On the night of 11 October and into Monday morning, refrigeration controllers at French supermarkets were taken over remotely. Fridges and freezers warmed product instead of cooling it. Staff arrived to spoiled stock. This is a separate incident from the Ahold Delhaize outage the same day.

What happened

BFMTV reported that hundreds of stores were hit through refrigeration control systems made by Danish firm Danfoss. An internal Intermarche note dated 12 October, which the outlet said it had seen, described a cyberattack overnight at Danfoss. A crisis call that morning brought in Danfoss and Axima, which installs and maintains the equipment.

Chains named in reporting include Groupement Mousquetaires (Intermarche, Netto), Cooperative U (Super U, Marche U), and Leclerc. Jonathan Le Borgne, who covers French grocery retail, said Carrefour Market and Monoprix were hit as well, and that the attackers took control of remotely manageable Danfoss controllers. Shops that were altered closer to opening, or whose managers got an alert, saved some product. Others reported losses in the tens or hundreds of thousands of euros. Help Net Security said there is no sign this is linked to the Ahold Delhaize incident.

In early August 2026, Claroty Team82 disclosed flaws in the web management interface of Danfoss AK-SM 800A controllers, and a separate set in Copeland XWEB Pro units. Both vendors shipped firmware. Some of those bugs could let an attacker hijack a controller and interfere with the refrigeration it runs. Nobody has confirmed those CVEs were used here. A similar defrost-mode failure hit US military commissary fridges in late August. That one was never officially confirmed as a cyber intrusion.

Who is affected

French grocery operators running Danfoss refrigeration controllers that can be reached remotely, and any site that copied that pattern: a cold-chain controller on a vendor VPN, a flat network, or the public internet. Food retail, pharma cold rooms, and cold storage in logistics are the same design. Loss here is product and trading hours, not a stolen database.

• Intermarche, Netto, Super U, Marche U, and Leclerc stores were named.
• Carrefour Market and Monoprix were also reported affected.
• Any site with a remotely reachable Danfoss refrigeration controller.

What to do now

Find every refrigeration and building controller that accepts a remote session, take it off the internet, and confirm it is on the vendor firmware released after the August disclosures. Alert on unexpected setpoint changes, especially defrost or temperature overrides outside maintenance windows. If a contractor manages the panel, ask who else can log in and whether returned or shared credentials are still valid.

Source: Help Net Security, Cyberattacks hit European grocers: French supermarket freezers hijacked.

Also on the blog

• CVE-2026-102255: SonicWall SMA1000 CVSS 10.0 SSRF under attack
• GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE
• Ahold Delhaize takes systems offline after network security incident
• Midnight Mimosa: budget Android phones ship with uninstallable malware

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.