A major cyberattack raised refrigeration temperatures to 50°C at hundreds of stores across France, triggering food losses and a national investigation into vulnerable control systems.
Hackers targeted hundreds of supermarkets across France overnight on October 11 and 12, 2026, remotely raising refrigerator and freezer temperatures to as high as 50 degrees Celsius (122 degrees Fahrenheit). The cyberattack spoiled large quantities of food, reportedly caused fires at some locations and disrupted operations at several major grocery chains.
The Paris prosecutor’s office confirmed that connected refrigeration systems had been targeted in a large-scale attack. French Prime Minister Sébastien Lecornu directed the country’s National Cybersecurity Agency, known as ANSSI, to investigate the incident and assess whether other businesses faced similar risks.
The attack affected Intermarché, Carrefour, Monoprix and Coopérative U, among other retailers. Some supermarkets remained open but had to close refrigerated sections and discard food that could no longer be considered safe for sale.
Intermarché was among the hardest-hit retailers, with approximately 150 stores affected. Parent company Les Mousquetaires said hackers caused refrigeration units to reach 50°C for about six hours, forcing employees to dispose of affected food.
The scale of the losses became visible Monday as workers emptied refrigerated display cases and freezers. At one Intermarché store in central Paris, employees were seen removing thawed products and filling large waste containers with spoiled merchandise.
Thierry Cotillard, president of Les Mousquetaires, told French television network BFM TV that the incident could produce tens of millions of euros in losses across the country in a single day. The figure was an early estimate rather than a confirmed accounting of the damage.
Carrefour reported that 80 of its supermarkets were affected. The company said the vast majority of its approximately 6,000 stores were not impacted, limiting the disruption across its broader operations.
Monoprix also confirmed problems at about 5% of its roughly 490 stores in France. That percentage represents approximately 25 locations, although the company had not released a final store-by-store assessment.
Coopérative U, which operates grocery stores under several banners, acknowledged that its refrigeration systems had also been targeted. Chief executive Dominique Schelcher described the incident as an unusually serious attack on equipment essential to maintaining food supplies.
Schelcher said the company’s employees were working to restore services and manage the consequences. The incident presented immediate difficulties because refrigerated foods cannot be sold safely after prolonged exposure to high temperatures.
For supermarkets, a refrigeration failure can destroy substantial inventories within hours. Meat, fish, dairy products, frozen meals and other temperature-sensitive goods must remain within appropriate storage conditions throughout transportation, warehousing and display.
When those conditions are disrupted, retailers may have little choice but to discard affected stock. Even products that appear undamaged can become unsafe if their storage temperatures have exceeded acceptable limits for extended periods.
The damage can continue beyond the initial food losses. Stores may face equipment inspections, replacement deliveries, cleaning requirements and temporary closures of refrigerated departments before normal sales resume.
Reports of fires added another serious concern. French prosecutors acknowledged fire damage associated with the cyberattack, although authorities had not publicly established the exact number of incidents, the extent of injuries or the precise circumstances surrounding each fire.
Investigators are examining how attackers gained access to refrigeration management equipment used by multiple supermarket chains. Early findings pointed toward a security weakness involving systems supplied by Danish engineering company Danfoss.
Danfoss manufactures equipment and software used to monitor and regulate commercial refrigeration systems. Its controllers can manage temperatures and operating conditions across numerous refrigerators and freezers within a single store.
These systems can also allow maintenance technicians to monitor equipment and adjust settings remotely. Although remote access can improve efficiency, it creates potential security risks if unauthorized users gain control.
According to Reuters, a source familiar with the French government’s response said ANSSI had identified a vulnerability involving Danfoss software. The investigation was continuing, and authorities had not publicly identified the hackers responsible.
Danfoss acknowledged that incidents in France had affected a limited number of refrigeration management systems. The company said the affected equipment was operating with outdated firmware, the software embedded in electronic devices that controls their basic functions.
The manufacturer emphasized that customers had previously been advised to install current firmware and replace older systems with supported equipment. Outdated software can leave known security weaknesses unresolved, particularly when devices remain connected to external networks.
Cybersecurity researchers had already identified weaknesses in certain Danfoss refrigeration controllers. In August, researchers from industrial cybersecurity company Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A controller that could allow attackers to bypass authentication protections or execute unauthorized commands.
The researchers explained that software updates addressed the identified vulnerabilities. However, the investigation into the French attacks had not established publicly whether those exact weaknesses were used in every affected supermarket.
The incident illustrates the growing security concerns surrounding operational technology, often called OT. These systems control physical equipment such as refrigeration units, manufacturing machinery, electrical systems and building infrastructure.
Unlike conventional computer attacks that primarily affect files, websites or customer information, interference with operational technology can have immediate physical consequences. A compromised controller may cause equipment to malfunction, interrupt production or damage products stored under controlled conditions.
Supermarkets are particularly exposed because refrigeration is essential to their daily operations. A coordinated attack against multiple locations can generate significant financial losses without shutting down payment systems or stealing customer information.
French authorities are also examining whether the problem extends beyond the country’s borders. Officials said they were coordinating with European partners because similar vulnerabilities could exist in refrigeration systems used by retailers elsewhere.
Félix Aimé, a senior cyber threat intelligence analyst at French cybersecurity firm Sekoia, said indications of related attacks had emerged in Spain, Portugal, Poland, Germany and Belgium. The full extent of those incidents had not been independently established.
Meanwhile, Dutch supermarket operator Ahold Delhaize reported a separate security issue affecting its network. The company, which operates Albert Heijn in the Netherlands and several grocery businesses in the United States, temporarily took systems offline as a precaution.
Investigators had not confirmed a connection between the Dutch disruption and the French refrigeration attacks. The simultaneous reports nevertheless increased concern among European retailers about possible weaknesses in interconnected systems.
Christel Delberghe, director general of the European retail association EuroCommerce, emphasized the need for resilience across the supply chain. Grocery retailers depend on refrigeration, transportation, distribution and digital systems working together to keep essential products available.
The French incident also follows earlier cybersecurity disruptions involving refrigerated food storage. In August, approximately a dozen U.S. military commissaries experienced refrigeration problems that resulted in food losses, although authorities have not established that the incidents involved the same attackers.
French retailers are now working to restore affected equipment, replace discarded stock and determine the full financial impact. Some stores resumed normal operations quickly, while others continued dealing with damaged inventory and interrupted refrigeration services.
The Paris prosecutor’s office is investigating the attack alongside national cybersecurity authorities. As of October 12, the hackers’ identities, their motives and the precise method used to compromise all the affected systems had not been publicly established.
The investigation will also help determine whether software weaknesses, insufficient security updates or compromised service providers allowed the attackers to manipulate refrigeration equipment across multiple retailers.
For the affected supermarkets, the immediate priority remains restoring reliable refrigeration and ensuring that replacement food meets safety standards. The wider challenge is preventing another cyberattack from turning systems designed to preserve food into a source of physical and financial damage.
IMAGE: Source Own work Author AG20044018 CC4