Hackers remotely manipulated refrigeration systems at hundreds of French supermarkets, causing temperatures to rise to dangerous levels and forcing retailers to discard large quantities of fresh and frozen food.
The cyberattack struck overnight between October 11 and 12, 2026, affecting approximately 700 supermarkets across France, according to figures disclosed by French Finance Minister Roland Lescure.
Major retail chains affected by the incident include Carrefour, Intermarché, Netto, Coopérative U, Monoprix and E.Leclerc.
Unlike conventional cyberattacks involving stolen customer information or encrypted business systems, this incident directly interfered with equipment responsible for preserving food.
French authorities have opened an investigation, while the country’s national cybersecurity agency is examining compromises involving internet-connected refrigeration control systems.
Attackers reportedly raised temperatures to 50°C
The attackers reportedly gained unauthorized control over refrigeration management systems and manipulated settings responsible for regulating temperatures and automatic defrost cycles.
Some refrigeration units reportedly reached temperatures of approximately 50°C (122°F), rendering stored food unsafe for consumption.
According to reports, attackers extended defrost cycles from approximately 1 hour to as long as 8 hours, delaying the return to normal cooling conditions and increasing the damage.
Several supermarkets were forced to empty refrigerated display cases and cold-storage rooms, discarding meat, frozen products and other perishable goods.
Some locations temporarily closed affected departments while employees removed spoiled products and inspected refrigeration equipment.
Retailers also reported equipment damage, with French authorities investigating reports of fires associated with the incident.
Hundreds of stores affected across major retail chains
The attack disrupted several competing supermarket groups rather than a single retail organization.
Reported impacts include:
- Intermarché and Netto: Approximately 300 stores affected, according to figures provided by the retail group.
- Carrefour: Approximately 80 supermarkets affected.
- Coopérative U: Around 80 stores affected, with some locations forced to discard refrigerated products.
- Monoprix: Approximately 5% of its French stores reportedly experienced refrigeration problems.
- E.Leclerc: Additional locations experienced disruptions involving refrigerated equipment.
French officials subsequently estimated that approximately 700 of the country’s 10,000 supermarkets had been affected.
The financial consequences could be substantial. Retailers have reported significant losses from spoiled food, damaged equipment, emergency repairs and interruptions to normal operations.
Industry estimates suggest the total losses could reach tens of millions of euros, although a definitive nationwide figure has not been established.
Outdated refrigeration controllers under investigation
Investigators are examining vulnerabilities involving remote management systems used to monitor and control commercial refrigeration equipment.
The affected technology includes refrigeration controllers associated with manufacturers Danfoss and Copeland.
Danfoss acknowledged that many affected installations were operating outdated firmware or equipment that had reached the end of its supported lifecycle.
Such systems may no longer receive security updates, leaving previously identified vulnerabilities unresolved.
The company has recommended that customers update supported equipment and replace obsolete systems with newer products.
Security researchers have previously identified weaknesses in connected refrigeration management technology that could allow unauthorized users to manipulate operating parameters.
However, authorities have not conclusively established which vulnerability or access method was used in every affected installation.
The incident also raises concerns about refrigeration controllers exposed directly to the internet, particularly when remote management interfaces lack adequate authentication or network restrictions.
Cyberattack exposes risks to physical infrastructure
The disruption demonstrates how compromised operational technology can produce immediate physical consequences without attackers needing to deploy ransomware or steal sensitive information.
Commercial refrigeration systems are increasingly connected to networks that allow technicians and service providers to monitor equipment remotely.
These capabilities simplify maintenance but can also introduce security risks when devices remain accessible through outdated software, exposed management interfaces or poorly protected remote connections.
Unlike traditional corporate IT systems, refrigeration equipment directly affects the storage and safety of food products.
Unauthorized changes to temperature settings can therefore cause substantial financial losses within hours, particularly when attacks occur overnight and remain undetected until employees arrive.
The incident also highlights potential third-party risks, as retailers frequently depend on external refrigeration specialists to install, maintain and remotely manage their equipment.
Organizations operating similar systems can reduce exposure by restricting remote management access, updating supported firmware, isolating operational equipment from public networks and monitoring unexpected changes to temperature and defrost settings.
French authorities investigate as attackers remain unidentified
The Paris prosecutor’s office has opened an investigation into the attacks, with France’s cybercrime investigators working to identify those responsible and establish the extent of the damage.
France’s national cybersecurity agency, ANSSI, has also been involved in examining the affected systems and the possibility of continued malicious activity.
No established ransomware group or other threat actor had publicly claimed responsibility for the operation at the time of publication.
Investigators have also not publicly confirmed a financial motive or identified an extortion demand associated with the attacks.
The absence of an identified perpetrator leaves the motivation uncertain, although the coordinated disruption of refrigeration systems across competing supermarket chains suggests attackers were targeting shared technological weaknesses rather than a single retailer’s corporate network.
French officials have emphasized the importance of protecting connected equipment used throughout the food supply chain.
The incident illustrates how weaknesses in aging industrial and commercial control systems can turn a cybersecurity compromise into widespread operational disruption, financial losses and potential food safety concerns.
