French Supermarkets Hit by Cyber Attack as Refrigerators Heat Up to 50C

Key Points

• Hundreds of French supermarkets were affected by a cyber attack targeting refrigeration systems, disrupting the storage of fresh and frozen food.
• Hackers reportedly manipulated software supplied by Danish engineering company Danfoss, causing some refrigeration units to heat up to 50C for six hours overnight.
• More than 100 Coopérative U supermarkets and at least 300 stores operated by Intermarché and its Netto brand were reportedly targeted.
• Carrefour reported that refrigerators in 80 of its approximately 6,000 stores were affected, while Monoprix said around 5% of its more than 400 outlets had been hit.
• Other major retailers, including E.Leclerc, were also reported to have been affected, although the full scale of the incident remains unclear.
• Retailers removed potentially unsafe food from sale, with Intermarché reportedly discarding affected products to reduce the risk to consumers.
• Two supermarkets in the Alsace region reported combined losses of €270,000 (£228,000), raising concerns that nationwide losses could reach millions of euros.
• French prosecutors opened a cyber-crime investigation into the incident, which affected refrigeration technology used by several major food retail chains.
• Danfoss said the affected units were older models whose security software could not be updated to address an identified vulnerability.
• European Food Commissioner Christophe Hansen condemned the attack and called for greater attention to food security.

France News7 (FN7) October 12, 2026 – A cyber attack targeting supermarket refrigeration systems has disrupted food storage across hundreds of French retail outlets, forcing retailers to remove potentially unsafe products and discard fresh and frozen food. The incident reportedly involved software supplied by Danish engineering company Danfoss, which allows supermarkets to manage refrigeration equipment remotely. Some units were allegedly forced to reach temperatures of 50C for several hours overnight. Major retailers, including Coopérative U, Intermarché, Netto, Carrefour and Monoprix, reported disruptions, while French prosecutors launched a cyber-crime investigation into the incident. The full number of affected stores and the overall financial losses remain uncertain.

What Happened in the Cyber Attack on French Supermarkets?

The cyber attack affected refrigeration equipment in supermarkets across France, disrupting systems designed to maintain the temperatures required for the safe storage of fresh and frozen food.

According to the information reported by the BBC, hackers gained control of software regulating refrigeration units and used it to force some equipment to heat up instead of maintaining the appropriate cooling conditions.

The incident was particularly disruptive because supermarket refrigeration systems operate continuously and are essential to the storage of perishable products. Fresh meat, dairy products, prepared foods, frozen goods and other temperature-sensitive items can become unsafe if they are exposed to unsuitable conditions.

The attack reportedly caused some units to reach temperatures of 50C (120F) for approximately six hours overnight into Monday. This was significantly different from the normal overnight defrosting process used by commercial refrigeration equipment.

Under normal operating conditions, freezers may undergo short defrosting cycles during which temperatures rise temporarily. The reported incident, however, involved equipment being commanded to heat up and remain hot for an extended period.

As a result, supermarket employees arriving at some branches on Monday morning encountered refrigeration units that were no longer operating as intended. The disruption forced retailers to assess their stock, remove affected products and arrange repairs.

The precise number of affected stores remains unconfirmed, and the available figures largely come from individual retailers and media reports.

How Many French Supermarkets Were Affected?

The reported figures indicate that the incident affected several major French supermarket groups, although the scale differed between retailers.

According to figures cited by the AFP news agency, more than 100 Coopérative U supermarkets were targeted. At least 300 stores operated by Intermarché and its Netto discount supermarket brand were also affected.

Carrefour reported that refrigeration units in 80 of its approximately 6,000 stores had been compromised. Monoprix said that around 5% of its more than 400 outlets had experienced problems.

Other retailers, including E.Leclerc, were also named among the affected businesses.

Taken together, the figures supplied by individual supermarket groups suggest that approximately 500 stores may have been affected out of roughly 15,000 supermarkets across France. This remains an estimate rather than a confirmed nationwide total.

The reported numbers also require careful interpretation. A store being affected does not necessarily mean that every refrigeration unit or every product in that location was compromised.

The impact depended on the equipment involved, the duration of the temperature disruption and whether staff could establish that products had remained safe.

Nevertheless, the number of retailers involved highlights the potential consequences of a cyber incident affecting technology used across multiple businesses in the same industry.

Why Did Supermarket Refrigerators Heat Up to 50C?

The attack reportedly exploited software used to manage refrigeration equipment remotely.

According to Danfoss, the Danish engineering company whose technology was involved, the affected refrigeration units were older models. Their security software could not be updated to protect against a risk the company had identified.

Remote management systems allow supermarket operators and technical teams to monitor refrigeration equipment, adjust operating settings and respond to faults without necessarily visiting each unit in person.

These capabilities can help retailers manage large networks of stores more efficiently. However, unauthorised access to the same systems can create operational risks if attackers gain the ability to change equipment settings.

In this incident, the reported manipulation of temperature controls turned technology intended to support refrigeration management into a source of disruption.

