French supermarket refrigeration systems hit by cyberattack, with food losses and fires reported

French supermarkets faced a cyberattack on connected refrigeration systems on 12 October 2026, with food losses and fires reported, according to the Paris prosecutor’s office. Les Mousquetaires, owner of Intermarché, said about 150 of its stores were hit. The disruption matters because refrigeration failures can force retailers to discard fresh food even when shops remain able to serve customers.

A Les Mousquetaires spokesperson said fridges were heated to 50°C for six hours and that food was discarded to avoid health risks. The prosecutor’s office described a large-scale attack affecting connected refrigerators at several major food retailers across France; its account of damage included food losses and fires. The available reporting does not establish how many fires occurred or the total amount of food lost.

Which French supermarkets were affected

Coopérative U chief executive Dominique Schelcher said his supermarkets were also hit. He called the attack unprecedented and extremely serious because it targeted equipment used to preserve fresh goods and the food supply. Neither his statement nor the prosecutor’s account establishes a confirmed nationwide store count.

The Guardian, in a report credited to Reuters in Paris, said Carrefour, Monoprix and Auchan had not responded to requests for comment. It attributed a report that E.Leclerc was affected to BFM TV and said E.Leclerc had not responded. Those accounts do not establish the extent of any impact at those chains. Industry publication Cooling Post estimated that around 500 stores were affected, while saying the total was unknown; that figure is an estimate, not a confirmed tally.

What France’s cyber agency confirmed about Danfoss controllers

CERT-FR warned that exposing a management interface to the internet runs against good practice. Where remote administration is needed, it advised restricting access to trusted IP addresses. Its immediate advice for AK-SM and AK-SC installations was to disconnect them from the network or filter access to them.

For equipment suspected of being compromised, CERT-FR recommended limiting service providers’ network access, restoring factory settings, applying available patches, changing secrets, checking accounts and reconfiguring the devices. Those steps indicate how operators can contain and recover affected systems; the alert does not identify who carried out the attack.

Danfoss response and older equipment

Danfoss said it was aware of incidents in France affecting a limited number of refrigeration-management systems. It said affected units were running outdated firmware and advised customers to update supported systems and migrate legacy equipment. In a statement to Cooling Post, the company said it was working closely with affected French supermarket customers on mitigation, including firmware updates where available, stronger network protections and removing direct internet exposure where applicable.

Cooling Post reported that Danfoss identified the affected equipment as including legacy AK-SM800 systems declared end of life in 2021, AK-SC355 systems phased out in 2016 and AK-SM800A systems running outdated firmware. That distinction matters for operators deciding what can be updated and what may require replacement. Neither that account nor CERT-FR’s alert establishes the precise entry point used in the attack.

Investigation and unanswered questions

Prime Minister Sébastien Lecornu instructed national cybersecurity agency ANSSI to investigate, according to a person in his office quoted by Reuters. The same source said France was coordinating with European counterparts because other countries might be affected, while authorities assessed risks to other French companies. Those assessments do not establish that the same attack had spread beyond France.

The Reuters report also described a separate security issue at Dutch retailer Ahold Delhaize. It said the company had taken systems offline and that Albert Heijn shops remained open while its app and delivery system were down. Whether that incident was connected to the French refrigeration attack was unclear, so it should not be counted as part of the same outbreak.

For now, the confirmed picture is narrower than the possible reach of the incident: Les Mousquetaires reported about 150 affected stores, Coopérative U reported an impact, and CERT-FR warned of numerous controller compromises. The identity and motive of the attackers, the full number of affected stores and the total losses remain unestablished in the available accounts. ANSSI’s investigation and operators’ checks may clarify those questions.