Overview
Hundreds of supermarkets across France have suffered significant food losses after hackers remotely manipulated refrigeration systems, forcing refrigerators and freezers to heat up overnight and leaving retailers facing potentially millions of euros in damage.
The cyberattack, which occurred overnight on October 11-12, 2026, affected several major grocery chains, including Intermarché, Netto, Coopérative U, Carrefour and E.Leclerc. Monoprix also reported disruption.
- French supermarkets were affected by a coordinated cyberattack that remotely triggered refrigeration defrost cycles, raising temperatures to as high as 50°C and destroying fresh and frozen food.
- Major retailers including Intermarché, Netto, Coopérative U, Carrefour and E.Leclerc reported disruption. The attack targeted refrigeration management systems supplied by Danish manufacturer Danfoss.
- French prosecutors and cybersecurity agency ANSSI are investigating the incident, which caused fires and potentially millions of euros in losses. Authorities are also examining possible risks to other European countries.
Attackers gained access to connected refrigeration controllers and activated prolonged defrost cycles, causing temperatures in some units to reach 50°C. Retailers were forced to discard fresh and frozen products to prevent food safety risks.
The Paris prosecutor’s office confirmed an investigation into a “large-scale cyber-attack affecting the refrigerators of several major food retail chains across France”, citing reports of food losses and fires.
Danfoss refrigeration systems targeted in cyberattack
The incident involved refrigeration management technology supplied by Danish engineering company Danfoss, which enables supermarkets to monitor and control cooling equipment remotely.
According to French cybersecurity authorities, vulnerabilities were identified in Danfoss software used to operate connected refrigeration systems.
Danfoss confirmed that the affected equipment included older refrigeration controllers operating outdated firmware, including models from its AK-SM and AK-SC product ranges.
The company said it had previously advised customers to update supported systems and replace legacy equipment that no longer receives security patches.
Reliable refrigeration is critical to our customers’ operations, and we remain committed to supporting our customers and helping them maintain secure and reliable systems they are used to.
Danfoss
The precise method used to compromise the systems has not been publicly established.
France’s national cybersecurity agency, ANSSI, has instructed organizations operating vulnerable systems to restrict network access or disconnect affected controllers while remediation measures are implemented.
Supermarket chains report extensive food losses
Les Mousquetaires, which owns Intermarché and Netto, reported that approximately 150 Intermarché stores experienced refrigeration failures, while other accounts indicated a wider number of affected or targeted outlets.
The group said temperatures in some refrigeration systems reached 50°C for approximately six hours. Affected products were discarded because their safety could no longer be guaranteed.
Coopérative U reported disruption at more than 100 supermarkets. “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” said Dominique Schelcher, the retailer’s chief executive.
Carrefour reported that refrigeration equipment in 80 of its approximately 6,000 stores had been compromised. Monoprix said around 5% of its more than 400 locations were affected.
E.Leclerc also confirmed that a cyberattack involving one of its refrigeration equipment suppliers had disrupted operations in several stores.
The full financial impact remains unknown. French broadcaster BFMTV reported that two supermarkets in the Alsace region alone suffered combined losses of approximately €270,000, suggesting nationwide damage could reach several million euros.
Retailers have begun restoring equipment and restocking shelves, although some refrigeration units remained unavailable on October 12.
Cyberattack raises concerns over food security and business interruption
French Prime Minister Sébastien Lecornu instructed ANSSI to investigate the attack and coordinate with European cybersecurity authorities. Officials are assessing whether similar vulnerabilities could affect businesses in other countries.
Dutch supermarket group Ahold Delhaize separately reported a cybersecurity issue affecting several digital systems, including services used by Albert Heijn and Delhaize. The company temporarily disabled some systems as a precaution.
No direct connection between that incident and the French supermarket attack has been established.
European Commissioner for Agriculture and Food Christophe Hansen condemned the targeting of food infrastructure. “Food security requires more attention at all levels. Because the weaponisation of food has become a reality,” Hansen wrote on X.
For retailers and insurers, the incident raises questions about cyber-related property losses, spoiled inventory, equipment damage and business interruption coverage. Whether losses are recoverable will depend on individual insurance policies and the circumstances of the attack.
The investigation also illustrates the operational consequences of compromised connected equipment. In this case, attackers caused physical damage and destroyed inventory without needing to shut down retailers’ entire computer networks.
French authorities have not identified the perpetrators, and the total number of affected stores and resulting financial losses remain under investigation.
