Attack on fridge controllers hits 700 French supermarkets

A cyber attack on internet-connected Danfoss refrigeration controllers has disrupted cold storage at more than 700 French supermarkets, with units defrosting and some overheating enough to cause smoke and fires. It shows that attacks on operational technology can spoil stock and create safety hazards, not just leak data.

What they found

• Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc and Super U were affected; at least 180 Les Mousquetaires and over 100 Coopérative U stores were hit, some units reaching 50°C.
• The controllers ran older Danfoss industrial software that could not be patched; in May 2025 the US Cybersecurity and Infrastructure Security Agency (CISA) had warned of authentication bypass and command injection flaws in them.
• Cold stores in Belgium, the Netherlands, Spain, Portugal, Poland, Germany and the United States were also hit, including Delhaize, Albert Heijn and Stop & Shop. Shodan shows about 4,500 such systems online, 1,500 of them in France.
• France's national cyber agency ANSSI and the Paris prosecutor are investigating; no group has claimed the attack. Coopérative U's chief executive called it "extremely serious and unprecedented".

What to do

• Keep industrial controllers off the public internet; reach them through a VPN (virtual private network) with allow-listed addresses.
• Replace controllers too old to patch rather than leaving them exposed.
• Segment operational networks and allow only the connectivity operations need.
• Fit independent temperature alarms so failures are caught before stock or premises suffer.

Source: Cyber Attack Shuts Down Refrigerators at 700 French Supermarkets, Resulting in Food Losses and Fires, CPO Magazine, 16 October 2026. Summary by the Cyber Risk Barometer.