Hackers warmed the fridges at 250 to 350 French supermarkets and forced fresh food off the shelves

French media reported that between 250 and 350 supermarkets were affected when attackers took over refrigeration controllers on Sunday night, October 11, 2026, and drove up the temperature inside chilled cabinets. The chains named include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc and Super U, and an Intermarché spokesperson also mentioned Netto. The range counts stores affected, not stores attacked one by one, and no one has published a verified list.

No group has been named as responsible. The Paris prosecutor’s office has opened an investigation covering the attack and its link to reported food losses and fires, so for now the culprit is simply unidentified. That leaves the usual suspects, criminal extortion crews, activists and state-linked saboteurs, as speculation rather than finding, and the sources read for this piece offer no ransom demand, claim of responsibility or technical attribution that would favor any of them over the others.

What 250 to 350 stores actually measures

The count comes from French outlets, among them BFMTV, which reported that temperatures climbed as high as 50 degrees Celsius and that fresh products were destroyed in hundreds of Intermarché and Super U stores. BleepingComputer repeated the 250-to-350 range but attributed it to those outlets and did not confirm it independently.

The wording matters. A range of that width signals that nobody had a clean tally on October 12, and Intermarché itself said it had no specific list of affected stores. It is also a count across several competing chains, not the total for any single banner, and it measures stores where refrigeration was disturbed rather than stores where goods were thrown away.

How a defrost cycle becomes a weapon

Refrigeration controllers are built to warm things on purpose. Display cases and cold rooms accumulate ice, so the system periodically runs a defrost cycle that heats the evaporator coils. According to BleepingComputer, the attackers hijacked the controllers and used that built-in automatic defrosting function to raise temperatures, on stores running older versions of Danfoss control software. No exact version was given, and how the intruders first got in remains unknown.

That is what separates this episode from a data breach. Nothing had to be stolen or encrypted; the intruders only had to issue instructions the equipment already knows how to follow, and the physics did the damage. Chilled meat, dairy and prepared food have narrow safe temperature windows, so a few hours of heat can turn a stocked aisle into waste, and the warmed cabinets were not even broken. Store staff would have seen cases drifting out of range while the equipment reported itself as working, which is why removing the products quickly was the only safe response available on the shop floor.

The Danfoss exposure researchers had already mapped

The report ties the attack surface to Danfoss’s AK-SM 8xxA series of system managers. In a write-up dated August 9, 2026, Claroty’s Team82 described the AK-SM 800A as a web-based console used to set temperature thresholds, review alarms, adjust operating schedules and perform remote maintenance. It found thousands of management interfaces reachable from the public internet, citing a Censys scan of 2,765 devices.

Team82 documented an authentication bypass, CVE-2025-41450, in which a hidden login path accepts a password derived from the current date, and a command injection flaw, CVE-2025-41451. It reported that Danfoss shipped firmware R4.3.1 to address the problems and advised keeping the interfaces off the public internet. BleepingComputer stressed that it has not confirmed either CVE was used in the French attack.

Baptiste Robert, chief executive of Predicta Lab, reported on Monday that he had found 2,752 internet-exposed Danfoss systems, 1,590 of them in France. Shodan tracks more than 4,500 Danfoss devices overall. Exposure on that scale means the French stores are unlikely to be the only ones reachable, which matters for operators of the same controllers elsewhere, including supermarkets in the United States.

Responses, losses and the open questions

Dominique Schelcher, president of Coopérative U, confirmed that stores in the U network were hit and said the matter “is an extremely serious matter and is unprecedented.” Intermarché’s spokesperson said the chain had taken all necessary precautions to remove products from the affected units as quickly as possible, which is the clearest statement that food was pulled from sale. EU agriculture commissioner Christophe Hansen also condemned the attack and named Leclerc as a victim.

A separate retail incident landed the same week: Ahold Delhaize took some systems offline on Monday. BleepingComputer’s report on that case says there is no evidence the two events are connected, so they should be read as unrelated until investigators say otherwise.

Still unanswered are who did it, what flaw or credential gave them access, how much food was lost, and whether the stores still reachable from the internet have been patched. Operators of any Danfoss system manager can start with the firmware version and with whether the management console answers requests from outside the store network.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview