A French supermarket cyberattack forced hundreds of grocery stores to throw away fresh food early Monday morning after hackers hijacked connected cooling units to sabotage store freezers. The hackers triggered automatic defrost cycles on cooling units at chains such as Intermarché, Coopérative U, and E. Leclerc and raised storage heat to 50 degrees Celsius (122 degrees Fahrenheit). Paris authorities and retail groups confirmed that the incident hit between 250 and 350 store sites nationwide [1, 2].
Hackers Trigger Defrost Cycles in Overnight Raid
The raid hit on Sunday. Hackers broke into control systems managing grocery cooling units, turning on built-in defrost cycles that ran for several hours without a stop. Under normal store routines, cooling equipment runs short defrost cycles to melt frost, but the attack kept heaters active long enough to spoil dairy, meat, and frozen goods. In some stores, the high heat even caused small fires to break out [1].
Six major retail chains suffered hits. Chains hit by the breach include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U. An Intermarché spokesperson said that a service provider managing store cooling units had been compromised, which knocked fresh and frozen food display cases out of service. “Intermarché and Netto have taken all necessary precautions to remove the products from these units as quickly as possible,” the spokesperson said. Store teams didn’t yet have a full list of affected sites [2].
Store crews spent Monday morning loading trash bins with spoiled food packages instead of welcoming local shoppers into their aisles. Milk, butter, yogurt, and frozen meat kept in the defrosted cabinets quickly warmed past safe limits, which created heavy financial losses for local grocers and cooperative members who own individual stores. Paper warnings lined empty aisles. Workers couldn’t save thawed inventory once interior cabinet heat climbed toward midday levels. The trouble shows how software hacks can create food waste in neighborhood shops, especially when retail networks rely on centralized cooling setups that link dozens of stores through one shared vendor [2].
French Supermarket Cyberattack Forces Mass Food Disposal
Coopérative U president Dominique Schelcher confirmed that multiple stores in his network lost cooling during the night. He stated on social platform X that store teams worked with cooling technicians to fix the systems and protect remaining supplies. Schelcher condemned the hack in plain terms. “Targeting equipment essential for preserving fresh produce and supplying food to the French people is an extremely serious matter and is unprecedented,” Schelcher said. He called the sabotage unacceptable [2].
EU agriculture and food commissioner Christophe Hansen also spoke out against the sabotage on Monday. Hansen named France’s largest grocery chain, Leclerc, as one of the main victims and said European officials were watching the aftermath closely. Grocery coolers stayed offline. While consumer appliances have run into trouble before — such as smart refrigerators disrupted by firmware bugs in South Korea — this incident targeted store refrigeration units on an industrial scale. Grocers threw out full truckloads of food to avoid health hazards for local buyers [2].
Retailers didn’t hesitate to discard the spoiled goods because French health codes forbid selling food once the cold chain breaks. Staff members emptied long rows of upright display coolers and chest freezers, taping warnings on glass doors while disposal crews hauled away warm inventory. Fresh milk and meat spoiled quickly. Replacing truckloads of fresh dairy and meat takes several days, and restocking frozen aisles needs cooling units to chill down again to proper freezing levels. Grocery managers admitted that the French supermarket cyberattack caused steep financial harm that insurance claims won’t settle right away [1, 2].
How Outdated Firmware Exposed Danfoss Controllers
Investigators quickly focused on the cooling hardware running the supermarket freezers. Intruders targeted control units made by engineering firm Danfoss, including the AK-SM800 and AK-SC355 models used in food retail. Danfoss told the trade publication Cooling Post that the affected devices were running outdated firmware that lacked recent security updates. Danfoss said it was working with customers to deploy newer firmware, remove direct web connections, and put stronger network guards in place [1].
Security records show that the Danfoss systems had known flaws on file. The Cybersecurity and Infrastructure Security Agency warned in May 2025 about an authentication bypass bug, cataloged as CVE-2025-41450, in Danfoss AK-SM 8xxA devices. Three months later, in August 2025, CISA issued an advisory for a command injection flaw, CVE-2025-41451. Cybersecurity research group Team82 at Claroty had discovered both flaws and published research showing how attackers could run unauthorized code on publicly accessible Danfoss AK-SM 800A management portals [2].
