European supermarket refrigeration (Danfoss controls): overnight cyberattack forced continuous defrost / high setpoints at Intermarché, E.Leclerc and Coopérative U stores; Coopérative U CEO confirms OT hit
Overnight between 11 and 12 October 2026, French supermarket groups Intermarché, E.Leclerc and Coopérative U reported a cyberattack that altered refrigeration-control settings, according to BFMTV, La Dépêche and Tom's Hardware. Early reporting ties the affected cabinets and freezers to Danfoss-made commercial refrigeration controls used for freezers, chilled displays, compressors and temperature alerts. Attackers reportedly enabled continuous/automatic defrost and raised setpoints as high as 50°C, so cooling units ran like heaters for hours and forced stores to inspect and discard temperature-sensitive stock. Dominique Schelcher, president/CEO of Coopérative U, confirmed publicly that a cyberattack had affected refrigeration production facilities at several stores in the group's network since the previous night, that teams and refrigeration technicians were restoring service, and that an investigation would be needed. He called attacking equipment essential to fresh-food conservation and French food supply extremely serious and unprecedented. Early French media put some-site losses in the hundreds of thousands of euros; nationwide figures are not confirmed. Tom's Hardware also noted parallel Sunday disruptions in the Netherlands (Albert Heijn, Etos, Gall & Gall websites and electronic shelf labels) reported by NOS; those brands sit under Ahold Delhaize, which issued its own 12 Oct network-security statement (separate card on this desk). Whether the French Danfoss OT wave and the Ahold Delhaize network incident share an actor or tooling is not publicly established — treat them as related-in-time retail cyber events, not proven one campaign, until primary notices say more. No CVE, ransomware brand or intrusion method has been confirmed by Danfoss or the retailers in the sources reviewed for this card. Primary confirmation: Coopérative U CEO statement (12 Oct); wires: Tom's Hardware / BFMTV / Cybersecurity News (12 Oct).
- Product
- Danfoss commercial refrigeration / supermarket cooling-control systems (as reported; vendor confirmation pending)
- Versions
- not published — early reports mention older software without naming a CVE or fixed release
- Exploited in Australia?
- unknown
- Patch to
- Food retail and cold-chain operators: isolate refrigeration OT from corporate IT where possible, require MFA and jump hosts for remote HVAC/fridge vendor access, alert on unexpected defrost or setpoint changes, and keep an offline procedure to reclaim local control of cabinets. Watch Danfoss and retailer notices for patches or IoCs; none were public in the sources used here.
Primary: Tom's Hardware — Unprecedented cyberattack cripples supermarket fridges across Europe (Stephen Warwick, 12 Oct 2026) · Cybersecurity News — Attackers reportedly hack supermarket fridges and raise temperatures to 50°C (12 Oct 2026)