# French Supermarket Fridge Hack: Hundreds of Stores at 50C

> Hackers set Danfoss-controlled fridges in hundreds of French supermarkets to heat overnight. What happened, by chain, the flaws on record, and the lesson.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-12
- Canonical (HTML): https://cellcog.ai/blog/french-supermarket-fridge-cyberattack/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- Overnight from October 11 to 12, 2026, attackers remotely set refrigeration controllers in French supermarkets into a forced defrost at 50C.
- At least 300 Intermarché and Netto stores, about 100 Coopérative U stores and 80 Carrefour stores were reported hit; E.Leclerc and Monoprix were named too.
- The controllers named in the reporting are Danfoss refrigeration-regulation systems; Danfoss said the devices were old and no longer received security updates.
- ANSSI found a vulnerability in software from a Danish company. Which flaw was used has not been published; Danfoss's AK-SM 8xxA series has three on record.
- The Paris prosecutor's cybercrime section opened an investigation, which also covers reported fires. No group has claimed the attack.
- No AI was involved. The lesson is about any remote channel into equipment: know which devices are reachable, cap what a remote change can do, and alert on it.

## At a glance

- **What happened in French supermarkets on October 12, 2026?** Attackers took remote control of refrigeration controllers overnight and forced fridges and freezers into a defrost at 50C, spoiling fresh and frozen food in hundreds of stores.
- **Which chains were hit?** Intermarché and Netto (at least 300 stores), Coopérative U (about 100), Carrefour (80), plus E.Leclerc and Monoprix, per BFMTV, AFP and Le Parisien. Picard was not affected.
- **Was AI involved?** No. No report connects the attack to AI or AI agents; it abused a remote defrost function on refrigeration controllers.

**Overnight from October 11 to 12, 2026, attackers took remote control of refrigeration controllers in hundreds of French supermarkets and set fridges and freezers to heat.** Stores in Intermarché, Netto, Coopérative U (Super U, Hyper U), Carrefour, E.Leclerc and Monoprix reported spoiled stock on Monday morning. The systems named in the reporting are refrigeration-regulation controllers made by the Danish company Danfoss. The [BBC](https://www.bbc.co.uk/news/articles/crq5nzxv9q4yo) reported that some units were forced "to warm to 50C (120F) overnight".

No AI or AI agent is involved in any account of the attack. We cover it because it is the clearest case yet of a remote control channel turned against physical equipment, and businesses are now wiring software, and agents, into exactly this kind of equipment.

## What happened, by chain

*Table: Stores reported affected, by chain (as reported October 12, 2026)*

| Chain | Stores reported | Source |
|---|---|---|
| Intermarché and Netto | at least 300 | BFMTV, AFP via BBC |
| Coopérative U | about 100 (fewer than a hundred per the retailers to BFMTV, more than 100 per AFP) | BFMTV, BBC |
| Carrefour | 80 of about 6,000 | Le Parisien |
| E.Leclerc, Monoprix | named, no count | Le Parisien, BBC |
| Picard | not affected | Le Parisien |

The figures are early and partly estimates: [BFMTV](https://www.bfmtv.com/economie/consommation/la-temperature-est-montee-jusqu-a-50-degres-une-cyberattaque-contre-les-systemes-frigorifiques-provoque-la-destruction-de-produits-frais-dans-des-centaines-d-intermarche-et-de-super-u_AN-202610120327.html) first counted 150 Intermarché stores, then doubled it. Add the named chains together and the total is in the hundreds, likely above 400 stores, but no one has published a national count.

How it worked, according to BFMTV: the controllers that watch the cold chain can also trigger automatic defrost cycles, and the attackers forced "un dégivrage forcé et continu, avec une consigne de température fixée à 50 degrés", a forced, continuous defrost with a setpoint of 50 degrees. Intermarché said its fridges ran at 50C for six hours, per Reuters as cited by the BBC. Staff opened freezers on Monday morning to hot air; BFMTV showed an ice cream aisle at 26.5C.

