Attackers seized remote control of refrigeration systems at hundreds of French supermarkets overnight from Sunday, Oct. 11, into Monday, Oct. 12, 2026, forcing fridges and freezers into defrost mode and heating some to as much as 50°C (122°F), The Hacker News reported, citing chain Les Mousquetaires. The overnight window in France corresponds to Sunday afternoon and evening ET; no exact start time has been published.
The target was store refrigeration controllers made by Danish manufacturer Danfoss. France's national cyber emergency team, CERT-FR, said Monday it was aware of "numerous compromises" of Danfoss AK-SM and AK-SC series devices and told operators to disconnect or filter them, according to its alert.
Paris prosecutors opened an investigation into the "large-scale cyberattack," which forced stores to throw out fresh and frozen food and, prosecutors indicated, sparked fires, CBS News reported. No one has claimed responsibility, and authorities have not said how the attackers got in.
Key Facts
- When: Overnight Sunday, Oct. 11, to Monday, Oct. 12, 2026, France time (Sunday afternoon and evening ET).
- Where: Supermarkets across France, including stores in Alsace such as Haguenau and Wasselonne.
- Who: Intermarché and Netto (Les Mousquetaires), Coopérative U, Carrefour, Monoprix and E.Leclerc; equipment maker Danfoss; France's cyber agency ANSSI and CERT-FR; the Paris prosecutor's office.
- What: Remote hijacking of Danfoss refrigeration controllers to trigger forced defrost cycles.
- Scale: Roughly 250 to 400 stores reported affected in the main reports; the exact number is unknown.
- Losses: Les Mousquetaires' chief executive expects losses of tens of millions of euros, per The Hacker News.
- Attribution: None. No group has claimed the attack.
- Status: Developing.
What Happened
Attackers triggered the controllers' built-in automatic defrost function, which raised temperatures in display cases and freezers, BleepingComputer reported. French broadcaster BFMTV reported the hackers "managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores," according to CBS News.
Store counts differ by outlet. AFP reported at least 300 Intermarché or Netto stores were targeted, while Reuters put the figure at about 150, The Hacker News noted. Carrefour said 80 of its supermarkets were hit, out of roughly 6,000 stores, CBS reported.
Coopérative U reported about 80 of its 2,000 stores affected, per The Hacker News, while CBS reported more than 100. Monoprix had about 30, and E.Leclerc said one of its refrigeration suppliers was hit, affecting several stores.
Intermarché said affected branches must "throw away all of the products" that were fresh and frozen, according to CBS. A Leclerc store in Wasselonne reportedly discarded about €220,000 in goods, and an Intermarché in Haguenau lost an estimated €50,000 of frozen stock, Security Affairs reported.
Dominique Schelcher, head of Coopérative U, called the attack "unprecedented" and wrote on X that targeting such equipment is of "extreme gravity." EU food and agriculture commissioner Christophe Hansen condemned it on X, CBS reported.
Danfoss said it is "working with affected customers to implement appropriate mitigation measures," according to Cooling Post.
Timeline
| Date/Time (ET) | Event |
|---|---|
| 2016 | Danfoss phases out the AK-SC 355 controller |
| May 2021 | Danfoss declares the AK-SM 800 end-of-life |
| 2025 | Danfoss fixes three flaws in the AK-SM 800A, per The Hacker News |
| Aug. 9, 2026 | Claroty's Team82 publishes research on the flaws |
| Late Aug. 2026 | Refrigeration outages hit several U.S. military commissaries |
| Sept. 1, 2026 | Army CID and Air Force OSI confirm investigations into commissary outages |
| Oct. 11, afternoon-evening ET (overnight in France) | Danfoss controllers at French supermarkets forced into defrost |
| Oct. 12, 2026 | CERT-FR issues alert CERTFR-2026-ALE-012; Paris prosecutors open inquiry |
| Oct. 12, 2026 | Ahold Delhaize separately takes some systems offline after a "security issue" |
Who's Involved
Danfoss, the Danish industrial group, makes the controllers. It said most of the units hit were legacy AK-SM 800 and AK-SC 355 models that no longer receive software or security updates, along with some current AK-SM 800A units running outdated firmware, Cooling Post reported.
ANSSI, France's national cybersecurity agency, named by The Hacker News, identified a vulnerability in software from a Danish company and contacted the vendor, a person close to Prime Minister Sébastien Lecornu said, according to CBS. The agency is coordinating with European counterparts.
The Paris prosecutor's office assigned the case to France's anti-cybercrime office, The Hacker News reported.
The retailers — Les Mousquetaires, Coopérative U, Carrefour, Monoprix and E.Leclerc — have confirmed or reported disruption to varying degrees. Intermarché said the attack reportedly affected "a service provider that manages refrigeration systems," BleepingComputer reported.
Claroty, an industrial cybersecurity firm, published research on Aug. 9 by Amir Zaltzman of its Team82 unit on flaws in the AK-SM 800A. Authorities have not said those flaws were used in this attack.
