Danfoss systems linked to French supermarket refrigeration cyberattack

A cyberattack on supermarket refrigeration systems overnight from October 11 to 12 forced equipment at hundreds of French stores into prolonged defrost cycles, spoiling fresh and frozen food. France’s Paris prosecutor has opened an investigation into the losses and reported fires. A final nationwide count and damage total are still unavailable, according to [AFP’s October 13 report](https://www.afp.com/en/french-supermarkets-suffer-refrigerator-shutdown-after-unprecedented-cyberattack). In its [October 13 report](https://www.lemonde.fr/en/economy/article/2026/10/13/a-disastrous-day-for-french-supermarkets-after-massive-cyberattack-targets-refrigeration-systems_6758535_19.html), Le Monde put the affected footprint at around 300 Intermarché and Netto stores, about 100 Coopérative U shops, 80 Carrefour stores, several E.Leclerc locations and roughly 30 Monoprix stores. [Reuters, reporting the previous day](https://www.reuters.com/business/retail-consumer/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stories-targeted-2026-10-12/), cited a lower Intermarché estimate and Monoprix’s figure of 5% of its roughly 490 French shops. These are dated, attributed snapshots rather than a final consolidated count. Le Monde also reported that wholesaler Metro was affected through an external service provider, while Metro said it checked that products remained safe; Picard said it was not affected. Some stores discarded all affected refrigerated stock to protect the cold chain. Le Monde reported that the national loss was not yet known and could reach several million euros or more, an estimate rather than a confirmed total. One shop owner it interviewed put his own loss at €21,000 at purchase cost. Several stores had to clear shelves or close temporarily; the reporting does not establish a national food shortage. The technical picture has sharpened. Le Monde reported that the attack involved Danfoss refrigeration-control software and that some settings were changed to raise temperatures and lengthen defrost cycles, delaying alarms. Danfoss told the newspaper that most affected units were obsolete and no longer received software or security updates. Separately, CERT-FR says it knows of numerous compromises of Danfoss AK-SM and AK-SC controllers, and urges operators to disconnect or tightly filter access. For suspected compromise it recommends restricting access to trusted service providers, factory resetting, applying fixes, rotating secrets, reviewing accounts and reconfiguring systems. [CERT-FR’s alert](https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/) This is more specific than the first reports, but investigators and Danfoss have not publicly identified a particular CVE or confirmed that a previously disclosed flaw was the route used in the supermarket attack. [Danfoss previously issued security advisories for its AK-SM 8xxA controllers](https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/); those disclosures alone do not establish how this incident happened. The attackers’ identity also remains unknown. The Paris prosecutor’s cybercrime office and France’s cybersecurity agency are investigating. For shoppers, the confirmed effects are discarded food and temporary disruption at affected branches. The next answers are whether the compromised controllers share a common exposure, how many sites and other cold-storage businesses were hit, and what the final losses are. Current reporting does not show that consumer data was stolen or that the Dutch retailer Ahold Delhaize incident was connected.