The distinction between a normal defrosting cycle and the reported attack is important. Defrosting is a routine process designed to maintain equipment performance. Forcing units to remain hot for hours is not a standard operating requirement and can jeopardise the condition of stored food.

Danfoss’s statement about older models also raises questions about how businesses manage equipment that cannot receive modern security updates.

The available information does not establish precisely how the attackers gained access, who was responsible or whether the incident involved a previously exploited vulnerability. Those questions will require further technical investigation.

Which Retailers Reported Disruption and Food Losses?

The incident affected several of France’s major supermarket operators, with retailers taking different measures depending on the equipment and stock involved.

What Did Coopérative U Say About the Attack?

Coopérative U’s chief executive, Dominique Schelcher, described the incident as an “extremely serious and unprecedented” attack, according to the supplied reporting.

In a post on X, Schelcher said employees were fully mobilised and working in coordination with refrigeration specialists to restore normal operations as quickly as possible.

He also called for an investigation, arguing that targeting equipment essential to the French food supply was unacceptable.

The company’s response underlined the importance of restoring refrigeration while ensuring that food potentially exposed to unsafe conditions did not return to sale without appropriate checks.

How Were Intermarché and Netto Affected?

Intermarché and Netto were among the most widely affected retail brands in the reported incident.

According to Reuters, Intermarché said its refrigeration units had heated to 50C for six hours overnight into Monday. The retailer reportedly discarded all affected food to avoid potential health risks.

In a statement to the BBC, the Mousquetaires Group, which owns Intermarché and Netto, said some fresh and frozen food display units remained out of service on Monday afternoon.

The group said the stores had taken all necessary precautions to remove products from those units. Staff were also working to restock shelves as quickly as possible.

The response illustrates the practical consequences of a refrigeration failure on this scale. Even after the technical problem is addressed, retailers must determine which products can safely be sold, dispose of unsuitable stock and replenish affected sections.

What Was the Impact on Carrefour and Monoprix?

Carrefour reported that refrigerators in 80 of its approximately 6,000 stores had been hacked.

Monoprix said that around 5% of its more than 400 outlets had been affected. The retailer removed food from sale wherever its condition could not be guaranteed.

These measures prioritised consumer safety over the immediate recovery of sales.

Although the reported disruption involved only a proportion of each chain’s total outlets, even a limited number of affected supermarkets can generate substantial losses when the incident involves large quantities of perishable goods.

The inclusion of several separate retail groups also suggests that the problem extended beyond an isolated equipment failure at an individual store.

How Much Financial Damage Has the Cyber Attack Caused?

The total financial impact remains unclear, but early reports indicate that the losses could reach millions of euros.

French broadcaster BFMTV reported losses of €270,000 (£228,000) between two supermarkets in the Alsace region. The figure provides an indication of the potential cost at individual locations, although it does not establish the total damage across France.

The overall losses could include the value of discarded food, the cost of cleaning and inspecting affected equipment, refrigeration repairs, staff time and the expense of replenishing stock.

Retailers may also face temporary reductions in sales if refrigeration sections remain out of service or popular products are unavailable.

However, a reliable nationwide estimate would require verified information from the affected chains. The number of stores involved alone is insufficient to calculate the total financial damage because the volume and value of compromised stock will differ between locations.

The losses also extend beyond the immediate value of food discarded. Supermarkets depend on continuous deliveries and predictable stock turnover, particularly for products with short shelf lives. Disruptions can affect replenishment schedules and require additional coordination with suppliers.

For smaller operators, an unexpected loss of perishable inventory can place pressure on operating budgets. Larger chains may be better positioned to redistribute stock or absorb individual losses, but a coordinated incident affecting numerous locations can still create significant costs.

At this stage, the reported figures should therefore be treated as early indications rather than a final assessment.

Were There Fires at Some Supermarkets?

The supplied reporting states that some locations experienced small fires during the disruption.

The circumstances surrounding these reports have not been fully established. It is therefore unclear whether the fires were directly caused by the cyber attack, resulted from equipment malfunction or were associated with another factor.

A temperature-control incident can create unusual operating conditions for refrigeration equipment, but the reported information does not provide enough technical detail to determine the cause of individual fires.

The reports nevertheless add another operational concern for store managers, who must assess not only food safety but also the condition of equipment and the safety of the surrounding premises.

Any damaged or potentially unsafe equipment requires appropriate inspection before being returned to service.

What Did the French Authorities Say About the Incident?

French prosecutors opened a specific cyber-crime investigation into the attack.

According to the Paris prosecutor’s office, the incident was a “large-scale cyber-attack affecting the refrigerators of several major food retail chains across France”.

The investigation is intended to examine the criminal incident, although the supplied information does not identify any suspects or establish the attackers’ motives.

The technical questions include how unauthorised access was obtained, how refrigeration settings were changed and whether the affected systems shared a common vulnerability or other point of exposure.

Investigators may also need to establish the extent of the incident, including which equipment was compromised and whether additional systems were accessed.

The fact that several retail groups were affected makes it important to distinguish between a shared technology problem and separate incidents involving similar equipment. The involvement of software from the same supplier is relevant, but it does not, by itself, establish the precise method used by the attackers.

