Cyberattack Defrosts Refrigerators: Intermarché & U Hit

A cyberattack defrosted refrigerators at Intermarché and Cooperative U supermarkets across France overnight on 11–12 October 2026, turning a remote digital intrusion into immediate commercial losses and spoiled food. The two retailers said an unprecedented attack forced refrigeration systems into defrost mode in hundreds of stores, leaving fresh and frozen stock to thaw and, in some locations, triggering fires and water damage.

What Happened at Intermarché and Cooperative U?

Intermarché owner Les Mousquetaires estimated that 150 to 200 Intermarché shops were hit, while Cooperative U reported nearly 100 affected Super U and Hyper U outlets. Other French chains were also caught up: Carrefour reported about 80 stores, Monoprix around 30, and Netto and E.Leclerc confirmed disruptions. The attack, which began after closing hours on 11 October, was first disclosed by both companies on Monday, 12 October 2026.

Cooperative U CEO Dominique Schelcher called the strike on food-preservation equipment extremely serious and unprecedented. Store staff and refrigeration technicians worked through the night to stabilize cold rooms manually. Most Cooperative U locations avoided a full break in the cold chain, but a minority could not react fast enough. The episode is part of a wider pattern of French retail cyberattacks that have exposed weak links in cold chain logistics.

How Did Hackers Force Refrigerators into Defrost Mode?

Investigators and cybersecurity researchers say the intruders did not encrypt data or demand a ransom. Instead, they accessed internet-exposed refrigeration controllers, many of them Danfoss AK-SM 800A and AK-SC 355 models plus Copeland/Dixell XWEB devices, and triggered a built-in defrost function without its normal time limits. Defrost heaters then ran for roughly six hours, pushing cabinet temperatures to about 50°C and, at one Normandy store, up to 80°C. According to Cyber Defence, the controllers had login screens using the username 'admin' and the current date as a password.

Two authentication flaws — CVE-2025-41450 and CVE-2025-41451 — were disclosed by Claroty’s Team82 and patched in Danfoss firmware R4.3.1 in August 2025. Yet many devices remained unpatched or were managed by a third-party refrigeration service provider, giving attackers a single point of entry across multiple chains. This highlights a growing problem in operational technology security.

Damage, Fires and the Cold Chain Risk

The physical impact went beyond spoilage. In some supermarkets, overheating equipment melted components, produced smoke and started fires, while sprinkler systems added water damage. Les Mousquetaires put early losses at several million euros across about 180 stores, and total damage has been estimated in the tens of millions of euros once discarded food, equipment repairs and business interruption are counted. For a retailer, a break in the cold chain is not just a logistical inconvenience; it is a food-safety emergency that requires disposing of entire chilled and frozen ranges.

The incident has been described as the first cyberattack to physically disrupt a national food supply chain. It has renewed attention on food supply chain cybersecurity and on the fact that connected building systems often lack the protections applied to payment terminals.

What This Means for Retail Cybersecurity

The French national cybersecurity agency ANSSI has opened an investigation, and European officials have responded sharply. European Commissioner for Agriculture and Food Christophe Hansen condemned the attack, warning that the weaponization of food has become a reality. Retailers and regulators are now discussing whether refrigeration, heating and ventilation systems should be covered by stronger critical-infrastructure rules. Industry groups are urging operators to segment operational technology networks, change default credentials, apply patches promptly and monitor defrost cycles for anomalies. The episode may accelerate stricter enforcement under EU critical infrastructure rules and encourage supermarkets to reassess their remote access policies.

FAQ

What caused the refrigerators to defrost in French supermarkets? Attackers accessed internet-exposed refrigeration controllers, triggered the built-in defrost function and removed its time limits, causing temperatures to rise for about six hours.

Which supermarket chains were affected? Intermarché, Cooperative U, Carrefour, Monoprix, Netto and E.Leclerc all reported disruption, with Intermarché estimating 150–200 stores and Cooperative U nearly 100.

Did the cyberattack steal customer data or demand a ransom? No data encryption, theft or ransom demand has been reported; the goal appeared to be physical disruption of refrigeration.

How much damage did the cyberattack cause? Les Mousquetaires estimated losses of several million euros across about 180 stores, with total damage expected to reach tens of millions of euros.

What should supermarkets do to prevent similar attacks? Segment operational technology networks, change default credentials, apply firmware patches such as Danfoss R4.3.1 and monitor refrigeration systems for unusual defrost activity.