Coopérative U

Summary

More than 100 Coopérative U supermarkets were targeted when attackers manipulated refrigeration controls on October 12. Temperatures rose, food was spoiled, equipment was damaged, and stores temporarily closed. Its CEO called the attack serious and unprecedented.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Between the evening of Sunday, October 11, and the early hours of Monday, October 12, 2026, hackers remotely manipulated internet-connected refrigeration-control systems used by several major French grocery chains. Coopérative U’s chief executive, Dominique Schelcher, confirmed that the cyberattack had affected the cold-production facilities of several stores in the cooperative’s network. More than 100 Coopérative U outlets were subsequently reported as targeted or affected, while the precise number changed as retailers and authorities consolidated information. The attack caused refrigeration systems to heat beyond safe operating levels, resulting in the loss of fresh and frozen products, damage at some locations, and the temporary closure or disruption of affected stores. No group claimed responsibility, and authorities had not identified the attackers or established a motive at the time of the initial reporting.

The compromised equipment was principally associated with refrigeration-management technology supplied by Danish engineering company Danfoss. Internet-connected control panels allowed maintenance personnel to adjust refrigeration systems remotely, and BFM TV reported that the hackers manipulated the forced-defrost function so that refrigeration units ran continuously rather than completing a normal short defrost cycle. Temperatures reportedly reached 50 degrees Celsius, or 122 degrees Fahrenheit, with Intermarché stating that some affected units remained at that level for six hours. Danfoss said most affected equipment consisted of legacy products that no longer received software or security updates, while some systems used outdated firmware. The company identified the AK-SM800 and AK-SC355 refrigerator-regulator systems among those affected and said it had long advised customers to update supported systems or replace older equipment. It did not provide a figure for the number of compromised units.

Cybersecurity researcher Amir Zaltzman of Claroty had disclosed several vulnerabilities in Danfoss refrigeration controllers on August 9. Article 1 specifically reported that flaws in the AK-SM 800A controller could permit attackers to bypass authentication and execute code on compromised devices, while CyberNews reported that patches for three Danfoss controllers had been available since September 18. The subsequent investigation did not publicly establish whether the supermarket attack used one of those particular vulnerabilities. Following the incident, France’s National Cybersecurity Agency, ANSSI, was reported to have identified a vulnerability in software supplied by Danfoss and contacted the vendor.

The scale extended beyond Coopérative U. Initial retailer statements identified between 150 and 200 Intermarché stores and almost 100 Coopérative U locations as affected, while later tallies cited roughly 300 Intermarché and Netto stores affected or targeted and more than 100 Coopérative U outlets. Another report said 180 Intermarché and Netto stores were affected and that roughly 100 additional shops were disconnected from the internet as a precaution. Carrefour reported 80 affected stores out of approximately 6,000, and Monoprix reported that about five percent of its network, representing roughly 30 stores, had been hit. E.Leclerc also confirmed that a cyberattack affecting a refrigeration-equipment supplier had disrupted refrigeration operations in several stores. Overall estimates placed the number of affected French supermarkets at about 400 out of roughly 15,000, although the full scale remained unclear.

The temperature manipulation destroyed temperature-sensitive inventory across the affected chains. Intermarché said fresh and frozen products had to be discarded, and Monoprix removed products from sale whenever their condition could not be guaranteed. Some refrigeration units remained out of service while products were removed and shelves were restocked. Small fires were reported at several locations, and some stores temporarily closed because of damaged equipment or unsafe operating conditions. Two supermarkets in Alsace reported combined inventory losses of €270,000. No specific loss figure was published for Coopérative U, while Intermarché chief executive Thierry Cotillard said the incident represented “tens of millions of euros” in nationwide losses in a single day. Intermarché also warned that insurance policies might not cover this type of in-store cyber incident.

Coopérative U’s response focused on restoring the affected cold chain with assistance from refrigeration specialists. Schelcher said the company’s teams were fully mobilized, had been coordinating with specialists since the attack began, and were working to restore normal operations as quickly as possible. Staff removed compromised food, isolated refrigeration equipment from internet connectivity at affected and potentially exposed sites, and resumed operations where refrigeration systems could be made safe. Some affected stores were operating again by Monday, while others continued remediation work. Intermarché’s crisis teams coordinated emergency supplies and technical assistance for stores needing replacement stock and equipment.

The Paris prosecutor’s office opened a specific cybercrime investigation and described the event as a large-scale attack on connected refrigerators at several major French retailers. The investigation was intended to identify victims and establish links between the intrusion and reported food losses and fire alarms. French Prime Minister Sébastien Lecornu instructed ANSSI to investigate, and the agency coordinated with European counterparts while seeking to identify other French companies that might be exposed. France’s retail federation, the FCD, called on Danfoss to provide full transparency. Coopérative U also said a full investigation would be necessary, while Danfoss stated that it remained committed to helping customers maintain secure and reliable refrigeration systems.

Sources

Sources available to members: 11 sources.