Hundreds of French supermarkets have had their refrigeration systems hacked.
The cybersecurity incident has resulted in food loss at multiple stores after the hackers reportedly turned up heating systems to maximum temperatures.
Dominique Schelcher, president of supermarket chain Coopérative U said: [translated from French]: “I can confirm that a cyberattack has been affecting the refrigeration systems of several stores in our Coopérative U network since last night.
Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU.
— Dominique Schelcher (@schelcher) October 12, 2026
Nos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra…
According to Le Parisien, Carrefour also confirmed being affected. The supermarket group told the newspaper that 80 supermarkets out of its 6,000 stores were affected.
French cybersecurity expert Clement Domingo attributed the attack to a vulnerability in systems from Denmark-headquartered industrial systems vendor Danfoss; one of the world’s biggest refrigeration and HVAC equipment providers worldwide.
The Danfoss vulnerabilities exploited remained contested as The Stack published.
Security firm Claroty in August said it had reported a trio of bugs in AK-SM 800A. That’s a centralised system manager from Danfoss responsible for coordinating refrigeration controllers. (CVE-2025-41450, CVE-2025-41451, CVE-2025-41520.)
Exploiting these, the operational technology (OT) specialist said, “we gained access to the device's full administrative interface and every management function it exposed.”
As well as letting them “configure temperature thresholds”, exploitation, access to the management plane exposed “a wide range of configuration pages for network settings, alarm management, user administration…logging, and system maintenance.”
Clarity added: “Industrial control systems are often assumed to be safely tucked away on isolated networks. Unfortunately that assumption doesn't always hold true.”
It saw over 2,700 facing the public internet.
Operational Technology (OT) is typically irregularly patched at best, as systems operators do not want to accommodate disruptive downtime in supermarkets, factories or other industrial environments. It is being increasingly targeted.
Technology systems operators in the OT space are also under immense pressure to connect more IT systems to their OT ones. That might be to run proactive maintenance, reduce energy consumption, or harvest data to build digital twins.
Other Danfoss vulnerabilities are troubling
Danfoss in September meanwhile also issued an advisory for a critical (CVSS 9.3) security vulnerability, allocated CVE-2026-15203 that affects a trio of its products,
These impact its Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 systems. (Those, respectively, are an industrial variable frequency drive – a device that controls the speed and torque of an AC electric motor; an inverter for propulsion and ship machinery; and a power convertor that moves and conditions electrical energy between batteries, generators, DC buses and the grid…)
Danfoss said the products expose “debug interfaces by default, allowing unauthorized access to internal data, uploading unsigned applications, and modifying firmware.”
Exploitation of Danfoss vulnerability CVE-2026-15203 means any user can “upload and execute unsigned applications, and upload unsigned EEPROM* data and firmware via exposed service interfaces and software update mechanisms” it said.
The Stack could not immediately independently confirm that exploitation of Danfoss vulnerabilities was to blame. We have contacted Danfoss for comment.
Muhammad Yahya Patel from cybersecurity firm Huntress commented: “The refrigeration systems in supermarkets are operational technology. Building management controls, HVAC, cold chain infrastructure. These are the same category of systems that the security industry has been warning about as the next frontier for sabotage attacks.
“The… consequences are significant and visible. Failures at the stores mean total write-off of perishable stock across every affected location simultaneously. The operational disruption compounds quickly…The food retail sector across Europe should be treating this as a signal that they are being actively targeted.”