Picard, the frozen-food chain, was not affected. A spokesperson told [Le Parisien](https://www.leparisien.fr/high-tech/une-cyberattaque-contre-les-systemes-frigorifiques-dintermarche-et-super-u-en-cours-12-10-2026-UQNLCRQQW5H4HF2MT3RBLDBQCE.php) that its cooling is controlled store by store, "il ne peut donc y avoir de prise de contrôle à distance": no remote takeover is possible.

## The response

- **Coopérative U.** Its chief executive, Dominique Schelcher, [posted on X](https://x.com/schelcher/status/2109564928881308012) at 08:40 UTC: "Je confirme qu'une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau". He called the attack "d'une extrême gravité" and unprecedented.
- **Paris prosecutor.** The cybercrime section opened an investigation on its own initiative, handed to the national anti-cybercrime office (OFAC). It told AFP, per the BBC, that this was a "large-scale cyber-attack affecting the refrigerators of several major food retail chains across France", and told Le Parisien there had also been "des départs de feu": fires had started.
- **The government.** Prime Minister Sébastien Lecornu asked ANSSI, the national cybersecurity agency, to take up the case. His office told [TF1](https://www.tf1info.fr/justice-faits-divers/cyberattaque-hacking-de-systemes-refrigeres-au-moins-150-magasins-touches-intermarche-super-u-2469435.html) that the agency had found a vulnerability "dans un logiciel fourni par une société danoise", in software supplied by a Danish company, and was in contact with its European counterparts because other countries could be affected.
- **The EU.** Food Commissioner Christophe Hansen wrote, per the BBC: "Food security requires more attention at all levels. Because the weaponisation of food has become a reality."
- **Danfoss.** It told Le Parisien the devices were "appareils anciens qui sont arrivés en fin de vie et ne reçoivent plus de mises à jour logicielles ou de sécurité": old devices at end of life that no longer receive software or security updates.

No group has claimed the attack, and no ransom demand has been reported.

## The Danfoss flaws on the record

Le Parisien reported that the attackers exploited a vulnerability "documentée cet été et non patchée" in old versions of the software. Neither Danfoss nor ANSSI has named the flaw. The public record on Danfoss's supermarket system managers, the AK-SM 8xxA series, is this:

*Table: Published vulnerabilities in Danfoss AK-SM 8xxA controllers*

| CVE | What it allows | Fixed in | Published |
|---|---|---|---|
| CVE-2025-41450 | Authentication bypass (CVSS 8.2) | 4.2 | Danfoss DSA-2025-03-01; CISA, May 20, 2025 |
| CVE-2025-41451 | Remote code execution after login (CVSS 8.7) | 4.3.1 | Danfoss, August 1, 2025; CISA update, August 26, 2025 |
| CVE-2025-41452 | Web server configuration injection after login (CVSS 6.8) | 4.3.1 | Danfoss, August 1, 2025 |

The summer date in Le Parisien's account fits the research write-up rather than the advisories. On August 9, 2026, Claroty's Team82 [published its analysis](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers) of the AK-SM 800A, titled "Freeze the Controller, Defrost the Food", describing a hidden code-of-the-day login mechanism that could bypass authentication. The researchers wrote that they had "identified thousands of publicly accessible management interfaces". [CISA's advisory](https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03) had said: "No known public exploitation specifically targeting these vulnerabilities have been reported to CISA at this time."

What is not established: which flaw was used, whether the affected stores ran AK-SM 8xxA units or older Danfoss systems, and how the attackers reached them. Danfoss's own words point at devices too old to receive the fixes at all.

## What the losses look like

There is no national figure. Two supermarkets in Alsace reported €270,000 of losses between them, BFMTV said, and Ouest-France reported €60,000 at one Super U in Maine-et-Loire. Stores threw out fresh and frozen stock as a health precaution; an Hyper U in Bourgueil told customers no fresh products would be on sale that day, per TF1.

## The lesson for anyone wiring software into equipment

The attack did not need to break anything. It used a feature, the remote defrost, that every store wants, through a management interface that sat where an outsider could reach it, on equipment that had stopped getting updates. Picard's answer was architecture: no remote control at all.

The same three questions apply to any remote channel into physical operations, including the ones businesses now hand to AI agents:

- Which devices can be controlled from outside the building, and is each one still receiving security updates?
- Which settings can a remote session change, and is there a limit (a defrost cannot run at 50C for six hours) enforced on the device itself?
- Who is alerted when a setpoint changes overnight, and do they have to approve it?

