No stolen data this time, but a mess of food to throw in the trash. Stores of several French major retail brands, such as Système U, Intermarché and E.Leclerc, were affected by a cyberattack on Monday October 12, targeting their fridges and freezers. More precisely, the hackers managed to remotely reach the refrigeration control systems of the Danish manufacturer Danfoss. While the losses could amount to several million euros, an investigation has been opened by the Paris prosecutor's office. Franceinfo summarizes what we know about this unprecedented cyberattack.
Several hundred stores affected
At least 300 Intermarché/Netto (Les Mousquetaires) points of sale, less than a hundred from the Coopérative U network, "several stores" from the E.Leclerc group, 80 Carrefour supermarkets and around thirty Monoprix are affected by this attack revealed by BFMTV, these distributors confirmed to AFP.
During the night from Sunday to Monday, the pirates managed to "defrost all our cold furniture and raise the temperature to 50°C", explained the boss of the Mousquetaires, Thierry Cotillard, Monday evening on BFMTV. On X, the CEO of the Coopérative U group, Dominique Schelcher, denounced an “unacceptable” cyberattack.
“Tackling equipment essential to the preservation of fresh products and the food supply of the French is extremely serious and is unprecedented.”
Dominique Schelcher, CEO of the Coopérative U group
on
Speaking to France 3 Bretagne, the manager of a Carrefour Market store in Rennes said that he first thought of "a bug", then of a fire. “My freezers were programmed at 95°C on my phone application,” reports Nicolas Le Crom, who explains having received several alerts during the night.
Losses estimated at several million euros
The scale of the losses could be gigantic. A source close to the matter assures France Inter that they could amount, in total, to several million euros. According to Intermarché, interviewed by AFP, distributors are forced to “discard all products” affected to respect the cold chain. The group believes that "one of the hard points" will be that of insurance, which does not "cover this type" of incidents.
Locally, managers are helpless. "In a small store", the losses can reach "a few tens of thousands of euros", when "in a hypermarket, this can rise to 180,000, 200,000 euros", assessed Tuesday morning on RTL Dominique Schelcher. “The temperature was positive inside the fridge, so we threw everything away,” Marie, manager of a store in Etréchy (Essonne), tells franceinfo.
“Complete boxes of baguettes, pastries, pastries, which ended up in the dumpster outside. They cost around 60,000 euros.”
Marie, store manager in Etréchy (Essonne)
at franceinfo
In another supermarket, in Issy-les-Moulineaux (Hauts-de-Seine), the damage is estimated at 55,000 euros. To avoid a new attack, the store manager disconnected the digital connection to the fresh departments. “It’s a place where we can control the fridges, see if there are any anomalies, etc. And there, we turned everything off, disconnected everything so that there wasn’t another possibility of hacking into our fridges,” Ina Genetay explains to France Télévisions. In Haguenau (Bas-Rhin), two Intermarché supermarkets reported, to France Inter, 270,000 euros in loss of goods.
Remote control of thermostats
The refrigeration system of the attacked brands is managed by a service provider, Danfoss. Remotely, cybercriminals managed to take control of thermostats and change the temperatures of connected fridges and freezers. To franceinfo, the company confirms “incidents occurring in France affecting a limited number of refrigeration management systems”.
“The majority of affected devices are obsolete products, including the AK-SM800 and AK-SC355, which have reached end-of-life and are no longer receiving software or security updates.”
Danfoss, Danish company which manages refrigerated furniture
at franceinfo
Danfoss has long recommended that its customers keep supported systems up to date with the latest firmware and migrate outdated systems to the latest generation solutions. The Danish company says it "takes these incidents very seriously" and "works with affected customers to implement appropriate mitigation measures, including firmware updates where available, strengthening network protections and removing direct internet exposure where appropriate."
For its part, the Federation of Commerce and Distribution (FCD) called on Danfoss and its refrigeration customers “for total transparency on the situation and the immediate implementation of all necessary measures”.
An attack “carried out without much difficulty”
Long isolated from the internet, industrial equipment such as refrigeration units are now connected via sensors or remote supervision systems, Antoine Hautin, secretary general of Almond, a cybersecurity consultancy, explained to AFP. “Historically, these systems were designed to prioritize reliability and cost control, rather than protection against cyberattacks” because “attackers could not access them remotely,” underlines the expert.
According to him, by affecting hundreds of equipment simultaneously, Monday's attack demonstrates a "certain sophistication". But for Clément “SaxX” Domingo, ethical hacker, guest on RMC Tuesday morning, this hack is not “that sophisticated”. “It’s simply an update that was not done, hence the interest in doing these updates. And so cybercriminals took control of this equipment with a very simple password, since each time it was the current date which allowed them to connect to all this equipment,” he said.
“What we saw this summer were data thefts. But there, there is a desire to harm, to sabotage, and to destabilize.”
Clément “SaxX” Domingo, ethical hacker
on RMC
“It seems that this is an operation that was carried out without too much difficulty,” Benoît Grunenwald, cybersecurity expert, also reacted on RMC. “Several security flaws have been documented, the latest dating back to April 2025. The latest spring update mentions numerous corrections. The attackers used one of these known flaws,” also analyzes for Sud Ouest Marta Rybczynska, cybersecurity specialist.
An investigation opened by the Paris prosecutor's office
This cyberattack has, for the moment, not been claimed. The Paris prosecutor's office announced to AFP on Monday the launch of an investigation on its own initiative into "the large-scale cyberattack affecting the connected refrigerators of several department stores". This investigation, led by the anti-cybercrime section and "entrusted to the anti-cybercrime office [Ofac], should make it possible to identify the victims and establish the link with the damage reported" in terms of "loss of food" and equipment having started to catch fire.
