A wave of sophisticated cyber-attacks has crippled the refrigeration infrastructure of numerous supermarket chains across France, triggering widespread concerns over food security and the vulnerability of critical industrial infrastructure. The targeted breach, which began manifesting on October 11, has forced major retail cooperatives to scramble to secure their supply chains as the incident threatens to result in significant financial losses and the destruction of vast quantities of perishable goods.
The retail sector in France has been thrown into disarray as affected companies—most notably Coopérative U, which operates a diverse network of Hyper U, Super U, U Express, and Utile stores, and the retail giant Groupe Mousquetaire’s Intermarché—grapple with the fallout. As the situation develops, reports indicate that the impact may be more widespread than initially feared, with industry analysts and retail watchdogs suggesting that other major players, including E. Leclerc, Carrefour, and Monoprix, may also have been caught in the digital crossfire.
A Coordinated Strike on Essential Infrastructure
The severity of the situation was publicly acknowledged by Dominique Schelcher, CEO of Coopérative U, who took to social media platform X on October 12 to address the growing crisis. In a statement that underscored the gravity of the incident, Schelcher confirmed that multiple stores within the cooperative’s network had been hit by the attack starting the previous day.
"Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be needed to shed full light on this attack," Schelcher stated. He emphasized that the breach went beyond a standard IT failure, noting that refrigeration systems are fundamental to the integrity of the nation’s food supply. Describing the event as "of utmost gravity, unprecedented, and unacceptable," the CEO highlighted the stark reality that the attack directly targeted the equipment essential for preserving fresh products destined for the French public.
The scale of the disruption is becoming increasingly clear as companies quantify the damage. A spokesperson for Intermarché, speaking to Infosecurity, confirmed that approximately 150 of its retail locations were impacted by the intrusion. While a precise total for the spoiled inventory remains difficult to calculate, the spokesperson estimated that the immediate financial damage is already reaching "at least thousands of euros," a figure expected to climb significantly as store managers assess their cold storage logs and inventory counts.
Exploiting Vulnerable Refrigeration Controllers
The technical nature of the attack points to a calculated exploitation of industrial control systems. Investigations into the breach have identified that the compromised units are administered by the Danish refrigeration systems provider, Danfoss. The attack specifically leveraged vulnerabilities within older, legacy versions of the manufacturer’s freezing and refrigeration control software.
According to technical analysis and reports from BFMTV, the perpetrators successfully identified and accessed vulnerable Danfoss consoles that were configured with remote-control capabilities but lacked robust, secure communication channels. By gaining unauthorized access, the attackers were able to remotely manipulate the operational parameters of the cooling systems.
In a particularly malicious turn, the attackers reportedly triggered "forced defrost" cycles across numerous supermarket sites. By overriding the intended cooling protocols, the hackers were able to manipulate internal temperatures, driving them as high as 50°C (122°F). This forced temperature spike effectively neutralized the cold chain, causing the rapid degradation of temperature-sensitive inventory.
The economic toll is already being felt on the ground. In the Alsace region, near the border with Germany, just two stores—one Intermarché and one Super U in Haguenau—have reported a combined loss of approximately €270,000 ($302,000) in spoiled merchandise. With hundreds of stores potentially affected across the country, the total national loss is expected to be substantial. Intermarché has confirmed that its legal and insurance departments have launched formal investigations to determine the extent of the damage and to hold the responsible parties accountable.
A Known Weakness in Industrial Systems
The incident has brought renewed scrutiny to the cybersecurity posture of industrial refrigeration technology. The vulnerabilities in Danfoss equipment are not entirely unknown to the security community. In recent years, several critical vulnerabilities, including CVE-2023-25915, CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452, have been documented. These flaws have previously been identified as potential entry points for attackers seeking privileged access to refrigeration control systems, allowing for the manipulation of physical hardware.
The potential for this exact type of attack was highlighted earlier this year at DEF CON 34 in August 2026. Researchers from Claroty’s Team82 presented a detailed analysis of how a compromised Danfoss AK-SM 800A controller could be used to disable cooling while simultaneously falsifying temperature reports. This "man-in-the-middle" style of manipulation is particularly dangerous because it allows the cooling system to fail while the dashboard displays normal, safe temperatures, masking the spoilage of food until it is too late to intervene.
These research findings served as a stark warning about the dangers of exposing industrial systems to the public internet without implementing rigorous security controls, authentication protocols, and regular firmware updates. The current crisis in France appears to be a direct manifestation of these warnings, illustrating the real-world consequences of failing to patch or secure legacy operational technology (OT) assets.
Industry Response and Ongoing Investigations
As the retail sector attempts to recover, the timing of the attack has placed a spotlight on the manufacturer. On October 13, just days after the attack began, Danfoss was scheduled to attend the Chillventa trade fair in Nuremberg, Germany—a major event for the global refrigeration industry. At the conference, the company planned to showcase its new iC7-HVACR drive, which touts "integrated cybersecurity features." Whether these features represent a sufficient leap forward in addressing the vulnerabilities exploited in the current crisis remains a point of intense discussion among industry experts.
Meanwhile, the investigation into the broader scope of the attack continues. Jonathan Le Borgne, who tracks the retail sector via the news website Je bosse en grande distribution, has reported that the reach of the cyber-attack likely extends to other major networks, including E. Leclerc, Carrefour, and Monoprix. While E. Leclerc has acknowledged receipt of inquiries regarding the incident, the company has yet to provide a formal comment on the status of its own refrigeration systems.
As of now, the situation remains fluid. Both Coopérative U and Danfoss have been contacted for further comment regarding their remediation efforts and the timeline for securing the remaining vulnerable infrastructure, though neither had responded by the time of publication. For the affected retailers, the priority remains the restoration of safe cooling environments and the disposal of affected goods, while security teams work to lock down network access to prevent further interference. The incident serves as a significant case study in the vulnerability of the modern food supply chain to remote, digitized threats.
