A cyberattack reportedly targeted Danfoss refrigeration controllers at several major French supermarket chains, and attackers used the controllers' own defrost function to run them warm overnight. According to BleepingComputer's October 12, 2026 report, victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, with French outlets reporting that between 250 and 350 stores were affected. The same reporting describes significant financial losses and food waste.
That last part matters, so let me be precise about it from the start: the store count, the losses, and the waste are what French outlets reported and what chain executives confirmed. They are not independently verified totals. As a security & compliance analyst, I treat the difference as the whole job. Here is what the reporting actually establishes, and where it stops.
What Happened, Per the Reporting
The attack landed on a Sunday night. Per BleepingComputer, threat actors hijacked refrigeration controllers running older versions of Danfoss control software and used them to raise refrigerator temperatures by triggering a built-in automatic defrosting system. Nothing exotic. No custom refrigeration malware is described. The operators abused a feature that is supposed to keep the equipment working.
An Intermarché spokesperson told BleepingComputer the attack "reportedly affect[ed] a service provider that manages refrigeration systems in stores," leaving some fresh and frozen food display units out of service. The spokesperson said Intermarché and Netto moved to pull products from the affected units quickly, and that the chain had no specific list of affected stores to share. That is a notable gap: even the victim could not, at the time of reporting, say exactly which stores were hit.
Coopérative U president Dominique Schelcher confirmed the incident and said it hit multiple stores across the Cooperative U network, with teams working alongside refrigeration specialists and an investigation to follow. Schelcher called the targeting of equipment "essential for preserving fresh produce and supplying food to the French people" serious and unprecedented. EU agriculture and food commissioner Christophe Hansen condemned the attack and named Leclerc, France's largest chain, as one of the victims.
The Defrost Trick, in Plain Terms
It is worth sitting with how low-tech the mechanism is. A commercial refrigeration unit runs a compressor to stay cold and periodically runs a defrost cycle to melt ice off the coils, which temporarily warms the cabinet by design. The attackers, per the reporting, forced that built-in cycle. They did not need to break thermodynamics. They just told the controller it was time to defrost, repeatedly, across a fleet, while staff slept.
This is the part that should bother OT and compliance teams more than any novel exploit. The destructive action was a legitimate command. Your monitoring, if it watches for anomalies at all, sees a controller doing exactly what it was built to do.
Known Flaws, Public Exposure
The reporting is careful to say there is no information yet on how the controllers were actually compromised. It then lays out the surrounding vulnerability picture, and I want to keep these as context, not as a proven root cause.
Per the report, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned in May 2025 of an authentication bypass, CVE-2025-41450, and in August 2025 of a command injection flaw, CVE-2025-41451, in the Danfoss AK-SM 8xxA Series hardware platform that manages refrigeration and HVAC systems commonly found in food retail. Claroty's Team82 research team, credited in the report with finding both flaws, published a write-up in August on chaining them into remote code execution on publicly accessible Danfoss AK-SM 800A management interfaces.
On exposure, the report cites Predicta Lab CEO Baptiste Robert finding 2,752 Danfoss systems exposed online, 1,590 of them in France, with Shodan separately tracking more than 4,500 reachable Danfoss devices.
Read those numbers as exposure, not as the attack path. The source does not connect the CVEs to this incident. Plausible is not proven.
Investigation and Statements
The Paris prosecutor's office told AFP it opened an investigation into the "large-scale cyberattack affecting the refrigerators of several major food retail chains across France," and that the inquiry aims to identify victims and "establish the link with the damage they reported in terms of foodstuff losses and the outbreak of fires." I am quoting the scope of the investigation, not declaring that fires or poisoning occurred. The prosecutor is investigating a reported link. Whether damage of that severity actually happened is exactly what the investigation has not yet established.
The report also notes that, with no evidence connecting the two events, retail giant Ahold Delhaize separately announced the same Monday that it had taken some systems offline after a "cybersecurity incident." Spokespersons for Danfoss, Leclerc, and Coopérative U were not immediately available for comment.
A Security & Compliance Analyst's Read
Now my own opinion, clearly separated from the reporting above.
First, the most credible thread is third-party management. Intermarché's own spokesperson pointed at a service provider that manages store refrigeration. A shared vendor bridging many stores into one controller estate is a single point of failure dressed up as convenience. Compliance programs routinely assess the IT vendor and ignore the "the refrigeration company has remote access" line item, because that access never appears in the identity inventory.
Second, this exposes a monitoring blind spot. OT telemetry from refrigeration controllers rarely lands in the same console an analyst watches for IT threats. The Security, Compliance, and Identity tooling most teams run around Microsoft 365 does not see a defrost command on an AK-SM controller. The "Microsoft Learn" documentation for those IT-side capabilities is solid, and it simply is not aimed at a compressor. That is an architecture problem, not a documentation gap, and calling it out is analysis on my part rather than a reported fact.
If you want a deeper pass on the firmware-and-OT angle, I covered related exposure in When Legacy OT Firmware Becomes a Thermal Hazard.
What to Take From This
Stay on the verified ground. Attackers reportedly pushed defrost cycles at 250 to 350 French stores via Danfoss controllers running older software, and the named chains, the EU commissioner, and the Paris prosecutor have all spoken about it. The exact intrusion method, the confirmed store count, and whether the most alarming reported damage actually occurred remain open questions.
For analysts, the lesson is narrower and more useful than "OT is scary." Map the remote-access vendors. Get controller telemetry into view. And when a headline pairs a scary number with a CVE from months earlier, resist the urge to draw the line between them until someone does.