www.it-connect.fr
Super U and Intermarché Hit by Cyberattack That Turned Freezers Into Ovens
Freezers heating up to 50°C in the middle of the night, and entire frozen-food aisles thrown away by morning. A cyberattack targeting Danfoss refrigeration systems has hit many French supermarkets, including U and Intermarché stores. Here is what we know.
A new large-scale cyberattack was carried out overnight from Sunday, October 11 to Monday, October 12, 2026. By early morning, store teams had found freezers heating up instead of cooling down. The attackers did not target data, but the equipment itself.
Dominique Schelcher, CEO of Coopérative U, confirmed the incident on his X account. "I confirm that since last night, a cyberattack has affected the refrigeration production systems of several stores in our network," he wrote, adding that teams are working with refrigeration technicians to restore operations and that an investigation will have to shed light on this attack. "Targeting equipment that is essential to preserving fresh products and supplying food to the French population is extremely serious and unprecedented. It is unacceptable.", he said.
Intermarché appears to be the hardest hit: between 150 and 200 stores are affected, the chain told AFP, confirming information reported by BFMTV. On the Coopérative U side, fewer than one hundred stores would be impacted. Leclerc stores would also be affected, as well as Carrefour Market and Monoprix locations.
"We had to throw away all of our fresh products (including the butcher section)," said the Intermarché store in Mur-de-Bretagne, and this is far from an isolated case. It is easy to imagine losses running into hundreds of thousands of euros, with all of these fresh products ending up in the trash.
Defrosting Misused to Heat Up the Refrigerators
In a supermarket, cold cases and cold rooms are controlled by a connected management system. It handles temperature and also schedules defrost cycles: a short phase during which the equipment heats up to melt frost. In this cyberattack, the attackers reportedly triggered this defrost function remotely and continuously, with a setpoint of 50°C.
According to BFMTV, the attackers reportedly targeted older versions of Danfoss control software, earlier than version 4. The Danish manufacturer equips a very large number of stores in France, which would explain the scale of the attack.
This scenario may seem surprising, yet it has already been highlighted by researchers. And not long ago... In August 2026, at DEF CON, Team82 researchers from Claroty presented their work on the Danfoss AK-SM 800A. This is a system manager that coordinates all the refrigeration controllers in an installation. They identified three vulnerabilities in its web management interface, along with a demo: a compromised controller can shut down refrigeration while falsifying the temperatures being displayed.
- CVE-2025-41450 : an authentication bypass using a hidden password computed solely from the current date.
- CVE-2025-41451 : a command injection in an email alert configuration field, leading to remote code execution (after authentication).
- CVE-2025-41452 : an injection of Nginx configuration directives, making it possible to trigger a denial of service (after authentication).
Following this demonstration and the responsible disclosure of these vulnerabilities, Danfoss patched these flaws in firmware R4.3.1 of its equipment. More importantly, beyond the discovery of these flaws, the researchers also found thousands of management interfaces exposed publicly. So, I am not saying there is a connection between these flaws and what happened overnight, but it would not be surprising if there were one.
If the compromised Danfoss systems were exposed on the Internet, that would also point to serious security gaps... More to come.
