PARIS — Supermarket managers across France spent Monday throwing out fresh and frozen stock after hackers drove the temperature in their freezers as high as 50°C overnight. Intermarché said its affected stores would have to “throw away all of the products” in those categories, and several stores reported fires.
The attack began on Sunday night, according to Dominique Schelcher, chief executive of Coopérative U, and by Monday Intermarché, Coopérative U and E Leclerc had confirmed it. At least 300 Intermarché or Netto stores were targeted, along with more than 100 Coopérative U outlets, the retailers said. Carrefour counted 80 supermarkets, Monoprix about 5 percent of its roughly 490 stores, and E Leclerc said only that several of its stores were hit. Those are the retailers’ own figures, as Al Jazeera relayed them, and they overlap by brand and by day rather than adding up to one national total.
What failed was not a till or a customer database. It was the thermostat. Danfoss, the Danish maker whose software is now at the centre of the inquiry, describes its refrigeration system manager on its own product page as the “brain” that coordinates the individual controllers, runs coordinated defrosting and handles alarms, with a web interface for remote connection. That reach is what maintenance firms use to adjust a store’s cold aisles, and a French television report, relayed by Al Jazeera, said it let the attackers trigger forced defrosting across hundreds of stores at once. The question France now has to answer is why equipment this basic to the food supply could be reached from outside.
Danfoss’s advisory page shows what the company had already disclosed about one of its controller families, the AK-SM 8xxA system managers. In March 2025 it published advisory DSA-2025-03-01 on an authentication bypass, rated 8.2 out of 10 and fixed in version 4.2. In August 2025 it followed with advisory DSA-2025-08-01 on a command-injection flaw, rated 8.7 and fixed in 4.3.1, which an attacker would need a valid login to use. Both credit Tomer Goldschmidt of the security firm Claroty, and both list mitigations as “N/A.” Danfoss’s product page lists encrypted web traffic, built-in firewalls and password management among its security features, and tells customers to “always install the latest version of the software.” Whether either flaw was used in the attack is not established. The advisory page, checked on Tuesday, carries no October notice and says nothing about the French incident.
Nobody has put a number on the total. Intermarché’s chief executive, Thierry Cotillard, put the losses at “tens of millions of euros nationwide in a single day,” Al Jazeera reported, a figure from one retailer for one day. Al Jazeera carries no industry-wide estimate. Some affected stores were already reopening on Monday, and the retail federation FCD called on Danfoss for “full transparency.”
Steven Lachance, a cybersecurity analyst, told Al Jazeera the attack was not unprecedented, though rare in scale, and called it “a global wake-up call.” He warned that the next target could be energy infrastructure or hospitals. Energy was already a target in August, in what EH reported as a UK power plant cyberattack by Iran-linked hackers that kept a British energy facility offline for four days.
The same month the FBI was investigating water system cyberattacks across seven US states. The French case differs in what it spoiled. The target was food in a cold room, not data on a server, and the cost was counted in stock thrown away within hours.
Al Jazeera reported that Schelcher wrote on X that the attack was “unacceptable” and that an investigation would be needed to shed full light on it. The public record so far shows two things. Danfoss disclosed serious flaws in one of its refrigeration controller families last year, and some of the units hit on Monday were still running outdated firmware. It does not yet show whether those two facts are connected.
