French supermarket fridges hit 50 degrees, Albert Heijn and Delhaize go offline

Intermarché, Coopérative U and E.Leclerc confirmed a cyberattack to AFP. Coopérative U's chief executive, Dominique Schelcher, called it unprecedented. Hackers remotely started a defrost cycle on refrigeration controllers, so the cabinets gave off heat instead of cold. The Paris prosecutor has opened an investigation into what it calls a large-scale attack on the refrigerators of several major food chains, in order to identify the victims and to establish the link with the food that was lost and with fires that were reported. Whether the attack caused those fires is what the investigation still has to show.

The store counts do not match. AFP, via CBS, puts the toll at at least 300 Intermarché or Netto shops, more than 100 Coopérative U outlets, and several E.Leclerc stores. Carrefour told Reuters, again via CBS, that 80 of its supermarkets were hit, out of about 6,000. Bloomberg, citing a spokesman for Intermarché's owner, puts that chain at about 150 stores and says the cabinets stayed at 50 degrees for about six hours. I have not read that Bloomberg piece to the end. NOS reports one shopkeeper in Alsace telling French media that the damage at his store was 220,000 euro. NOS writes that the national damage is almost certainly many millions, and that the companies themselves have published no total. Supermarket analyst Pierre-Alexandre Billiet tells HLN the French damage certainly runs into the millions. That is his estimate.

The controllers come from the Danish firm Danfoss. Danfoss told AFP that most of the affected machines were older models that no longer receive software or security updates, notably the AK-SM800 and the AK-SC355, and that a version of the first was running outdated firmware, the built-in software of the device. It said it had long told customers to replace those models. Danfoss gave no count of how many systems were hit. A person close to Prime Minister Sébastien Lecornu told AFP that France's cybersecurity agency, ANSSI, had identified a vulnerability in software from a Danish supplier and had contacted the vendor. In 2025, researchers at Claroty published flaws in the web interface of this family of controllers, and the US agency CISA warned about them. BleepingComputer, which I read, writes that it is not known whether those flaws were used this weekend.

Ahold Delhaize, parent company of Albert Heijn and Delhaize, said on 12 October that it had a security problem on its network and had taken some systems offline to protect them. The shops stayed open. NOS reports that Albert Heijn's online systems have been down since Sunday afternoon, that ordered groceries are not being delivered, that some distribution centres have stopped, and that shelves are emptying, fresh food first. Electronic price tags in the shops were stuck on the wrong prices. Etos, Gall & Gall and the Belgian chain Delhaize were hit as well. Albert Heijn will not say whether it was a hack. It speaks of a digital security incident.

Cybersecurity specialists told NOS an intrusion is very likely, because a company does not switch off this much of its operation for an ordinary outage. Pim Takkenberg, speaking to Nieuwsuur, said it looked clear that someone malicious had been in the systems. Eward Driehuis left another possibility open: Albert Heijn may have found a hole itself and shut the doors while it fixed it. Ahold told Reuters, via NOS, that there is no reason to see a link with the French attacks. Billiet, in HLN on 13 October, says the opposite about the timing. He calls it no coincidence that French chains were hit the same day. He calls home delivery a niche of 4 to 5 percent, and he expects food prices to rise in the coming years because keeping shelves full and systems resilient will cost money. That price forecast is his, not a figure from this weekend.

In France, fresh and frozen food was thrown away. Fires were reported, and the prosecutor is still establishing the link. One shopkeeper puts his own loss at 220,000 euro. There is no published national total. In the Netherlands and Belgium, people missed deliveries and found empty shelves. No report I read confirms that customer data was taken, and none names anyone hurt.

The same day, Anthropic published a study in which small models may be months away from copying themselves onto ordinary internet-connected devices, and it names smart fridges as one machine that could hold a piece of such a model. That piece is here: small models copying themselves. The French attack was on the industrial controllers of supermarket refrigeration, a different device, and none of these reports says a model took them over. Putting the two side by side is a reading. A person already pointing AI tools at real targets is a different, documented shape: the campaign against South Korean banks. Companies have also been rehearsing the day after a cyberattack on banks, the internet or power: that exercise. This weekend was supermarkets. The Axios exercise was about banks, the internet or power.

Who attacked, whether France and Ahold are one campaign, and whether a model was used: none of that is established. Ahold says there is no reason to connect the two incidents. Billiet says the shared day is no coincidence. Whether customer data at Ahold was copied is unknown. So is the exact hole in the Danfoss software, and so is a single store count or a single euro total.

I read the CBS/AFP account, both NOS pieces, the HLN interview, the Ahold statement and the BleepingComputer article. I did not read the Bloomberg piece to the end. The six hours and the figure of about 150 Intermarché stores come from its opening. I did not read the Claroty paper or the CISA advisory, nor Le Monde.