What Happened

Intermarché and Coopérative U said a cyberattack that hit Sunday night into Monday, Oct. 11-12, made refrigerators and freezers defrost in hundreds of stores across France, Agence France-Presse reported Monday. AFP put the number of targeted stores at about 150 to 200 Intermarché locations and almost 100 Coopérative U outlets. BFMTV reported about 300 Intermarché and Netto stores and fewer than 100 Coopérative U stores, according to The Record. Those figures are provisional and vary by source.

Les Mousquetaires, which operates Intermarché, gave franceinfo a first tally of about 100 affected stores out of roughly 3,600 in France, and franceinfo put the number of affected Système U stores at fewer than 100.

Les Mousquetaires said Danfoss, the company that manages its refrigerated display units, was the target of the attack and that temperatures were set to 50°C (122°F), according to Agence Radio France as carried by franceinfo. BFMTV reported that the attackers targeted older versions of Danfoss software, according to The Record; Danfoss has not confirmed that. Danfoss had made no public statement as of Monday morning, and AFP's report does not mention the company. Les Mousquetaires said it would be up to Danfoss to file a criminal complaint.

RelatedFrance Widens Fridge-Hack Alert to More Controllers as Store Count Passes 350

Coopérative U Chief Executive Dominique Schelcher said on X that cooling equipment in several stores had been affected since Sunday night. He called the attack “unprecedented” and “extremely serious,” said teams were working with refrigeration technicians and said an investigation is needed.

Intermarché told AFP that affected stores must discard all fresh and frozen products. The chain condemned the food waste and financial losses without giving figures and warned that insurance may not cover this kind of in-store incident. Franceinfo reported that a bailiff must first record the losses.

The Paris prosecutor's office told AFP it has opened an investigation into a large-scale attack on refrigerators at several major food retail chains. The investigation aims to identify victims and link them to food losses and to reported outbreaks of fire. Other chains have been named in French media but had not confirmed to AFP that they were affected.

France's national cybersecurity agency, ANSSI, said it was mobilized to handle the incident and was coordinating with European counterparts, The Record reported.

Why It Matters

Supermarket cooling runs on small controllers coordinated by a central system manager that logs temperatures, raises alarms and schedules defrost cycles. That operational technology controls physical equipment, and suppliers often reach it remotely. The damage in this case is physical: spoiled stock and, according to prosecutors, fires.

For retail and cold-storage leaders, the attack raises practical questions about who outside the company can reach these controls, whether the systems are patched and isolated from the internet and corporate networks, how quickly stores would detect and respond to temperature changes, and whether insurance covers physical losses from a supplier-side cyberattack.

Equipment Context

No link has been published between this attack and any known vulnerability. Danfoss, a Danish company, also sells its System Manager line, including the AK-SM 800A, to food retailers in the U.S. A CISA advisory first issued May 20, 2025, and updated Aug. 26, 2025 (ICSA-25-140-03), described three flaws in Danfoss AK-SM 8xxA system managers, which Danfoss fixed in software versions R4.2 and R4.3.1. CISA reported no public exploitation at the time and urged operators to keep the devices off the internet and separate from business networks.

What to Watch

Key questions include which chains and stores were hit as the prosecutor's investigation proceeds, whether Danfoss confirms the retailer's account and issues guidance to customers elsewhere, the size of the losses and whether insurers pay, and whether investigators identify who carried out the attack.

Sources

  • Agence France-Presse
  • franceinfo and Agence Radio France
  • Les Mousquetaires (Intermarché)
  • Dominique Schelcher, Coopérative U, on X
  • Paris prosecutor's office (via AFP)
  • CISA advisory ICSA-25-140-03
  • The Record (Recorded Future News)