Cyberattack on Danfoss Refrigeration Controls Hits Hundreds of French Supermarkets; Intermarché Owner Says 300 Stores Affected

CONFIRMED (retailer statements) / REPORTED (how it was done and what it cost): Two French grocery groups have confirmed that a cyberattack overnight on 11 to 12 October disabled refrigeration in their stores. Details of the method, the software versions and the losses come from BFMTV’s sector sources and have not been confirmed by Danfoss.

A cyberattack on refrigeration control systems made by Danish manufacturer Danfoss has hit hundreds of French supermarkets, forcing stores to throw away fresh and frozen food, BFMTV reported on 12 October [1].

The Groupement des Mousquetaires told BFMTV that 300 of its Intermarché and Netto stores were affected, double the first estimate of 150 [1]. Earlier on Monday, Intermarché gave AFP a figure of 150 to 200 stores and Le Figaro a figure of 100 to 150 [4][2]. Coopérative U told BFMTV that “moins d’une centaine” (fewer than 100) of its stores were hit [1]. (CONFIRMED)

“Suite à une cyberattaque qui aurait touché un prestataire de la gestion des systèmes frigorifiques dans les magasins, certains matériels frais et surgelés sont hors-services,” the Mousquetaires group said, adding that Intermarché and Netto had taken precautions to remove products from the affected equipment [1]. (TSN translation: “Following a cyberattack that reportedly affected a provider managing the stores’ refrigeration systems, some fresh and frozen equipment is out of service.”)

“Inédit. C’est inacceptable.”

Dominique Schelcher, president of Coopérative U, confirmed the attack on X, saying cold-production equipment at several of the group’s stores had been affected since the night [1][3]:

“S’attaquer à des équipements essentiels à la conservation des produits frais et à l’approvisionnement alimentaire des Français est d’une extrême gravité et est inédit. C’est inacceptable.”

(TSN translation: “Attacking equipment essential to keeping fresh produce and to feeding the French people is extremely serious and unprecedented. It is unacceptable.”)

He said an investigation should shed full light on the attack [3].

What happened, according to sector sources

Refrigeration control systems are the computers that run a store’s fridges and freezers: they hold temperature setpoints and schedule routine tasks such as defrosting. They are a form of operational technology (OT), software that controls physical equipment rather than handling data.

According to professionals in the sector quoted by BFMTV, the attack targeted older versions of Danfoss’s refrigeration control software, those before version 4 [1]. Defrosting normally runs for set periods, for example two hours in 24, to clear ice from equipment. The attackers reportedly forced a continuous defrost with a temperature setpoint of 50°C, so cabinets heated for hours instead of keeping goods cold [1]. “Une vague de chaleur s’est échappée” (“a wave of heat escaped”) when staff opened fridges and freezers in the morning, a sector source told BFMTV [1]. (REPORTED)

In some stores the attack reportedly started around midnight; stores hit later in the night saved some fresh goods [1]. The manager of the Intermarché in Haguenau, Sophie Matt, told Le Figaro that cabinets reached 36°C [2].

An internal Intermarché note dated 12 October, seen by BFMTV, refers to a cyberattack overnight “chez Danfoss” (at Danfoss) [1]. TSN found no incident statement from Danfoss. No source has named who carried out the attack or why. BFMTV said a crisis meeting was planned for 11:00 on Monday between refrigeration contractors, including Axima, and Danfoss [1].

The losses

All of these figures are estimates reported by BFMTV, not official tallies (REPORTED):

• Nationally: “plusieurs millions d’euros” (several million euros), according to a sector source quoted by BFMTV [1]; Le Figaro attributes the same estimate to the Groupement des Mousquetaires [2].
• Intermarché, Haguenau (Bas-Rhin): its entire frozen stock, about €50,000 [1][2].
• Leclerc, Wasselonne: frozen and fresh products, about €220,000 [1]. (BFMTV’s own summary describes the two hardest-hit Alsace stores as an Intermarché and a Super U; TSN follows the detailed account in BFMTV’s article.)

BFMTV also reported that Leclerc stores, and possibly Metro stores and independent butchers, were affected [1]. Leclerc had not confirmed this to AFP [4].

What is not known

• Who is behind the attack, and how they reached the control systems.
• Whether Danfoss has confirmed the version-4 detail or issued guidance to customers.
• The final number of stores affected across all chains, and the total cost.

Sources

1. BFMTV, “‘Extrême gravité, inédit et inacceptable’: une cyberattaque frappe les frigos de Leclerc, Intermarché et Super U”, 12 October 2026. https://www.bfmtv.com/economie/consommation/la-temperature-est-montee-jusqu-a-50-degres-une-cyberattaque-contre-les-systemes-frigorifiques-provoque-la-destruction-de-produits-frais-dans-des-centaines-d-intermarche-et-de-super-u_AN-202610120327.html
2. Le Figaro, “Une cyberattaque a touché les infrastructures frigorifiques de centaines de supermarchés Coopérative U et Intermarché”, 12 October 2026. https://www.lefigaro.fr/societes/une-cyberattaque-a-touche-les-infrastructures-frigorifiques-de-centaines-de-supermarches-cooperative-u-et-intermarche-20261012
3. 20 Minutes, quoting Dominique Schelcher on X, 12 October 2026. https://www.20minutes.fr/societe/4253570-20261012-intermarche-u-leclerc-installations-frigorifiques-supermarches-touchees-cyberattaque-gros-degats
4. La DH / Belga, citing AFP, 12 October 2026. https://www.dhnet.be/actu/monde/2026/10/12/des-supermarches-francais-victimes-dune-cyberattaque-sur-les-installations-frigorifiques-Z6YFSG6U2BHMZLJZD2TRZ3UZKA/

Related stories

• Fireworks AI Confirms Misuse of Internal Credentials and Capture of Customers’ Stored API Keys and Tokens
• Coldcard Says a Phishing Link Was Posted From Its Official X Account and It Is Still Investigating How
• Japan’s Commune Confirms About 307,000 Community Members’ Data Leaked
• SonicWall Attack Attempts, a $1.26m Pwn2Own and a Windows Update Deadline
• Cyber Breaches: SoftBank Cloud Ransomware, Qilin’s 53 Japanese Victims, Asos’s Bigger Leak and Denmark’s Register