The first signs looked like technical failures: dark display cases, confusing alarms and maintenance crews trying to understand why cold-storage rooms were no longer keeping products chilled. But on Monday, Oct. 12, supermarkets across France discovered that their refrigerators and freezers had been remotely manipulated overnight. Temperatures in some stores reached 122°F (50°C), while others reported even higher readings. The emergency forced stores to remove and discard fresh and frozen food, while crews also dealt with fires and sprinkler systems activated by the heat.
The Paris prosecutor’s office confirmed it had opened an investigation into a large-scale cyberattack targeting refrigeration systems at several major grocery chains. It told Agence France-Presse that investigators were seeking to identify the victims and establish the connection between the attack, food losses and reported fires. The scope was still under review as companies inspected their locations. Early estimates put the number of affected stores in the hundreds; the figure of 309 cited in some headlines is a media estimate, not an official total confirmed by the government.
Carrefour said 80 of its supermarkets were affected. Monoprix, which operates about 490 stores in France, estimated that around 5% of its locations were hit. Les Mousquetaires, the group that owns Intermarché and Netto, reported problems at about 150 locations, while other reports put the number of affected stores under its brands at nearly 300. Coopérative U also confirmed disruptions. Estimates shifted as companies inspected their facilities, and because an “affected store” could refer to a location, a cold room or a compromised system.
For shoppers, the most visible consequence was the loss of merchandise and temporarily emptied display cases. In Paris, one resident saw Intermarché workers throw carts full of thawed products into a dumpster, with melted ice cream spilling onto the street. In Gradignan, the owner of a store told Le Monde that the problem was discovered when a delivery driver found the stockroom flooded; the cold room had reached 122°F (50°C), triggering a sprinkler. Because the stores could not confirm that the cold chain had been maintained, they discarded perishable products.
A detail reported at some locations helps explain the scale of the losses. According to Le Monde, in addition to triggering defrost cycles and raising temperatures, the attackers reportedly extended the cycle from one hour to eight hours on certain units, delaying alarms and staff intervention. At one store in Normandy, temperatures reportedly reached 176°F (80°C), damaging equipment. These accounts do not necessarily describe every affected store, but they suggest a maneuver designed to prolong exposure to heat and make an early response more difficult.
The financial toll also grew quickly. Thierry Cotillard, Intermarché’s president, told French broadcaster BFM that the attack could cause tens of millions of euros in losses nationwide in a single day. That was an initial estimate, not an audited industry-wide tally: discarded inventory, repairs, staff hours and lost sales still had to be counted. The French Federation of Commerce and Distribution (FCD) said stores were working to protect customers and resume normal operations; some had already reopened affected areas.
From refrigeration control panels to an international investigation
The investigation is focusing on how these systems are managed. At many supermarkets, a control panel monitors display cases, freezers and cold rooms throughout each store. Remote access allows technicians and maintenance companies to check temperatures and adjust settings without traveling to the location. That connection saves time, but it can also create an entry point if credentials, software or network security are weak.
Another challenge is the way the sector is organized. At many grocery groups, IT systems are decentralized. This means each store or affiliated company manages its own equipment, while specialized contractors maintain refrigeration units. That structure can make it harder to deliver software updates to every location, identify which controllers remain exposed and verify that protective measures have been applied consistently. Responding effectively requires accurate equipment inventories and clear responsibilities among retailers, manufacturers, maintenance companies and local operators. Each link in the chain needs to know what it is responsible for protecting and whom to alert when it detects an anomaly.
Early inquiries pointed to refrigeration controllers and management software made by Danish company Danfoss. A source close to Prime Minister Sébastien Lecornu said the National Agency for the Security of Information Systems, known as ANSSI, had identified a vulnerability in software associated with the equipment. Danfoss said it was aware of incidents in France affecting a limited number of systems and noted that the compromised units were running outdated firmware. The company says it recommends keeping supported equipment updated and migrating older systems to newer solutions.
Firmware is the basic software that allows an electronic device to perform its functions; in an industrial controller, it manages sensors, motors, alarms and commands. An older version may lack security fixes released after its installation. However, the existence of a known vulnerability or outdated software does not prove how the attackers gained access or who they are. Technical investigators will need to determine whether there was direct access to the controllers, misuse of maintenance accounts, a configuration error or another entry point. No group had publicly claimed responsibility for the operation.
