Dominique Schelcher, CEO of Coopérative U, confirmed the attack on X Monday morning. "Attacking equipment essential to the preservation of fresh products and to supplying food to the French public is of utmost gravity and is unprecedented," he wrote. His teams, he said, were working alongside refrigeration specialists to restore operations.
The attack began overnight from Sunday October 11 into Monday, October 12, 2026. According to French news channel BFMTV, the compromised systems are administered by Danish refrigeration provider Danfoss, and the attackers targeted outdated versions of the manufacturer's control software.
The attack struck not at checkout systems or customer databases, but at the refrigeration units themselves. Hackers triggered forced defrost cycles remotely, with temperature setpoints pushed as high as 50°C. A freezer running at minus 20°C overnight suddenly heating to plus 30°C, store closed, staff home asleep. By the time morning crews arrived, the damage was done.
Losses Are Mounting
BFMTV reported that two supermarkets alone, an Intermarché and a Super U, already recorded losses of €270,000 ($302,000) in Haguenau, in the Alsace region. The outlet assessed that 150 Intermarché stores, part of Groupe Mousquetaires, are affected. An E.Leclerc store in the same town was also hit, though its losses had not yet been calculated.
Other reportedly affected networks include E.Leclerc, Carrefour, and Monoprix, along with Metro stores and independent businesses like butcher shops. Groupement Mousquetaires, Intermarché's parent company, estimates the total losses at "several million euros."
In an internal message, Coopérative U acknowledged the ongoing attack and confirmed that, in the worst cases, entire fresh food sections had to be discarded.
A Vulnerability That Was Already Known
The attack exploited vulnerabilities that security researchers had publicly documented. Research presented by Claroty's Team82 at DEF CON 34 in August 2026 demonstrated how a compromised AK-SM 800A controller could disable cooling while falsifying temperature readings, potentially concealing failures in the cold chain.
Claroty's research uncovered a hidden "code-of-the-day" authentication mechanism that could be abused to bypass normal authentication, along with a command-injection vulnerability leading to remote code execution. The analysis found thousands of publicly accessible management interfaces.
Danfoss addressed the three vulnerabilities in firmware version R4.3.1 and advised operators of affected AK-SM 800A controllers to upgrade. According to BFMTV, the hackers in this attack targeted versions of the Danfoss software older than version 4.
Stores running outdated firmware on internet-exposed controllers were sitting targets. The vulnerability disclosure was two months ago. The firmware patch existed. The attack happened anyway.
No Perpetrators Identified
French authorities and the affected companies are still investigating. The identity of the attackers has not been confirmed. No ransomware note has been publicly reported, and the attack appears to have been purely destructive rather than extortive.
The incident underscores how operational technology in retail environments remains a blind spot for many organizations. Claroty noted in its earlier research that predictable credentials, internet-exposed management interfaces, and slow adoption of firmware updates continue to leave critical systems vulnerable. Refrigeration systems are easy to overlook as attack surfaces until the food spoils.
"Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible," Schelcher wrote. "An investigation will be needed to shed full light on this attack."
The full extent of the damage remains unknown. Some stores may not have realized they were affected until inventory checks revealed ruined stock. Technical investigations are ongoing.