The OSINT Picture
Internet-scanning data shows how exposed these systems are. Baptiste Robert, chief executive of Predicta Lab, found 2,752 Danfoss systems exposed online on Monday, 1,590 of them in France, BleepingComputer reported. The Shodan search engine tracks more than 4,500 internet-reachable Danfoss devices, per the same report.
Claroty's earlier scan using Censys found 2,765 exposed AK-SM 800A devices. "Numerous controllers were directly accessible from the public Internet," the researchers wrote.
The flaws they found include an authentication bypass (CVE-2025-41450), a command injection (CVE-2025-41451) and a configuration injection (CVE-2025-41452). Claroty says firmware R4.3.1 addresses them; The Hacker News reports version 4.2 fixed the authentication bypass. The U.S. Cybersecurity and Infrastructure Security Agency flagged the first two in 2025 bulletins, according to BleepingComputer.
CERT-FR said exposing a management interface to the internet goes against best practice. It advised a factory reset, patching, rotating all secrets and fully reconfiguring any device suspected of compromise, per the alert.
A Sekoia analyst said Spain, Portugal, Poland, Germany and Belgium were also affected, The Hacker News reported. That claim is unconfirmed; no details were given. Danfoss's own October 2025 newsletter cited 2022 attacks on 16 Russian and 40 Israeli supermarkets, per the same report.
Confidence: The compromise of Danfoss controllers is confirmed by CERT-FR and Danfoss. The entry method, the attacker and any foreign-state role are unknown.
Geopolitical Players
France is treating the attack as a criminal and national-security matter. President Emmanuel Macron ordered measures last month to protect critical infrastructure from Russian "hybrid attacks," though officials have not linked this attack to Russia, CBS reported.
The EU is engaged through Commissioner Hansen and ANSSI's coordination with other national agencies.
Denmark is home to Danfoss. The company has framed the problem as one of unsupported and unpatched equipment.
What It Means for the United States
Benefits and opportunities
- Early warning: The French case gives U.S. grocers, the Pentagon's commissary system and CISA a concrete playbook to check for exposed refrigeration controllers before a similar attack lands here.
- Policy momentum (analysis): The incident strengthens the case for treating food cold-chain technology as critical infrastructure in federal cyber planning.
Risks and dangers
- Exposed U.S. systems: The same Danfoss products are sold globally, and Claroty's scan found thousands of exposed management interfaces. Ecker Geopolitics could not determine how many are in the United States.
- Military commissaries: In late August, refrigeration outages hit at least seven U.S. commissaries, including Fort Irwin and Fort Huachuca; at Fort Huachuca, all freezers went into defrost mode, Military Times reported. Army CID's Cyber Field Office and Air Force OSI confirmed investigations, Stars and Stripes reported. No hack and no vendor have been confirmed, and there is no evidence linking those outages to France.
- Separate European outages: The Defense Commissary Agency said outages at four European commissaries were caused by "routine wear" and parts delays and were unrelated to the U.S. cases, Stars and Stripes reported.
- Grocery networks: Ahold Delhaize, owner of Food Lion, Stop & Shop, Giant Food, Hannaford and The Giant Company, took some systems offline Monday after a "security issue," Grocery Dive reported. There is no evidence it is connected to the French attack.
Want the full Intel Briefing? Pro Truth Seeker members get members-only deep dives, the daily Intel Briefing and the full archive. Become a member.
What's Next
- Criminal investigation: The Paris prosecutor's inquiry will seek to identify victims and link the attack to food losses and fires.
- Patching and disconnection: CERT-FR has told operators to disconnect or filter AK-SM and AK-SC devices immediately.
- Cross-border checks: ANSSI is working with European agencies because other countries may be affected.
- U.S. probes: Military investigators have not announced findings on the August commissary outages.
Support independent reporting by supporting the Information War, and get updates by subscribing to the Ecker Dispatch.
Sources
- CERT-FR: Alert CERTFR-2026-ALE-012, Security incident targeting Danfoss AK-SM and AK-SC series (Oct. 12, 2026)
- BleepingComputer: Cyberattack shuts down refrigerators at French supermarkets (Oct. 12, 2026)
- The Hacker News: Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers (Oct. 12, 2026)
- CBS News: Hackers turn up the heat in refrigerators at hundreds of supermarkets in France, sparking fires and food losses (Oct. 12, 2026)
- Cooling Post: Danfoss moves to mitigate cyberattack (Oct. 12, 2026)
- Security Affairs: Hackers cranked French supermarkets' freezers up to 50 degrees (Oct. 12, 2026)
- Cybernews: Refrigeration cyberattack hits French supermarkets (Oct. 12, 2026)
- Grocery Dive: Ahold Delhaize experiencing cybersecurity issue (Oct. 12, 2026)
- Claroty Team82: Freeze the Controller, Defrost the Food (Aug. 9, 2026)
- Stars and Stripes: Refrigeration failures affect 4 military commissaries in Europe (Sept. 30, 2026)
- Stars and Stripes: Army, Air Force special agents investigate refrigerator outages affecting several commissary stores (Sept. 1, 2026)
- Military Times: DoD confirms 'refrigeration disruption' at military commissaries (Aug. 28, 2026)