Cybersecurity firm Claroty published an analysis in August describing flaws in the Danfoss AK-SM 800A controller. The study outlined problems that could allow attackers to bypass authentication controls and execute code on compromised devices; it also noted that the manufacturer had issued updates. Reuters reported that the units affected by the attack were running outdated firmware. Still, investigators had not confirmed that the vulnerabilities described by Claroty were the method used at the supermarkets. Forensic work will have to establish that before a hypothesis is presented as a definitive explanation.
ANSSI was mobilized to support France’s response and share information with its European counterparts, according to Lecornu’s office. The prime minister assigned the agency to investigate the incident as authorities assessed whether other French companies might be at risk. Félix Aimé, an analyst at Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected; that industry assessment still required official confirmation in each country. The European coordination reflects the fact that suppliers and connected equipment can operate across national borders.
Dominique Schelcher, CEO of Coopérative U, called the attack “extremely serious” and “unprecedented.” He said targeting equipment essential to preserving fresh products and supplying the French public was unacceptable, and that his teams were working to restore service. Christel Delberghe, director general of EuroCommerce, a European retail association, said the incident underscored the importance of resilience throughout the supply chain. Their remarks highlight damage that can extend beyond inventory to logistics and sales.
A localized crisis with questions that cross borders
International concern grew when Dutch group Ahold Delhaize, which operates Albert Heijn in the Netherlands and several chains in the United States, reported a “security issue” on its network and took some systems offline as a precaution. The Albert Heijn app said it could not deliver groceries because of a cybersecurity incident, although physical stores remained open. The company said there was no reason to connect that issue to the attacks in France. Some websites for the group’s U.S. chains displayed outage notices, but no common cause had been established. The timing alone does not prove the incidents were connected.
If other countries are confirmed to have been affected, investigators will need to establish how many devices were exposed, which networks were disconnected and whether there was access to internal systems. They will also need to determine whether any personal or financial data was compromised. In the first reports, the known impact in France centered on refrigeration and food; no theft of customer data at the affected supermarkets had been reported. That distinction helps put the incident in perspective: an operational failure can cause significant losses without evidence of a data breach.
The attack does not, by itself, prove that anyone sought to disrupt France’s food supply, and its purpose remains under investigation. Still, the institutional response reflects the importance of the risk to supply: the prime minister’s office mobilized ANSSI, prosecutors opened a case, and France coordinated with other countries. Christophe Hansen, the European commissioner for agriculture and food, condemned the attack and called for greater attention at every level to protect food security. He warned that “the weaponization of food has become a reality,” a political assessment that does not identify those responsible.
For stores, restoring operations takes more than repairing a machine. They need to check which units are safe, remove affected products, clean, restock and coordinate deliveries with suppliers and distribution centers. Some chains advised stores not to reconnect certain equipment while they strengthened security measures. Business continuity depends on plans to isolate systems, respond to incidents and communicate clearly about which products and services are available. The crisis tested those procedures in a matter of hours.
It also remains unclear who will cover the costs. Intermarché said some commercial insurance policies might not cover this type of incident, raising questions involving insurance, maintenance contracts and cybersecurity obligations. There is still no definitive nationwide assessment of the losses. Cotillard’s estimate offers an initial sense of the potential impact, but the final calculation will depend on how many stores and suppliers were affected and how long operations were disrupted. The figures remain preliminary: it is not yet known how much each chain will absorb, what may be reimbursed or whether suppliers will have direct contractual liability.
The case raises a practical question for retailers around the world: How can specialized systems that support everyday services be protected? The response includes updating equipment that remains supported, replacing systems that no longer receive updates, limiting remote access, strengthening authentication, segmenting networks and monitoring for unusual changes in system controls. It also requires contingency plans and coordination among retailers, manufacturers and contractors. Investigators will need to determine what failed as they continue to assess the full scale and impact of the incident. In sum, the cyberattack damaged food, disrupted operations and tested cross-border coordination among authorities and companies.