Attackers remotely manipulated supermarket refrigeration systems in France overnight on October 11–12, 2026. Some fridges and freezers reportedly reached 50°C (122°F), spoiling fresh and frozen food; fires were also reported. Hundreds of stores were affected, but published counts differ, and the precise method used to gain access has not been established in the available reporting.
3
5
17
What happened overnight
The attack targeted refrigeration controls, not checkout systems. Reports say the equipment was forced into defrost mode, keeping the units from cooling and causing temperatures to rise. Danfoss refrigeration controllers were implicated, though the exact route attackers used to access the systems remains unclear.
20
31
11
Les Mousquetaires, the group behind Intermarché, said around 150 of its stores were hit and that some refrigeration units reached 50°C for six hours. Reuters also reported that Carrefour said 80 of its supermarkets were affected. Across the country, spoiled stock and fires were reported.
5
17
How many stores were affected?
The figures vary by outlet and retailer. Some reports describe stores directly affected; others use broader estimates or include locations targeted. The available reporting does not consistently distinguish between those categories, so the counts should not be added together as a definitive total.
- Intermarché and Netto: Reuters reported around 150 Les Mousquetaires stores affected. Other early reports put the number of Intermarché and Netto locations targeted at 300 or more.
5
12
- Coopérative U: Its chief executive publicly confirmed that refrigeration systems at “several stores” were affected. Other reports put the number above 100.
1
12
- Carrefour: The company said 80 supermarkets were hit.
17
- Monoprix: Reuters reported that 5% of its approximately 490 French stores were affected.
17
- E. Leclerc: The chain was named among those affected, but the available sources do not provide a dependable store count.
3
These differences may reflect different reporting times or definitions, but the available sources do not establish why the numbers diverge.
What is known about the refrigeration systems
Reporting identifies Danfoss-made refrigeration management equipment as the apparent target. Danfoss said it was aware of incidents in France involving a limited number of systems; a separate report said many affected units were legacy products or were running outdated firmware.
17
31
Researchers have also discussed security risks in internet-connected refrigeration systems. That broader context does not establish which vulnerability, if any, was used in this attack: the method of access has not been confirmed in the supplied reporting.
11
33
Investigation and what remains uncertain
The Paris prosecutor’s office opened an investigation into the attack. A report citing a source close to Prime Minister Sébastien Lecornu said France’s cybersecurity agency, ANSSI, had identified a vulnerability in Danfoss software. The available reports do not establish whether that vulnerability was the one used by the attackers.
41
17
The incident shows how an attack on connected operational equipment can cause physical disruption: in this case, spoiled food and reported fires, rather than only a loss of access to digital services. But the attacker’s identity and the exact technical route into the refrigeration systems remain unknown in the supplied sources.
17
11