A cyberattack on supermarket refrigeration systems in France has caused food losses and fires after hackers remotely manipulated connected fridges and freezers, pushing temperatures as high as 50°C or 122°F. The attack affected hundreds of supermarket outlets across the country, disrupting equipment designed to keep fresh and frozen food safe. Several major retailers reported damage, while French authorities launched an investigation into the incident.
The unusual attack has also raised questions about the cybersecurity of everyday equipment connected to the internet. Unlike a conventional data breach, which may expose customer information or disrupt online services, this incident directly affected physical equipment inside supermarkets.
What happened in the France supermarket cyberattack?
The attack came to light on Monday, October 12, after supermarket chains reported problems with their refrigeration systems. The Paris prosecutor's office confirmed a large-scale cyberattack affecting connected refrigerators at several major food retailers. According to reports, hackers remotely triggered forced defrosting functions in refrigeration systems, causing temperatures to rise sharply. Some units reportedly reached 50°C, or 122°F, and remained at elevated temperatures for around six hours.
The consequences were immediate. Fresh and frozen food became unsafe to sell, while fires were reported at some locations.Intermarché's parent group, Les Mousquetaires, said around 150 of its stores were affected. The company discarded the affected food to avoid potential health risks.
Carrefour reported that 80 supermarkets had been hit. Monoprix also reported disruptions, while Coopérative U confirmed that its stores had been targeted. The full financial impact remains unclear. Intermarché chief executive Thierry Cotillard told French broadcaster BFM TV that the incident could cause losses running into tens of millions of euros across the country in a single day.
How did hackers turn supermarket fridges into furnaces?
The attack appears to have exploited weaknesses in the digital systems used to manage commercial refrigeration equipment. Supermarket refrigerators and freezers often operate through centralised control systems. These systems allow staff and maintenance teams to monitor temperatures, manage cooling cycles and service equipment remotely.
Remote access makes refrigeration easier to manage across large stores and retail chains. However, it can also create a security risk if the systems lack adequate protection or run outdated software. In this incident, attackers reportedly manipulated the controls to force refrigeration units into defrost mode.
The attack demonstrates how access to a digital control system can affect physical operations. A compromised system can do more than interrupt a computer network; it can change how machinery behaves. French authorities identified a vulnerability involving software supplied by Danish engineering company Danfoss, according to a source close to Prime Minister Sébastien Lecornu cited in media reports.
Danfoss said the affected systems were running outdated firmware. The company also said it had advised customers to update supported systems and move away from legacy solutions. Investigators are still examining the incident, and authorities have not publicly established who carried out the attack.
Which French supermarket chains were affected?
Several major retailers reported disruptions, although the extent of the damage differed between companies.
Intermarché: Around 150 stores were affected, according to its parent group, Les Mousquetaires. The retailer discarded the affected food.
Carrefour: The company reported that 80 supermarkets had been hit.
Coopérative U: The supermarket group confirmed that its refrigeration systems were targeted.
Monoprix: The retailer said approximately 5% of its stores were affected.
Reports also mentioned possible disruption at other French retail chains, including E.Leclerc and Auchan, but the extent of their involvement was not fully established in the initial reports. The incident forced stores to deal with spoiled stock, damaged equipment and the task of restoring normal refrigeration. Customers could also encounter closed or emptied refrigerated sections while staff assessed the affected products.
Why did the cyberattack cause food losses and fires?
Refrigeration is essential to supermarket operations because many products must remain within safe temperature ranges throughout storage and display. When refrigeration fails, food can warm beyond the limits required for safe storage. Meat, seafood, dairy products and frozen goods are particularly vulnerable to temperature changes. Simply switching a refrigerator back on does not make food safe again. The attack created an additional problem by reportedly causing fires at some locations.
Is the cyberattack limited to France?
French authorities are coordinating with counterparts in other European countries to determine whether the incident has a wider impact. However, the precise extent of any cross-border connection remained unclear in initial reports. Authorities were also examining whether other French businesses faced similar risks.
Dutch retail group Ahold Delhaize separately reported a cybersecurity issue affecting its network and took some systems offline as a precaution. The group operates Albert Heijn in the Netherlands and several supermarket chains in the United States.
A direct link between the Dutch retailer's incident and the French refrigeration attack had not been established.
What the incident reveals about connected devices
The attack highlights a growing challenge for businesses that rely on internet-connected equipment to manage physical operations. Retailers increasingly use digital systems to control refrigeration, heating, ventilation, security and other essential functions. These technologies can reduce manual work and improve efficiency, but they also create potential entry points for cybercriminals.
A weakness in one component can have consequences far beyond the computer system itself. In a supermarket, that could mean spoiled food, disrupted supply chains and significant financial losses. Keeping firmware updated is one important safeguard. Businesses also need to restrict remote access, use strong authentication, monitor unusual activity and separate operational technology from other corporate networks where possible.
French authorities, including the country's National Cybersecurity Agency (ANSSI), are investigating the incident. The findings should help establish how the attackers gained access, whether the vulnerability was exploited across multiple retailers and what additional protections may be necessary.