E.Leclerc

Summary

E.Leclerc was among the major French food retailers affected by the cyberattack that targeted Danfoss software managing supermarket refrigeration units.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A cyberattack struck connected refrigeration systems at French supermarkets overnight from Sunday into Monday, 12 October 2026. Hackers gained control of software used to regulate refrigeration units, and BFM TV reported that they remotely triggered forced-defrost functions in numerous stores. Instead of the slight temperature increase normally associated with an overnight defrost cycle, some refrigeration units were made to heat up and remain hot. Intermarché reported that its fridges had reached 50°C for six hours overnight into Monday, while a BFMTV image showed an ice-cream freezer displaying 26.5°C. The temperature changes caused fresh and frozen products to spoil, and small fires were reported at some locations.

E.Leclerc confirmed to AFP that the cyberattack had affected one of its refrigeration-equipment suppliers, resulting in operational repercussions for refrigeration systems in several stores. BFM TV separately reported that the attacker remotely initiated forced defrosting in numerous E.Leclerc stores. E.Leclerc did not name the supplier in its statement, but a source close to the incident said the targeted refrigeration-control systems were manufactured by Danish company Danfoss. The published reports did not provide an exact number of affected E.Leclerc locations or a specific financial-loss figure for the chain.

The disruption extended across several major retailers. AFP, citing statements from the retailers, reported that at least 300 Intermarché or Netto stores and more than 100 Coopérative U outlets had been targeted, along with several E.Leclerc stores. A BBC account distinguished between 180 affected Intermarché and Netto stores and another 100 shops that were urgently disconnected from the internet to prevent the same disruption. Carrefour said 80 of its 6,000 stores had been affected, while Monoprix reported that 5% of its more than 400 stores had been hit, representing roughly 30 locations. Based on figures supplied by individual chains, the BBC estimated that about 400 stores were affected out of approximately 15,000 across France.

Affected stores removed products from refrigeration units and discarded fresh and frozen goods that could no longer be guaranteed safe. Intermarché said it had thrown away all affected food to avoid health risks, and Monoprix withdrew products from sale whenever their condition could not be assured. Some display units remained out of service on Monday afternoon while staff worked to restock shelves. Two supermarkets in Alsace reported combined stock losses of €270,000, and broadcasters said the nationwide cost of spoiled food could run into millions of euros. Managers arriving at branches on Monday morning encountered hot air from affected freezers, and some locations experienced small fires.

Operational responses included disconnecting refrigeration equipment from internet access, removing compromised products, coordinating with refrigeration specialists, and arranging technical support and emergency supplies. Coopérative U said its staff were fully mobilised alongside refrigeration specialists to restore refrigeration systems as quickly as possible. Reporting on the Intermarché response described internal warnings about frozen-product losses and crisis teams coordinating assistance for affected branches. While these measures were being implemented, some refrigeration systems remained unavailable and restocking work continued.

Danfoss said most of the affected equipment consisted of legacy products that no longer received software or security updates. It identified its AK-SM800 and AK-SC355 refrigerator-regulator systems as affected, with one version of the former running outdated firmware, and said it had long advised customers to update from those models. The company did not provide a figure for the number of affected systems. Separately, security researcher Amir Zaltzman of Claroty had identified several flaws in Danfoss refrigeration controllers in August, and a patch for three controllers had been available since 18 September.

France’s national cybersecurity agency, ANSSI, identified a vulnerability in software supplied by the Danish company and contacted the vendor. It was coordinating with European counterparts because other countries could be affected and was seeking to identify additional French companies involved so they could be alerted and measures could be taken to prevent further spread. The Paris prosecutor’s office opened a specific cybercrime investigation into what it described as a large-scale attack affecting connected refrigerators across several major food retailers. The investigation was intended to identify victims and establish links between the attack and the reported food losses and fires.

Further updates came as teams continued removing compromised stock and restoring refrigeration systems. The published information did not establish the total number of refrigeration units affected, the complete cost across retailers, or the full extent of the disruption at E.Leclerc. Danfoss provided no system count, and several affected Intermarché and Netto stores remained out of service or were still being restocked on Monday afternoon as the prosecutor’s investigation and ANSSI’s vendor coordination continued.

Sources

Sources available to members: 6 sources.