Cyberattack on refrigeration systems caused significant losses to French supermarkets
In France, hundreds of supermarkets suffered a massive cyberattack on refrigeration control systems. The attackers remotely changed temperature settings, causing refrigerators and freezers to overheat, and retail chains were forced to dispose of large quantities of food products. Losses could amount to millions of euros.
This was reported by Le Monde and CBC with reference to representatives of retail chains and cybersecurity experts.
The first wave of attacks occurred on the night of October 11-12, 2026. Refrigeration systems in Intermarché, Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc stores were affected.
According to Le Monde, approximately 300 Intermarché and Netto stores experienced problems, about 100 Coopérative U outlets, 80 Carrefour supermarkets, and 30 Monoprix stores. Some individual E.Leclerc locations were also affected.
The exact number of affected stores has not yet been definitively established, as different chains reported the aftermath of the attack separately.
Hackers forced refrigerators to heat up
The attackers gained access to digital systems used for remote temperature control in cold rooms and freezer equipment in supermarkets.
Instead of normal cooling mode, they initiated forced defrost and modified its parameters. This caused the temperature inside some cold storage areas to rise to 50 degrees Celsius.
In some cases, hackers also extended the defrost cycle, delaying activation of fault warning systems. This allowed equipment to overheat for extended periods before staff noticed the problem.
In an Intermarché supermarket in the town of Gradignan, employees discovered the effects of the attack only in the morning, when the cold room was already flooded with water from thawed products. The temperature increase also triggered the fire protection system.
Due to temperature violations, stores were forced to remove meat, dairy products, frozen goods, and other products requiring constant refrigeration from sale.
Retail chains suffered significant losses
The cyberattack caused not only product spoilage but also temporary disruption to some supermarkets' operations. Some stores delayed opening to clean cold rooms and inspect equipment.
An owner of an Intermarché supermarket reported a loss of products with a purchase price of 21,000 euros. Damaged goods had to be disposed of.
The overall financial impact on the French retail sector is still being assessed. Preliminary estimates point to at least several million euros, though no final loss figure exists yet.
Additional expenses relate to equipment inspection, restoration of refrigeration systems, disposal of products, and restocking shelves.
Insurance coverage may become a separate problem. Intermarché representatives noted that existing insurance contracts do not necessarily cover losses from such cyber incidents.
Coopérative U CEO Dominique Schelcher called the attack unprecedented, highlighting the danger of tampering with equipment on which food storage depends.
Possible cause: vulnerabilities in outdated software
During the investigation, experts focused on refrigeration control systems by the Danish company Danfoss.
These solutions allow specialized service providers to remotely monitor temperatures, adjust settings, and control operation of refrigeration units.
According to BleepingComputer, vulnerabilities had previously been found in some Danfoss controllers that potentially allowed third parties to gain access to equipment. The manufacturer released corresponding security updates in 2025.
Danfoss reported that a significant portion of affected devices belong to outdated models for which software updates are no longer released, or use old firmware.
At the same time, the exact technical method of intrusion by the attackers has not yet been definitively established. The presence of known vulnerabilities does not necessarily mean they were exploited in this attack.
Attacks spread to equipment from other manufacturers
On the night of October 12-13, another wave of intrusions into refrigeration systems was recorded in France. This time, equipment of the Dixell brand, owned by American company Copeland, was affected.
Le Monde reports that in a supermarket near Bordeaux, specialists promptly noticed unauthorized changes to temperature settings and managed to prevent product spoilage.
Meanwhile, another E.Leclerc store was forced to dispose of goods due to disruption of the cold chain.
The French National Agency for Cybersecurity ANSSI confirmed receiving information about compromise of software used in Dixell and Copeland refrigeration systems.
According to preliminary data, the second wave was smaller in scale than the first.
French prosecutor's office launched an investigation
The Paris public prosecutor's office opened an investigation into the cyberattack. Law enforcement agencies are establishing the number of affected businesses, the intrusion mechanism, and the extent of damages.
The French agency ANSSI was also involved in the investigation.
As of October 14, the perpetrators of the attack remain unknown. No group has publicly claimed responsibility, and there is no confirmed information about ransom demands or political motives.
The incident demonstrated risks associated with using internet-connected industrial equipment. A cyberattack targeting not bank accounts or personal data but control systems directly caused real material losses and disrupted food supply operations.
For commercial companies, such cases highlight the need to strengthen protection not only of corporate information systems but also of technological equipment on which business continuity depends.
Source: Le Monde, Le Monde — about the second wave of attacks, BleepingComputer, CBC