Hundreds of French supermarkets, including major chains Intermarché, Coopérative U, E. Leclerc, Carrefour, and Monoprix, experienced significant food spoilage following a cyberattack on their refrigeration systems. The attack, which occurred overnight on October 11-12, remotely manipulated cooling regulators, forcing them into continuous defrost cycles and driving internal temperatures to extremes, in some cases reaching 50 degrees Celsius. Julien Freret, director of an Intermarché store in La Haye, Normandy, reported a complete loss of fresh and frozen stock, with temperatures in some fridges reportedly reaching 80 degrees Celsius, causing equipment to melt.
Les Mousquetaires, the parent company of Intermarché and Netto, stated that approximately 150 of its stores were affected, with refrigeration units exposed to high temperatures for six hours. A spokesperson for Les Mousquetaires confirmed that all affected food was discarded to prevent health risks. Dominique Schelcher, CEO of Coopérative U, characterized the incident as "unprecedented" and "of extreme gravity," highlighting the targeting of equipment essential to food preservation. Coopérative U reported that around 80 of its 2,000 stores were impacted. Carrefour stated that 80 of its supermarkets were hit, while Monoprix indicated that approximately 5% of its 490 French stores were affected. E. Leclerc also confirmed that a cyberattack impacted one of its refrigeration equipment suppliers, leading to repercussions on its cooling systems in several stores.
The Paris prosecutor's office has initiated an investigation into the large-scale cyberattack, which also reportedly caused fires in some locations. French Prime Minister Sébastien Lecornu has directed the national cybersecurity agency ANSSI to investigate the incident. ANSSI has identified a vulnerability in software supplied by the Danish company Danfoss, which manufactures the refrigeration control systems used by the affected supermarkets. Danfoss acknowledged incidents in France affecting a limited number of its refrigeration management systems, noting that the compromised units were running outdated firmware. The company has previously advised customers to update their systems with the latest firmware and migrate older systems to current-generation solutions. Cybersecurity firm Claroty's Team82 had reported vulnerabilities in the Danfoss AK-SM 800A system in August 2026, including an authentication bypass mechanism.
The attack has raised broader concerns about the cybersecurity of critical infrastructure and food supply chains, which increasingly rely on network-connected systems. Christophe Hansen, the European Union's food and agriculture commissioner, condemned the attack, emphasizing the need for increased attention to food security at all levels. Intermarché CEO Thierry Cotillard estimated the nationwide losses from the attack could amount to "tens of millions of euros in a single day." Individual stores have reported substantial damages; for instance, an Intermarché and an E. Leclerc in Haguenau, eastern France, estimated combined stock losses at €270,000. The incident also comes amidst heightened vigilance against cyberattacks in Europe, following warnings from French President Emmanuel Macron about potential "hybrid attacks."
The full extent of the attack's reach is still under investigation. While the immediate focus is on France, authorities are coordinating with European counterparts as other countries may also be affected. The Dutch supermarket company Ahold Delhaize also reported dealing with a "security issue" in its network, which disrupted online orders and took some systems offline, though a direct link to the French attacks has not been confirmed.