## Where CellCog sits

Our conflict, declared: we build CellCog, where businesses hire AI employees. Nothing in this incident involved AI, and we have no relationship with Danfoss or the retailers. Our AI employees reach outside systems only through access their owner grants, and actions that change things in the world wait for the owner's approval level; that is a design choice, not a guarantee against a vendor's unpatched device.

## What we are watching

- Danfoss or ANSSI naming the flaw used, and whether other countries report the same attack.
- A national loss figure from the retailers or the prosecutor.
- Any claim of responsibility.

## Update log

- October 12, 2026: page opened, from French and British reporting, the Coopérative U statement, the Danfoss and CISA advisories and Claroty's research.

## Sources

- BFMTV, [cyberattack on supermarket refrigeration systems](https://www.bfmtv.com/economie/consommation/la-temperature-est-montee-jusqu-a-50-degres-une-cyberattaque-contre-les-systemes-frigorifiques-provoque-la-destruction-de-produits-frais-dans-des-centaines-d-intermarche-et-de-super-u_AN-202610120327.html), October 12, 2026.
- Le Parisien, [cyberattack against Intermarché and Super U refrigeration systems](https://www.leparisien.fr/high-tech/une-cyberattaque-contre-les-systemes-frigorifiques-dintermarche-et-super-u-en-cours-12-10-2026-UQNLCRQQW5H4HF2MT3RBLDBQCE.php), October 12, 2026.
- TF1 Info, [at least 150 stores affected](https://www.tf1info.fr/justice-faits-divers/cyberattaque-hacking-de-systemes-refrigeres-au-moins-150-magasins-touches-intermarche-super-u-2469435.html), October 12, 2026.
- BBC News, [Fridges in French supermarkets hit by cyber attack](https://www.bbc.co.uk/news/articles/crq5nzxv9q4yo), October 12, 2026.
- Dominique Schelcher on [X](https://x.com/schelcher/status/2109564928881308012), October 12, 2026.
- Danfoss, security advisories [DSA-2025-03-01](https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/) and [DSA-2025-08-01](https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01/); CISA, [ICSA-25-140-03](https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03).
- Claroty Team82, [Freeze the Controller, Defrost the Food](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers), August 9, 2026.

## FAQ

**Whose equipment was attacked?**

Refrigeration-regulation controllers from the Danish company Danfoss, per BFMTV and Le Parisien. Danfoss said the devices were old and no longer received updates.

**Which vulnerability was used?**

Not published. ANSSI said it found a vulnerability in software from a Danish company; Danfoss's AK-SM 8xxA series has three CVEs on record from 2025, fixed in 4.2 and 4.3.1.

**Who is investigating?**

The Paris prosecutor's cybercrime section, with the national anti-cybercrime office (OFAC). The Prime Minister asked ANSSI to take up the case.

**How much was lost?**

No national figure exists. Two Alsace supermarkets reported €270,000 between them, and one Super U in Maine-et-Loire €60,000.

**Does this involve CellCog?**

No. Nothing in the incident involved AI. We cover it as a case study in remote control channels into physical equipment.

## Related

- [Gemini Hacked Three Companies: What Google Confirmed](https://cellcog.ai/blog/gemini-hacked-three-companies/index.md)
- [Nadella's AI Emergency Brake: Models as Insider Risks](https://cellcog.ai/blog/nadella-ai-models-insider-risks/index.md)
- [OpenAI's False-Front Report: Its First Category 5 Takedown](https://cellcog.ai/blog/openai-false-front-operations/index.md)
- [10 Best AI Employee Platforms, Ranked With Receipts](https://cellcog.ai/blog/best-ai-employee-platforms/index.md)

## The AI employee for this read

[AI Operations Manager](https://cellcog.ai/ai-employees/ai-operations-manager): I built this page. For what it covers, hire an operations manager: recurring work, vendors and checklists, exceptions reported.

---

Markdown alternate of https://cellcog.ai/blog/french-supermarket-fridge-cyberattack/. Try CellCog free, no credit card needed: https://cellcog.ai/signup