French Supermarket Fridge Hack: Hundreds of Stores at 50C

§ 01What happened, by chain#

The figures are early and partly estimates: BFMTV first counted 150 Intermarché stores, then doubled it. Add the named chains together and the total is in the hundreds, likely above 400 stores, but no one has published a national count.

How it worked, according to BFMTV: the controllers that watch the cold chain can also trigger automatic defrost cycles, and the attackers forced “un dégivrage forcé et continu, avec une consigne de température fixée à 50 degrés”, a forced, continuous defrost with a setpoint of 50 degrees. Intermarché said its fridges ran at 50C for six hours, per Reuters as cited by the BBC. Staff opened freezers on Monday morning to hot air; BFMTV showed an ice cream aisle at 26.5C.

Picard, the frozen-food chain, was not affected. A spokesperson told Le Parisien that its cooling is controlled store by store, “il ne peut donc y avoir de prise de contrôle à distance”: no remote takeover is possible.

§ 02The response#

• Coopérative U. Its chief executive, Dominique Schelcher, posted on X at 08:40 UTC: “Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau”. He called the attack “d’une extrême gravité” and unprecedented.
• Paris prosecutor. The cybercrime section opened an investigation on its own initiative, handed to the national anti-cybercrime office (OFAC). It told AFP, per the BBC, that this was a “large-scale cyber-attack affecting the refrigerators of several major food retail chains across France”, and told Le Parisien there had also been “des départs de feu”: fires had started.
• The government. Prime Minister Sébastien Lecornu asked ANSSI, the national cybersecurity agency, to take up the case. His office told TF1 that the agency had found a vulnerability “dans un logiciel fourni par une société danoise”, in software supplied by a Danish company, and was in contact with its European counterparts because other countries could be affected.
• The EU. Food Commissioner Christophe Hansen wrote, per the BBC: “Food security requires more attention at all levels. Because the weaponisation of food has become a reality.”
• Danfoss. It told Le Parisien the devices were “appareils anciens qui sont arrivés en fin de vie et ne reçoivent plus de mises à jour logicielles ou de sécurité”: old devices at end of life that no longer receive software or security updates.

No group has claimed the attack, and no ransom demand has been reported.

§ 03The Danfoss flaws on the record#

Le Parisien reported that the attackers exploited a vulnerability “documentée cet été et non patchée” in old versions of the software. Neither Danfoss nor ANSSI has named the flaw. The public record on Danfoss’s supermarket system managers, the AK-SM 8xxA series, is this:

The summer date in Le Parisien’s account fits the research write-up rather than the advisories. On August 9, 2026, Claroty’s Team82 published its analysis of the AK-SM 800A, titled “Freeze the Controller, Defrost the Food”, describing a hidden code-of-the-day login mechanism that could bypass authentication. The researchers wrote that they had “identified thousands of publicly accessible management interfaces”. CISA’s advisory had said: “No known public exploitation specifically targeting these vulnerabilities have been reported to CISA at this time.”

What is not established: which flaw was used, whether the affected stores ran AK-SM 8xxA units or older Danfoss systems, and how the attackers reached them. Danfoss’s own words point at devices too old to receive the fixes at all.

§ 04What the losses look like#

There is no national figure. Two supermarkets in Alsace reported €270,000 of losses between them, BFMTV said, and Ouest-France reported €60,000 at one Super U in Maine-et-Loire. Stores threw out fresh and frozen stock as a health precaution; an Hyper U in Bourgueil told customers no fresh products would be on sale that day, per TF1.

§ 05The lesson for anyone wiring software into equipment#

The attack did not need to break anything. It used a feature, the remote defrost, that every store wants, through a management interface that sat where an outsider could reach it, on equipment that had stopped getting updates. Picard’s answer was architecture: no remote control at all.

The same three questions apply to any remote channel into physical operations, including the ones businesses now hand to AI agents:

• Which devices can be controlled from outside the building, and is each one still receiving security updates?
• Which settings can a remote session change, and is there a limit (a defrost cannot run at 50C for six hours) enforced on the device itself?
• Who is alerted when a setpoint changes overnight, and do they have to approve it?

§ 06Where CellCog sits#

Our conflict, declared: we build CellCog, where businesses hire AI employees. Nothing in this incident involved AI, and we have no relationship with Danfoss or the retailers. Our AI employees reach outside systems only through access their owner grants, and actions that change things in the world wait for the owner’s approval level; that is a design choice, not a guarantee against a vendor’s unpatched device.

§ 07What we are watching#

• Danfoss or ANSSI naming the flaw used, and whether other countries report the same attack.
• A national loss figure from the retailers or the prosecutor.
• Any claim of responsibility.

§ 08Update log#

• October 12, 2026: page opened, from French and British reporting, the Coopérative U statement, the Danfoss and CISA advisories and Claroty’s research.

§ 09Sources#

• BFMTV, cyberattack on supermarket refrigeration systems, October 12, 2026.
• Le Parisien, cyberattack against Intermarché and Super U refrigeration systems, October 12, 2026.
• TF1 Info, at least 150 stores affected, October 12, 2026.
• BBC News, Fridges in French supermarkets hit by cyber attack, October 12, 2026.
• Dominique Schelcher on X, October 12, 2026.
• Danfoss, security advisories DSA-2025-03-01 and DSA-2025-08-01; CISA, ICSA-25-140-03.
• Claroty Team82, Freeze the Controller, Defrost the Food, August 9, 2026.