Hackers Cook French Supermarket Fridges in a Nationwide Cyberattack

Hackers Cook French Supermarket Fridges in a Nationwide Cyberattack

Attackers cranked the fridges to 50C overnight

Between Sunday night and early Monday, October 12, intruders reached into the refrigeration controllers used by French supermarkets and forced them into a continuous defrost cycle. Fridges and freezers climbed to 50 degrees Celsius (122 Fahrenheit) and stayed there for roughly six hours, according to BFMTV and Reuters, destroying fresh and frozen stock and in some cases starting fires. The mechanism was mundane but effective: hijack the box in the stockroom that schedules defrosting, and the food cooks itself.

Five chains, hundreds of stores, one weekend night

E.Leclerc, Intermarché and Coopérative U confirmed to AFP that they were hit. The reported tallies vary by source: Les Mousquetaires said about 150 of its stores sat at 50C for six hours, while its Intermarché and Netto banners together saw some 300 outlets affected; Coopérative U reported more than 100 sites; Carrefour confirmed 80 supermarkets; Monoprix said about 5 percent of its roughly 490 French stores were touched. Le Monde's count put the total above 500.

Paris prosecutors opened a cybercrime investigation

The Paris prosecutor's office called it a "large-scale" attack "affecting connected refrigerators in several major food retail chains across France," with damage including "food losses and fires." Its cybercrime unit is now establishing which stores were victims and tying those losses to the intrusion. Prime Minister Sébastien Lecornu instructed the national cybersecurity agency, ANSSI, to investigate.

The finance minister put a number on it

On Tuesday, Finance Minister Roland Lescure told Parliament that about 700 of France's 10,000 supermarkets were affected. He said food supplies were not at risk, but conceded the attack "touches the heart of our food security" and called it "a wake-up call for everyone."

Old Danfoss firmware was the way in

ANSSI identified a flaw in software supplied by Danish manufacturer Danfoss and contacted the vendor; the agency's alert, CERTFR-2026-ALE-012, covers the AK-SC and AK-SM controller families. Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems," mostly legacy units such as the AK-SM 800 and AK-SC 355 that "no longer receive software or security updates," and that it had long urged customers to patch or migrate. ANSSI later said it was aware of numerous compromises involving those modules and remote-control units from U.S. firm Copeland, which pointed to "a discontinued, end-of-life generation of controllers."

The flaw was disclosed back in August

Security firm Claroty's Team82 research team published findings in August showing the Danfoss AK-SM 800A controller could be taken over without valid login, and Danfoss shipped firmware fixes at the time. Stores still running the old firmware, in other words, sat on a publicly known hole for roughly two months.

Tens of millions of euros in a single day

Intermarché chief executive Thierry Cotillard told BFMTV the "unprecedented" attack would cost "tens of millions of euros nationwide in a single day." A sector source put the national bill in the millions of euros, while other estimates cited losses above 10 million euros, about 11.2 million dollars. The clearest store-level figure so far comes from Haguenau in Alsace, where an Intermarché and an E.Leclerc reported combined stock losses of about 270,000 euros.

No ransom, no claim, no motive yet

Investigators told Reuters they have neither a statement claiming responsibility nor a ransom demand, which fits neither the profit-driven extortion pattern nor the publicity-seeking political one. No group or individual has come forward. Coopérative U chief Dominique Schelcher called the attack "of extreme gravity and unprecedented" and "unacceptable."

Europe now checks its own cold rooms

ANSSI says it is working "at the national level, to accompany potential victims, and at the European level to coordinate with its counterparts," because other countries may be affected, and French law enforcement will work with European counterparts to stop the spread. Dutch group Ahold Delhaize shut websites serving customers in Europe and the United States, saying it saw no link to the French incidents. The next front is the unglamorous one: deciding which of Europe's aging refrigeration controllers get patched, and which get replaced.