Massive cyberattack targeting hundreds of supermarkets

A large-scale cyberattack targeting supermarket refrigeration systems across France has plunged hundreds of grocery stores into a critical situation, with food supplies destroyed, equipment damaged, and fires reported, after hackers remotely manipulated the temperatures of refrigerators and freezers, causing them to rise to 50 degrees Celsius (122 degrees Fahrenheit). This coordinated disruption began on the night of October 11–12, 2026, affecting major supermarket chains such as Intermarché, Carrefour, Coopérative U, and Monoprix; other retailers reported problems as the scope of the attack became clearer. French authorities launched a criminal investigation after refrigerated and frozen products were rendered unfit for consumption, forcing employees to clear entire shelves in their stores and discard large quantities of merchandise. The Paris Public Prosecutor’s Office confirmed that this “large-scale” cyberattack “affected the connected refrigerators of several major food retailers across France,” with the damage including, in particular, “food losses and fires.” Approximately 700 stores were reportedly affected, according to estimates cited by French media, although the exact number is still under investigation. Prime Minister Sébastien Lecornu has ordered the National Cybersecurity Agency (ANSSI) to investigate this unprecedented disruption, which has raised concerns about the vulnerability of critical food distribution infrastructure to malicious digital interference.

Unlike traditional cyberattacks involving the theft of customer data or the use of ransomware that locks down computer systems, this operation targeted the electronic control systems responsible for maintaining safe temperatures inside commercial refrigeration units. Investigators believe the hackers gained remote access to the connected systems and manipulated their automatic defrost functions, which normally activate for short periods to prevent ice from accumulating around cooling components. By altering the temperature settings and extending the defrost cycles, the hackers effectively transformed equipment designed to preserve food into systems capable of generating dangerously high temperatures. Some refrigerators reportedly reached 50 degrees Celsius for several hours, causing frozen products to thaw and exposing refrigerated goods to conditions well beyond food safety limits. According to technical findings reported by French media, some defrost cycles were extended by approximately one to eight hours, thereby preventing the cooling equipment from returning to its normal operating temperatures. This operation demonstrated how remotely accessible industrial controls can be exploited to cause physical damage without the hackers ever having entered the affected buildings. Cybersecurity experts also expressed concerns about outdated software and internet-connected refrigeration systems that may lack adequate protections against unauthorized access.

The consequences became apparent when supermarket employees arrived at work on Monday morning and found refrigerators filled with spoiled goods, partially thawed frozen products, and, in some stores, damage caused by overheating equipment. Les Mousquetaires, the retail group behind Intermarché, confirmed that approximately 150 of its stores had been affected, with refrigeration temperatures reaching 50 degrees Celsius for up to six hours. A company spokesperson stated that all spoiled food had been discarded to eliminate any potential health risks to consumers. Carrefour, for its part, reported that nearly 80 of its supermarkets were affected, although the vast majority of its roughly 6,000 stores remained operational. At an Intermarché in central Paris, employees were seen throwing large quantities of thawed products into trash containers, including ice cream that had melted in its packaging. In Gradignan, near Bordeaux, store manager Charles Dezon described a particularly destructive incident in which overheated refrigeration equipment reportedly triggered a fire suppression system, flooding part of his supermarket and exacerbating the damage. Beyond the immediate destruction of frozen meals, meat, dairy products, and other perishable goods, retailers faced the costly challenge of cleaning up the affected facilities, inspecting their equipment, and replacing their inventory. Intermarché President Thierry Cotillard estimated that this attack could result in losses of tens of millions of euros nationwide in a single day, underscoring the financial consequences of sabotaging systems essential to food preservation.

This cyberattack highlighted significant vulnerabilities in the digital infrastructure controlling commercial refrigeration systems, particularly equipment running on outdated software or lacking adequate protection against unauthorized remote access. French cybersecurity investigators identified vulnerabilities affecting systems manufactured by the Danish company Danfoss, while equipment associated with the American manufacturer Copeland and its Dixell brand was also targeted. According to CNN, more than 1,700 instances of the affected Danfoss software were publicly accessible via the Internet in France prior to the attack, which could have allowed hackers to remotely manipulate the controls of the refrigeration systems. The cybersecurity firm Claroty had already identified vulnerabilities affecting some of these controllers in early 2026, raising questions about whether previous warnings had been adequately addressed. Danfoss acknowledged that many of the affected devices were obsolete and stated that it had “long advised its customers to keep supported systems up to date with the latest firmware and to migrate legacy systems to next-generation solutions.” The manufacturer explained that the older equipment had reached the end of its supported lifecycle and was no longer receiving regular security updates. This incident has heightened scrutiny of supermarket operators and third-party maintenance providers responsible for protecting critical refrigeration systems against increasingly sophisticated cyberthreats.

The French government has launched an investigation into this nationwide disruption. Prime Minister Sébastien Lecornu has tasked the National Cybersecurity Agency (ANSSI) with examining the compromised refrigeration systems and identifying the vulnerabilities exploited by the attackers. The cybercrime unit of the Paris Public Prosecutor’s Office is also investigating this incident, while reports of other attacks involving Dixell equipment were revealed on October 13. Economy Minister Roland Lescure addressed the seriousness of this disruption before lawmakers, stating: “When we discovered this cyberattack, it raised concerns about the ability of our supply chains to properly deliver food to all our citizens.” He added: “This is a wake-up call for everyone. ” This incident comes just a few weeks after President Emmanuel Macron warned of the growing threat of cyberattacks and foreign interference targeting France’s critical infrastructure. Speaking in September, Mr. Macron referred to the “Russian hybrid threat facing Europeans and France,” warning that the danger had “intensified” in recent weeks. However, French authorities have not attributed the attacks on the supermarkets to Russia nor identified a group responsible. Investigators are seeking to determine whether the operation was intended to cause economic harm, disrupt essential services, or exploit poorly secured equipment, without any broader political objective.

The consequences of this attack have extended beyond France, raising concerns that similar vulnerabilities may threaten food distributors and refrigerated supply chains throughout Europe. Cybersecurity researchers have reported comparable incidents affecting refrigeration equipment in Spain, Portugal, Poland, Germany, and Belgium, although the exact extent of these disruptions is still under investigation. In addition, the Dutch supermarket chain Ahold Delhaize experienced a security incident that forced some of its digital services offline, but the company has not linked its issues to the attacks in France. The European Commissioner for Agriculture and Food, Christophe Hansen, warned of broader implications for food security, stating: “The use of food as a weapon has become a reality.” This incident also follows reports of similar disruptions to refrigeration systems that affected a dozen U.S. Army food stores in August, although investigators have not publicly determined whether these events were linked. Despite the destruction of significant quantities of food, French authorities have reassured consumers that these attacks do not currently threaten the overall availability of food in the country. Nevertheless, this operation demonstrated the extent to which vulnerabilities in common connected devices can cause considerable physical and financial damage, disrupting business operations and destroying essential goods without hackers needing to physically enter a single supermarket.

Massive cyberattack targeting hundreds of supermarkets