three vulnerabilities: a hidden authentication mechanism that could allow a password bypass (CVE-2025-41450), a post-authentication command injection (CVE-2025-41451) and a configuration injection (CVE-2025-41452). They counted 2,765 of these interfaces exposed on the internet, based on a Censys scan. No link has been established at this stage between these vulnerabilities and the October 12 attack.

What to do if you operate connected refrigeration equipment

• Check that no management interface (controllers, supervisors, remote maintenance gateways) is directly reachable from the internet.
• For Danfoss AK-SM 800A units, Claroty recommends firmware R4.3.1 or a later version.
• Restrict remote access to a VPN with strong authentication, and segment this equipment from the rest of the network.
• Change the passwords of maintenance accounts, including those of your refrigeration contractors.
• Set up temperature alarms that are independent of the control system, and keep a manual recovery procedure.

Update of October 13, 2026

Danfoss has commented after the remote disruption of refrigerated display cases in hundreds of supermarkets overnight on October 11–12. According to Next, the Danish manufacturer says the affected equipment is either obsolete controllers (AK-SM 800 and AK-SC 355) or AK-SM 800A units whose firmware had not been updated. It recommends replacing the AK-SC 355, which is no longer sold. According to BFMTV, cited by Next, 300 Intermarché and Netto stores and about a hundred U stores were affected.

On October 12, CERT-FR, the French government's cyber threat monitoring and response center, published an alert (CERTFR-2026-ALE-012). It says it is aware of "numerous compromises" of Danfoss AK-SM and AK-SC series controllers. It recommends disconnecting them from the internet or filtering access to them. In case of compromise, it advises resetting them, applying patches, changing secrets and reviewing existing accounts.

The Paris prosecutor's office confirmed it has opened an investigation, assigned to the Office anti-cybercriminalité (Ofac). According to Le Monde, cited by Next, it also reports cases of fires breaking out. The attackers' method of access has not been established, and no claim of responsibility has been made public.