On 12 October 2026, Intermarché and Coopérative U confirmed to AFP that a cyberattack had targeted their refrigeration installations. Documented consequences concern stock preservation and store operations. This article reflects information available on that date.
The incident raises a practical question for retailers: who can remotely change the settings of equipment your business depends on? Reviewing that access is useful even though the initial attack mechanism has not been established in the sources consulted.
What is confirmed on 12 October
AFP reports that an investigation has been opened, as confirmed by Paris prosecutors. Its article includes statements from both retailers about the affected scope. The figures in the key takeaways are provisional, rather than a final count across all French stores.
Three types of information need to remain distinct: retailer confirmations, observations in an individual store and hypotheses about the intrusion. A witness account about one installation cannot establish the condition of every affected unit or identify the attacker.
Lost stock, beyond an IT outage
TF1’s report shows frozen goods being withdrawn in a supermarket near Bordeaux. In the Rhône, Le Progrès describes forced defrosting at a Super U in Lyon during the night and an attempt to move goods urgently.
Defrosting removes frost from the evaporator, the component that absorbs heat to provide cooling. Depending on the installation, it interrupts cooling or adds heat. Abusing this function can therefore disrupt food storage conditions. The cited Danfoss manual describes these general principles; it does not establish which method the affected stores used.
These observations illustrate an operational consequence: getting software running again does not, by itself, resolve what happens to the stock. A store manager must separately handle refrigeration recovery, withdrawn products and replenishment. Local loss reports do not provide a basis for calculating a nationwide cost.
The intrusion method remains unestablished
TF1 discusses Danfoss systems as a possible lead. That does not establish which specific model was exploited, whether the manufacturer’s servers were compromised or whether a stolen credential played a role. The sources reviewed also do not establish a customer data breach.
In August 2025, Danfoss published guidance for AK-SM 800A version 4.3.1: a service port disabled by default, temporary reactivation when needed and stronger rules for new passwords. This documentation gives maintainers checks to consider; it does not prove that this version or port explains the French incident.
For your installation, ask the maintainer to check the current versions and guidance for the installed model using Danfoss’s official support page. The version cited here is historical context, rather than an upgrade recommendation or a proven fix for this attack.
For customers: check with your store
Before travelling to buy fresh or frozen food, check your local Intermarché or U store’s updates, or contact it directly. The situation at one branch cannot establish the position at every store in the chain.
Reports about withdrawn stock are not a list of recalled batches. If a store publishes instructions about a specific purchase, follow that communication. This article cannot determine whether a product bought before the incident is affected.
For operators: review remote maintenance
If your store is affected, have the technical responders preserve connection logs and available histories, and record actions taken during recovery. Cybermalveillance.gouv.fr recommends preserving evidence and keeping an incident record. Coordinate this collection with the refrigeration contractor and incident responders, accounting for safety and stock preservation constraints.
Work with the refrigeration contractor and IT lead to identify remotely controllable equipment, its accounts and the people authorised to intervene. Ask a simple question about each access path: can it only read a temperature, or can it change a setting? That distinction helps prioritise access capable of changing refrigeration operation.
ANSSI recommends controlling remote maintenance through connections opened on demand for a defined period, authentication, strong passwords, logging and restrictions on necessary network flows. Apply these principles alongside the store’s operating constraints. Have maintainers approve changes rather than indiscriminately disconnecting links that alarms may depend on.
The connection with Soclyde
For a store using maintenance or monitoring credentials, Soclyde helps keep passwords in an encrypted vault on devices. Sharing access between users, included in Premium, reduces copies scattered across messages and documents. The vault resides on authorised devices, without a central cloud vault operated by Soclyde.
That benefit concerns organising secrets. Removing a contractor’s account, changing its permissions or replacing its password happens in the maintenance system. Soclyde does not protect refrigeration controllers against a software vulnerability and cannot justify a claim that the 12 October attack would have been prevented.
Key points to remember
This incident shows why refrigeration equipment belongs in a store’s discussions about digital access. The priority is to understand which people and tools can change refrigeration settings, then prepare a response with contractors that accounts for stock constraints.
To organise credentials, read our SMB password policy guide and our guide to sharing passwords in a team. These measures complement maintenance and network security; they do not replace technical investigation of the incident.
Generated editorial illustration: it does not depict an identified affected store.