Those software holes gave hackers an easy path to take over cooling settings without stepping foot into store backrooms. No backroom entry was needed. By sending remote commands to web-facing management interfaces, unauthorized users could change heat limits, turn off warning bells, and force refrigeration units into hours-long defrost routines. Danfoss stated on its website that it takes security seriously and has rolled out new defenses for AK-SM800 controllers. Without local network isolation, a single internet connection gave outsiders complete power over store freezers. Even so, many store owners hadn’t patched their boxes, leaving hundreds of remote food coolers open to anyone who scanned the public web for vulnerable Danfoss ports [1, 2].
Supermarket Refrigeration Cyberattack Uncovers Internet Vulnerabilities
The scope of exposed cooling hardware became clear as independent analysts probed internet scanning data on Monday following the French supermarket cyberattack. Baptiste Robert, chief executive of security firm Predicta Lab, found 2,752 Danfoss systems exposed online, with 1,590 of those units located in France. The internet device search engine Shodan was tracking more than 4,500 reachable Danfoss installations around the globe. Most exposed units sat in France. Those numbers showed that thousands of cooling units in supermarkets and storage depots stayed visible on the open web without firewalls or private connections to shield them from remote tampering [2].
Security analysts point out that industrial internet setups carry far greater risks than stolen files. Darktrace threat intelligence vice president Nathaniel Jones told CNET that digital attacks can now manipulate machinery on store floors. “A cyber incident no longer affects only data or business systems; it can manipulate physical equipment and cause real-world damage,” Jones said. He told CNET in an email statement that “if it is connected, it can be targeted.” Much like cyberattacks striking municipal utilities, tampering with cooling networks endangers everyday civil supplies [1].
The French grocery incident wasn’t an isolated headache for European retailers on Monday. Retail giant Ahold Delhaize announced that it had to take several systems offline after a cybersecurity incident, though investigators haven’t tied that event to the supermarket refrigerators in France. Many grocery chains hook up cooling controllers to track energy costs, check food safety logs, and change digital shelf tags from distant headquarters. When retail companies connect those devices without setting up secure virtual private networks, intruders can easily turn ordinary management tools into disruptive network weapons [1, 2].
Paris Prosecutors Open Food Supply Probe
French law enforcement agencies responded promptly to the grocery failures. The Paris prosecutor’s office told news agency AFP that it opened a criminal inquiry into what it described as a large-scale cyberattack on major food retail chains. Investigators want to identify the perpetrators, determine the exact methods used against Danfoss hardware, and establish legal links between the digital tampering and the resulting food waste and store fires [1, 2].
Neither French officials nor Danfoss spokespersons have named a specific hacking group or motive behind the attack. No extortion demand or ransom note had surfaced publicly by Monday afternoon, which left investigators to question whether the perpetrators sought illicit money or deliberate sabotage against the food supply. No ransom note appeared. Danfoss told trade reporters that it’s continuing to help affected grocers disconnect vulnerable controllers from public internet routes while delivering firmware fixes to keep cooling units online [1].
Supermarket chains in France now face the job of securing hundreds of cooling controllers before refilling their empty shelves with new supplies. Repair crews spent Monday isolating exposed panels, resetting login keys, and installing newer software builds at store branches in every French department. Store owners moved quickly. Retail leaders acknowledged that keeping food safe needs treating refrigeration hardware with the same defensive care as payment terminals and accounting servers. The French supermarket cyberattack showed that automated store machinery can become an easy target when routine internet security measures get ignored by local operators [1, 2].
- ONLINE NEWS Gallaga, O. (2026, October 12). Cyberattack Targets French Supermarket Refrigerators, Forcing Mass Food Disposal. CNET. [Article Link]
- ONLINE NEWS Gatlan, S. (2026, October 12). Cyberattack shuts down refrigerators at French supermarkets. BleepingComputer. [Article Link]
