French supermarket chains lost refrigerated stock overnight on 11-12 October 2026 after a cyberattack against store refrigeration. Attackers remotely triggered defrost cycles and, according to BFMTV, set temperatures as high as 50C.

What happened

Dominique Schelcher, CEO of Cooperative U, confirmed on 12 October that cold-production equipment at several stores in the network had been hit since the previous night. He called the attack unprecedented and said teams were working with refrigeration specialists to restore service.

BFMTV reported that the affected systems are administered with software from Danish vendor Danfoss, and that outdated versions of the refrigeration control software were targeted. Infosecurity Magazine, citing BFMTV, said about 150 Intermarche stores were assessed as affected. Two stores in Haguenau, an Intermarche and a Super U, had already lost about 270,000 euros of merchandise.

This is a developing incident. Infosecurity said Cooperative U, Intermarche, E. Leclerc, and Danfoss had been asked for comment. No CVE has been named for this attack. Do not assume it is one of the older Danfoss controller bugs published by researchers.

Who is affected

Confirmed public impact is on French retail cold chain, not a generic IT outage. The pattern matters to any operator of internet-reachable refrigeration, HVAC, or building controllers, including food sites and industrial plants.

• Cooperative U confirmed several of its stores were hit.
• BFMTV assessed about 150 Intermarche stores affected.
• Other French chains have been named in reporting, but those claims were still unverified when Infosecurity published.

What to do now

Inventory internet-exposed refrigeration and building controllers, take their management interfaces off the public internet, and confirm they are not running outdated vendor software.

Segment OT from store Wi-Fi and guest networks. Alert on unexpected setpoint changes, especially defrost or temperature commands outside maintenance windows. A controller that can be reached from the internet is an operations incident waiting, not only a cyber one.

Source: Infosecurity Magazine, 12 October 2026. Major French Supermarket Chains Hit by Cyber-Attack, Food Stock Impacted.

Also on the blog

• CVE-2026-102255: SonicWall SMA1000 CVSS 10.0 SSRF under attack
• CVE-2026-97229: GitLab CI/CD regex compiler CVSS 10.0 RCE
• Ledger finds unauthorized implant in CryptoBilis-sold wallets
• Palo Alto CVE-2026-0257 Still Used for Ransomware VPN Access

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.