Overview
An overnight attack on October 11–12, 2026 hit commercial refrigeration controllers at hundreds of European supermarkets, with most damage in France. Attackers reportedly forced fridges, freezers and cold rooms to heat, with temperatures rising as high as 50°C. Food spoiled and some small fires were reported. Figures differ by source, and the details below come from secondary reporting.
Scope
- Stores: Estimates vary: north of 700 stores (Dark Reading, citing company reports), over 400 (a summary of that article), more than 300 in France (BFM TV), and 150–200 Intermarché plus nearly 100 Coopérative U outlets (Forbes).
- Chains named: Auchan, Carrefour, E.Leclerc, Intermarché and Monoprix.
- Countries: Mainly France, with impact also reported in Belgium, Germany, the Netherlands, Poland, Portugal and Spain.
- Losses: Estimates range from several million euros (Intermarché, per Forbes) to tens or hundreds of millions across the sector (Dark Reading). Two Alsace stores alone reported €270,000. Some insurance policies may not cover the incident.
- French prosecutors have opened a cybercrime investigation.
Root Cause
Reporting points to CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452 in Danfoss controllers, which allow remote code execution or denial of service. Danfoss had released patches, but applying them was left to customers. Most affected units were end-of-life AK-SM 800 or older AK-SC355 platforms that remained unpatched.
Les Mousquetaires, parent of Intermarché and Netto, told CNBC the attack came through a service provider managing its refrigeration systems. Experts cited poor OT network segmentation, unmanaged third-party vendor access, and thousands of internet-exposed devices.
Lessons for OT Owners
- Inventory OT assets, including those run by contractors, and track firmware and end-of-life status.
- Remove direct internet exposure of building and refrigeration controllers; place them behind VPN or a broker with MFA.
- Segment OT from IT and restrict vendor access paths with time-bound, logged sessions.
- Contract for patching. Service agreements should state who applies firmware updates and by when.
- Plan for physical failure modes, such as independent temperature alarms that do not rely on the controller.