No attribution to a particular individual, criminal group or state actor can be made on the information currently available.

The investigation’s findings will be important in determining the technical causes, the scope of the intrusion and whether further security measures are necessary.

Why Has the Attack Raised Concerns About Food Security?

European Food Commissioner Christophe Hansen condemned the incident in a post on X and called for greater attention to food security.

Hansen said: “Food security requires more attention at all levels. Because the weaponisation of food has become a reality.”

His statement placed the incident within a broader discussion about the protection of systems that support food production, distribution and retail.

Supermarkets are an important part of the food supply chain. They depend on refrigeration, transport, warehouse management, stock-control systems and reliable deliveries to keep products available to consumers.

A disruption to one of these functions can affect food availability even when the food itself has not been physically attacked or contaminated.

Refrigeration is particularly important because temperature-sensitive products may become unsuitable for consumption when required storage conditions are not maintained. Once a product’s safety cannot be established, retailers may have to remove it from sale.

The incident also demonstrates how digital systems can affect physical operations. A cyber attack does not necessarily need to steal customer data or interrupt online payments to create serious commercial consequences. Manipulating industrial or building-management equipment can also disrupt everyday services.

However, the available reporting does not establish that the French attack caused a nationwide food shortage or a sustained interruption to the country’s food supply. The documented consequences concern affected refrigeration units, discarded stock and disruption at individual supermarkets.

The broader food-security concern is that essential infrastructure can become vulnerable when operational equipment is connected to software that can be accessed or controlled remotely.

What Steps Must Supermarkets Take to Restore Normal Operations?

Restoring normal service involves more than switching refrigeration equipment back on.

Retailers first need to establish whether the affected units are operating safely and whether the underlying security problem has been contained. Technical specialists may need to inspect the equipment, verify control settings and determine whether software changes or other corrective measures are required.

Food safety assessments are equally important. Products exposed to unsuitable temperatures cannot automatically be considered safe simply because refrigeration has resumed.

Where retailers cannot guarantee a product’s condition, removing it from sale is a precautionary measure. Intermarché’s reported decision to discard all affected food reflects the potential health consequences of selling products whose safety cannot be established.

Supermarkets must also arrange replacement stock, coordinate deliveries and manage the temporary loss of display capacity.

Danfoss’s statement about older models raises an additional challenge: equipment that cannot receive current security updates may require alternative protective measures or eventual replacement.

For operators managing thousands of stores, such decisions can involve substantial planning and expenditure. Businesses need to balance the cost of modernising existing equipment against the operational and security risks of continuing to use systems with limited update options.

The supplied reporting does not specify what long-term measures the affected retailers will adopt or whether Danfoss will recommend a particular replacement programme.

Background: Why Is Refrigeration Technology Critical to Supermarket Operations?

Commercial refrigeration maintains the conditions needed to preserve perishable food throughout the retail process. Supermarkets use refrigerated display cabinets, cold rooms and freezers to store products before they are purchased by consumers.

Modern retail refrigeration systems may include remote monitoring and management tools that allow technical teams to track temperatures, identify faults and adjust settings across multiple locations.

These systems can improve efficiency by reducing the need for manual checks and enabling quicker responses to equipment problems. However, remote access also makes cybersecurity an important part of equipment management.

Older refrigeration units can present particular challenges when their software no longer supports security updates. Businesses may continue using otherwise functional equipment because replacing it is costly or disruptive, even when doing so creates a need for additional safeguards.

The French incident has brought these operational and digital risks into focus. It demonstrates how a compromise involving temperature controls can lead to food losses, store disruption and a criminal investigation.

The wider lesson for retailers is that cybersecurity and food safety are interconnected. Protecting digital access to refrigeration systems is part of maintaining the physical conditions required for safe food storage.

Prediction: How Could the Cyber Attack Affect French Consumers and Supermarket Businesses?

The immediate effects are likely to depend on how quickly affected retailers restore refrigeration, verify equipment security and replace discarded stock.

For consumers, the most visible consequences may be temporary gaps in supermarket shelves, reduced availability of certain chilled or frozen products and changes in product selection at affected locations. The available information does not establish that these disruptions will lead to sustained shortages or widespread price increases.

For supermarket operators, the financial consequences could extend beyond the initial value of discarded food. Equipment inspections, repairs, restocking and potential investment in more secure technology may add to the cost of the incident. The final impact will depend on the number of affected units, the duration of disruption and the measures needed to prevent a recurrence.

The incident could also prompt retailers to reassess older refrigeration equipment and review the security arrangements governing remote access. Businesses using systems that cannot receive software updates may need to consider additional controls, closer monitoring or eventual replacement.

For food suppliers and distributors, temporary changes in supermarket demand could affect delivery schedules and stock planning. The scale of any such effect will depend on how quickly the affected chains resume normal operations.

The French cyber-crime investigation may clarify how the attack occurred and whether the same vulnerabilities could affect other businesses using similar technology. Until those findings are available, the precise method of intrusion and the identity of those responsible remain unconfirmed.