Key points
- French chains including Intermarché saw freezers heated remotely, destroying frozen goods.
- Ahold Delhaize outlets in the Netherlands and Belgium experienced operational disruption.
- The French incident targeted Danfoss control systems, though no specific vulnerability link is confirmed.
The short version
- Attackers remotely manipulated Danfoss refrigeration controllers in France, causing freezers to warm up.
- Hundreds of stores across France reported defrosted and spoiled products after the incident.
- Ahold Delhaize reported a separate security issue affecting operations in the Netherlands and Belgium.
The details
European food retailers have endured significant operational disruption following two separate cyber incidents. In France, the primary impact was physical damage to perishable inventory. According to BFMTV, hundreds of supermarket locations were affected by a compromise of refrigeration control systems manufactured by Danish firm Danfoss. The attacks occurred during the night, with systems being hijacked remotely between Sunday evening and Monday morning. Staff arriving for their shifts found that the temperature settings had been altered, causing freezers and fridges to heat rather than cool. This resulted in the destruction of chilled and frozen products.
The scope of the French incident appears broad. BFMTV reported that stores operated by Groupement Mousquetaires, which includes Intermarché and Netto, were among those affected. The outlet also noted impacts on locations run by Coopérative U and Leclerc. Jonathan Le Borgne, a creator of a retail-focused podcast and blog, confirmed that hackers had taken control of the remotely manageable Danfoss systems. He additionally stated that Carrefour Market and Monoprix stores were included in the affected group. An internal communication from the Intermarché network, dated 12 October, verified the cyberattack on Danfoss systems during the night.
Financial repercussions are evident, with BFMTV reporting that damages range from tens to hundreds of thousands of euros per location. A crisis meeting was convened on Monday at 11:00, involving Danfoss and refrigeration specialist Axima, to address the breach. Some mitigation was possible; staff at certain stores managed to salvage limited product because the attack occurred closer to opening hours or because managers received alerts about the destructive changes before total spoilage occurred.
The context
A separate but distinct disruption affected the Netherlands and Belgium. Workers at stores owned by Dutch multinational Ahold Delhaize dealt with operational difficulties stemming from an unspecified security issue. Help Net Security reported this as a separate event from the French incidents. While the French attack targeted specific hardware controls, the nature of the disruption at Ahold Delhaize remains undefined in available reports.
Security researchers from Claroty’s Team82 disclosed multiple vulnerabilities in early August 2026. These flaws affected the web-based management interfaces of Danfoss AK-SM 800A refrigeration controllers and Copeland XWEB Pro supervisory controllers. Although these known weaknesses exist, the source material does not confirm that the French attack exploited these specific vulnerabilities. The connection remains unverified.
Defender's checklist
Organisations should audit all remotely controllable building management systems. Identify which devices have web-based interfaces exposed to the internet. Ensure that access to these interfaces is restricted to trusted networks only. Monitor for unusual changes in temperature settings or system configurations. Verify that firmware on all control units is up to date. Segment industrial control networks from general corporate IT networks to limit lateral movement.
What to do and how to stay safe: Danfoss
- Inventory all industrial control systems and verify their access controls.
- Monitor system logs for unexpected configuration changes or remote access attempts.
- Ensure network segmentation isolates critical infrastructure from general office networks.
- Establish incident response procedures for physical system failures linked to cyber events.
Step-by-step guide: Phishing vs Spear Phishing: Targeting Mechanics and Defence
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific supermarket chains were affected in France?
Stores including Intermarché, Netto, Super U, Marché U, Leclerc, Carrefour Market, and Monoprix were affected.
Is there a confirmed link between the attack and known vulnerabilities?
No, the source material does not confirm that the attackers exploited the vulnerabilities disclosed by Claroty’s Team82.
What happened to the inventory in the affected French stores?
Freezers were heated remotely, causing chilled and frozen products to defrost and spoil.
