Several chains of supermarkets in France have reportedly been hit by a cyber-attack targeting the refrigeration facilities of several stores across the country.

Affected companies include Coopérative U, a retail cooperative encompassing supermarkets branded as Hyper U, Super U, U Express and Utile, Groupement Mousquetaire's Intermarché and Carrefour.

In a post on X published on October 12, Dominique Schelcher, CEO of Cooperative U, confirmed the cyber-attack affected several stores in the network from October 11.

“Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be needed to shed full light on this attack,” he said.

He also highlighted that refrigeration systems are “essential to preserving fresh products and supplying food to the French public” and said this attack is “of utmost gravity, unprecedented [and] unacceptable."

Speaking to Infosecurity, an Intermarché spokesperson confirmed that 150 of its stores were affected by the cyber-attack, estimated the financial loss at "at least thousands of euros."

Meanwhile, a Carrefour spokesperson said the incident "primarily affected 80 out of our 6000 stores" and Groupe Casino said 5% of Monoprix supermarkets are impacted by the attack.

Attackers May Have Compromised Refrigeration Software Provider

French news channel BFMTV reported that the compromised systems are administered by Danish refrigeration systems provider Danfoss. An Intermarché spokesperson has since confirmed these details to Infosecurity.

The attackers targeted outdated versions of the manufacturer’s freezing and refrigeration control software, the spokesperson confirmed. Affected stores include those operating vulnerable Danfoss consoles with remote-control capabilities that lacked an adequately secured communication channel.

“Hackers reportedly managed to remotely trigger forced defrost cycles in refrigeration systems at numerous supermarkets, with temperatures programmed to reach as high as 50 °C (122°F),” BFMTV reported.

BFMTV reported that as a result of the incident two supermarkets alone, an Intermarché and Super U, have already recorded losses of €270,000 ($302,000) worth of merchandise in Haguenau, in the Alsace region of eastern France near the German border.

Intermarché said it was yet impossible to estimate how much food would be wasted due to the attack.

"Our legal and insurance teams have started investigating the incident," the spokesperson added.

Other purportedly affected supermarket networks include E. Leclerc and Monoprix, Jonathan Le Borgne, author of the specialized retail news website Je bosse en grande distribution, has reported.

E. Leclerc has acknowledged Infosecurity's request for comment but has yet to provide a response.

Supermarkets in Belgium and the Netherlands were also reportedly affected.

Claroty Research Exposed Security Risks in Danfoss Refrigeration Controllers

Additionally, research presented by Claroty’s Team82 at DEF CON 34 in August 2026 demonstrated how a compromised Danfoss AK-SM 800A controller could disable cooling while falsifying temperature readings, potentially concealing failures in the cold chain.

A Shodan scan on Aug 19 still found 3726 of these controllers accessible from the public internet.

These findings highlighted the real-world risks of exposing industrial refrigeration systems to the public internet without adequate security controls, authentication, and firmware updates.

On October 13, the Danish company will be at Chillventa in Nuremberg, a three-day trade fair for refrigeration technology, where it is planning to showcase the new iC7-HVACR drive featuring “integrated cybersecurity features.”

This is a developing story. Coopérative U, Monoprix, Albert Heijn and Danfoss have been contacted but have not responded to our request for at the time of publication.

Image credits: NeydtStock / Pierre-Olivier / Shutterstock.com