PARIS: A major cyberattack targeting supermarket refrigeration systems across France has caused temperatures in some refrigerators and freezers to rise to 50°C, damaging large quantities of fresh and frozen food and triggering fires at several stores. The attack, reported on October 12, 2026, affected hundreds of supermarket outlets and prompted a criminal investigation by French authorities.
Major retail chains, including Carrefour, Monoprix, Intermarché and Coopérative U, reported disruptions to their refrigeration equipment. The affected stores were forced to discard food that could no longer be considered safe for consumption.
France’s National Cybersecurity Agency (ANSSI) has been asked to investigate the incident, while the Paris prosecutor’s office is examining the attack. Authorities are also coordinating with counterparts in other European countries amid concerns that the incident could have a wider impact.
The incident has raised concerns about the security of connected equipment used to manage essential services and food supply chains. Unlike conventional cyberattacks that focus on stealing information or disrupting computer networks, this incident targeted the systems responsible for keeping perishable food at safe temperatures.
Hundreds of supermarket outlets affected
The scale of the disruption became clearer as retailers assessed the damage. Carrefour reported that 80 of its supermarkets had been affected, while Monoprix said around 5 per cent of its stores were hit.
Les Mousquetaires, the group that operates Intermarché, reported that refrigeration units in approximately 150 stores had been heated to 50°C for around six hours overnight. Coopérative U also confirmed that its stores had been targeted, with reports indicating that nearly 100 outlets belonging to the group were affected.
The figures indicate that the attack extended across several retail networks rather than being confined to a single supermarket chain. Reports also identified E.Leclerc outlets among the potentially affected locations, although confirmation from individual retailers varied.
Employees arriving at affected stores discovered that refrigerated and frozen products had deteriorated. At an Intermarché outlet in Paris, staff were seen disposing of large quantities of defrosted food, including ice cream.
Retailers decided to discard affected stock to prevent potential health risks. Food safety depends on maintaining appropriate temperatures throughout storage and distribution, and products exposed to unsuitable conditions cannot automatically be considered safe simply because they are subsequently cooled again.
The losses also created additional work for store employees, who had to remove spoiled products, clean affected areas and assess refrigeration equipment before normal operations could resume.
How hackers manipulated refrigeration systems
The attack appears to have exploited weaknesses in connected refrigeration management systems. These systems allow supermarket operators and maintenance providers to monitor and control multiple refrigerators and freezers through centralised equipment.
Remote access can help retailers manage temperatures, detect faults and reduce maintenance costs. However, if the software or access controls are inadequately protected, attackers may be able to interfere with equipment without physically entering a store.
In this incident, the attackers reportedly manipulated refrigeration controls and triggered defrost cycles. These cycles are normally used to remove ice that accumulates in cooling equipment, but keeping the process running improperly can cause temperatures to rise and compromise food storage.
Investigators have identified a vulnerability involving refrigeration management software supplied by Danish company Danfoss. The company acknowledged that some affected systems were running outdated firmware and said it had advised customers to keep supported systems updated and move older equipment to current-generation solutions.
Cybersecurity research published by Claroty’s Team82 on August 9, 2026, had documented vulnerabilities in the Danfoss AK-SM 800A controller. According to the research cited in reports, subsequent software updates addressed flaws that could allow attackers to bypass authentication protections and execute code on compromised devices.
The identification of a potential software weakness does not, by itself, establish precisely how the attackers gained access. Investigators will need to determine which systems were compromised, whether the known vulnerabilities were exploited and whether additional weaknesses contributed to the incident.
French authorities launch investigation
The Paris prosecutor’s office described the incident as a large-scale cyberattack affecting connected refrigeration equipment at major food retailers. Reported damage included food losses and fires.
Prime Minister Sébastien Lecornu instructed France’s National Cybersecurity Agency, known as ANSSI, to investigate the attack, according to an official from his office.
The investigation will need to establish the extent of the intrusion, the methods used and whether the attack was coordinated across different supermarket chains. Authorities may also examine whether the same weaknesses exist in other organisations using similar refrigeration systems.
As of October 13, reports had not established who was responsible for the attack or what motivated it. No confirmed attribution to a particular individual, criminal group or state actor had been announced in the cited reports.
The absence of a confirmed motive is significant. Although the incident caused substantial commercial damage, investigators have not publicly established whether the objective was financial gain, sabotage or another purpose.
The case also highlights the need to treat operational technology as part of an organisation’s cybersecurity responsibilities. Systems that control physical equipment can create risks extending beyond data loss, particularly when they are connected to networks that can be accessed remotely.
Possible impact beyond France
Cybersecurity analyst Felix Aime of Sekoia Threat Detection and Research said Spain, Portugal, Poland, Germany and Belgium may also have been affected. French authorities were coordinating with European counterparts to assess the possible international impact.
However, the extent of any disruption outside France remained unclear. Further investigation is required to determine whether the incidents involved the same vulnerability, the same attackers or separate security problems.
Dutch retail group Ahold Delhaize, which operates Albert Heijn in the Netherlands and several supermarket chains in the United States, also reported a cybersecurity issue and took some systems offline as a precaution.
The company said there was no reason to link its network incident to the attacks affecting French supermarkets. Its statement means the two incidents should not be treated as part of the same operation without further evidence.
If similar refrigeration vulnerabilities are found elsewhere, retailers could face pressure to review remote access arrangements, update outdated firmware and strengthen monitoring of equipment used to preserve food.
Financial losses and food supply concerns
The full financial impact of the attack remained uncertain. Intermarché and other retailers faced the cost of discarded stock, equipment checks, cleaning and potential repairs, alongside disruption to normal store operations.
Thierry Cotillard, head of the Les Mousquetaires group, estimated that the damage across the industry could reach tens of millions of euros in a single day, according to reports. The final cost will depend on the quantity of food destroyed, the number of affected stores and how quickly refrigeration systems can be restored.
European retail association EuroCommerce warned that the incident highlighted the importance of resilience across supply chains. Supermarkets depend on refrigeration not only to maintain product quality but also to support food safety and prevent avoidable waste.
The incident demonstrates how a digital intrusion can have immediate physical and economic consequences. A failure in refrigeration controls can affect food supplies, increase operating costs and force businesses to dispose of products that would otherwise have been sold.
Conclusion
The cyberattack on French supermarkets has exposed the risks associated with connected refrigeration equipment and outdated software. By manipulating systems designed to keep food cold, attackers caused widespread spoilage and disrupted operations across several major retail chains.
French authorities and cybersecurity specialists are investigating the incident, while retailers assess their losses and work to restore affected equipment. The identity of the attackers and the full extent of the damage remain unconfirmed.
The case serves as a warning to retailers and other businesses that cybersecurity must extend beyond computers and customer databases to include the physical systems on which essential services depend.