“Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be needed to shed full light on this attack,” Dominique Schelcher, CEO of Coopérative U, wrote on X on October 12.
Coopérative U says multiple stores affected from October 11
Coopérative U — the retail cooperative whose brands include Hyper U, Super U, U Express and Utile — confirmed on October 12 that a cyber‑attack affected several stores in its network beginning October 11. Dominique Schelcher described refrigeration systems as “essential to preserving fresh products and supplying food to the French public” and called the incident “of utmost gravity, unprecedented [and] unacceptable.”
Danfoss refrigeration systems reportedly compromised and manipulated
French news channel BFMTV reported that the compromised systems are administered by Danish refrigeration systems provider Danfoss and that attackers targeted outdated versions of the manufacturer’s refrigeration control software. BFMTV said hackers remotely triggered forced defrost cycles in refrigeration systems at numerous supermarkets, with temperatures programmed to reach as high as 50 °C (122°F).
BFMTV reported immediate commercial impacts: two supermarkets in Haguenau — an Intermarché and a Super U — recorded combined losses of €270,000 ($302,000) in merchandise. The outlet assessed that about 150 Intermarché stores, part of Groupe Mousquetaire, were affected. Other reportedly affected supermarket networks include E. Leclerc, Carrefour and Monoprix, a list first reported by Jonathan Le Borgne of the retail news website Je bosse en grande distribution.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageDocumented vulnerabilities and Claroty’s DEF CON 34 findings
Danfoss products have previously been associated with critical cybersecurity vulnerabilities, specifically CVE-2023-25915, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452. Some of those vulnerabilities could allow attackers to gain privileged access to refrigeration control systems and manipulate physical equipment.
Research presented by Claroty’s Team82 at DEF CON 34 in August 2026 demonstrated a practical manipulation: a compromised AK‑SM 800A controller could disable cooling while falsifying temperature readings, potentially concealing failures in the cold chain. Claroty’s presentation was cited in reporting that highlighted the risk of exposing industrial refrigeration systems to the public internet without adequate security controls, authentication and firmware updates.
Danfoss plans Chillventa appearance on October 13 and product messaging
On October 13 Danfoss will be at Chillventa in Nuremberg, a three‑day trade fair for refrigeration technology, where it is planning to showcase the new iC7‑HVACR drive featuring “integrated cybersecurity features.”
Coopérative U, E. Leclerc, Intermarché and Danfoss have been contacted for comment, according to the reporting.
What this means for Danfoss, supermarket operators, and consumers
- Danfoss and refrigeration suppliers: the company’s past CVEs and the Claroty demonstration place product security squarely on the agenda; Danfoss’s scheduled Chillventa exhibit of the iC7‑HVACR drive signals an immediate, public-facing effort to address cybersecurity in product messaging.
- Supermarket operators (Coopérative U, Intermarché, E. Leclerc, Carrefour, Monoprix): operators are already reporting direct inventory losses and mobilizing refrigeration specialists; BFMTV’s reporting of 150 Intermarché stores affected and a €270,000 loss in Haguenau shows the operational and financial scale of the disruption.
- Consumers and the public food supply: Coopérative U’s statement frames refrigeration systems as central to preserving fresh products and supplying food to the French public, underlining how attacks on control systems can translate quickly into food‑safety and supply concerns.
Investigations are underway and, as Coopérative U’s CEO put it, will be needed “to shed full light on this attack.” The reporting ties a concrete pattern of previously disclosed vulnerabilities and academic research to an active disruption of the food cold chain, and it places Danfoss’s product security claims and the supermarket networks’ remediation efforts at the centre of the immediate response.
Original reporting: https://www.infosecurity-magazine.com/news/french-supermarket-chains/
