Cyber-Attack Hits French Supermarkets, Disrupts Food Refrigeration and Causes Losses

What happened to French supermarkets?

On 11 October 2026, several major supermarket chains in France, including Coopérative U (which operates Hyper U, Super U, U Express and Utile), Intermarché, E. Leclerc, Carrefour and Monoprix, were reportedly hit by a cyber-attack. The attack targeted the refrigeration systems in many stores, causing temperatures to rise and leading to the spoilage of fresh food stock. According to the CEO of Coopérative U, Dominique Schelcher, the attack affected several stores and was described as “of utmost gravity, unprecedented [and] unacceptable.” Infosecurity Magazine↗ (opens in a new tab)

How did the attack work?

Reports suggest that the attackers compromised systems managed by Danfoss, a Danish company that supplies refrigeration control software. Outdated versions of this software were reportedly targeted. According to French news channel BFMTV, hackers managed to remotely trigger forced defrost cycles in supermarket refrigeration units, causing temperatures to spike as high as 50°C (122°F). This led to significant food spoilage, with two supermarkets in Haguenau alone losing €270,000 worth of merchandise.

Who is affected and what is the scale?

The attack is reported to have affected at least 150 Intermarché stores and several other major supermarket chains. The full extent of the impact is still being investigated. Coopérative U’s CEO stated that their teams are working with refrigeration specialists to restore normal operations. Other affected companies have not yet issued public statements. The Danish supplier, Danfoss, is expected to address the incident at an upcoming trade fair, where it will present new products with improved cybersecurity features.

Previous warnings and vulnerabilities

Danfoss refrigeration controllers have previously been found to contain serious security flaws. Vulnerabilities such as CVE-2023-25915, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452 could allow attackers to gain privileged access and manipulate physical equipment. Research presented by Claroty’s Team82 at DEF CON 34 in August 2026 showed that attackers could disable cooling and falsify temperature readings, making it harder to detect problems. These findings highlight the risks of connecting industrial control systems to the internet without proper security measures, such as authentication and regular software updates.

What happens next?

This story is still developing. Investigations are underway to determine exactly how the attack was carried out and how many stores and companies are affected. Coopérative U, E. Leclerc, Intermarché and Danfoss have been contacted for comment. The incident has raised questions about the security of critical infrastructure in the retail sector and the need for regular updates and strong authentication on industrial systems. Supermarkets and their suppliers will likely review their security practices in response.

What should affected organisations do?

Supermarkets and other businesses using industrial control systems should review their security controls, ensure all software is up to date, and restrict remote access where possible. Regular vulnerability assessments and incident response planning are essential to reduce the risk of similar attacks. If you shop at affected stores, there is no evidence that customer data was compromised, but food safety may be temporarily affected in some locations.