How did hackers raise supermarket fridge temperatures to 50°C?
What does the French supermarket cyberattack mean for European food security?
How can retailers protect connected refrigeration systems from cyberattacks?
Hundreds of stores hit as attackers manipulate refrigeration controls, destroy fresh and frozen food, and expose a dangerous vulnerability in the systems protecting Europe’s food supply.
PARIS, October 13, 2026
A supermarket’s most essential safety system became its greatest vulnerability overnight. In a major cyberattack across France, hackers reportedly manipulated connected refrigeration systems, forcing temperatures in affected units to soar to 50°C (122°F), triggering fires at some locations and leaving retailers facing vast quantities of spoiled food.
The attack, which struck during the night of October 11–12, affected hundreds of supermarket outlets and prompted a criminal investigation in Paris. France’s government has also directed the National Cybersecurity Agency, ANSSI, to investigate as authorities assess whether the threat extends beyond the country.
Many international outlets have reported the incident, describing an attack that transformed ordinary refrigeration equipment into a potential threat to food safety and business continuity.
The financial damage could reach tens of millions of euros, according to estimates reported by ABC News and Reuters. The final toll, however, remains uncertain.
The Attack: When Supermarket Freezers Turned Against Their Owners
The reported method was deceptively simple and potentially devastating.
Instead of concentrating on payment terminals or customer databases, the attackers targeted controls governing commercial refrigeration. According to reports by Reuters and specialist cybersecurity outlets, they appear to have remotely triggered defrosting functions, disrupting the systems designed to keep perishable goods at safe temperatures.
At affected Intermarché locations, refrigeration units reportedly reached 50°C in approximately six hours. Staff were forced to discard fresh and frozen products to eliminate potential health risks.
The consequences extended beyond spoiled stock. French prosecutors confirmed that reported damage included food losses and fires, while retailers mobilized technical teams to restore normal operations.
The incident demonstrates how a cyberattack can move from computer networks into the physical world, with consequences for food safety, property and the daily operations of essential businesses.
Which Supermarket Chains Were Hit?
The reported impact spans several major French grocery retailers.
- Intermarché and Netto: Their parent group, Les Mousquetaires, reported that around 150 Intermarché stores had been affected. Other reports put the wider number of Intermarché and Netto outlets targeted at approximately 300.
- Coopérative U: The retailer confirmed that its refrigeration systems had been targeted, with reports indicating that nearly 100 or more outlets were affected.
- Carrefour: The company reported that 80 supermarkets were affected.
- Monoprix: The retailer said approximately 5% of its French stores were affected.
- E.Leclerc: The chain was also reported to have been targeted, although the precise extent of the disruption was not immediately established in all reports.
The figures vary because retailers have reported different categories of affected stores and the investigation remains ongoing. They should not be added together as a definitive nationwide total.
The Suspected Weak Point: Connected Refrigeration Systems
Investigators are examining a potential vulnerability involving refrigeration-management software supplied by Danish engineering company Danfoss.
Danfoss said it was aware of incidents affecting refrigeration-management systems in France and indicated that the affected units were running outdated firmware. The company has urged customers to keep supported systems updated and migrate away from legacy equipment.
Cybersecurity researchers had previously documented vulnerabilities affecting Danfoss refrigeration controllers. That background raises questions about patch management, remote access and the security of operational technology used in food retail.
However, identifying a potential vulnerability is not the same as establishing precisely how attackers exploited it. Investigators must determine the entry point, the extent of unauthorized access and whether the same weakness was used across all affected stores.
The episode highlights a growing security challenge: equipment once treated as ordinary industrial machinery is increasingly connected to remote-management systems, creating additional pathways that attackers may attempt to exploit.
Could the Attack Spread Beyond France?
French authorities are coordinating with European counterparts as they investigate whether other countries or businesses may be at risk.
Cyber threat intelligence analyst Félix Aimé of Sekoia reportedly told Reuters that Spain, Portugal, Poland, Germany and Belgium may also have been affected. Separately, Dutch retailer Ahold Delhaize reported a cybersecurity issue and took certain systems offline as a precaution.
A direct connection between the Dutch incident and the French supermarket attack has not been established.
The distinction matters. Similar timing or technical symptoms can signal a shared vulnerability, but they do not automatically prove a single coordinated operation.
For European retailers, the immediate priority is to establish whether refrigeration controllers are exposed, verify system integrity and ensure that any affected equipment can be safely returned to service.
A Warning for Europe’s Food Supply Chain
The attack has exposed a vulnerability that extends far beyond supermarket aisles.
Modern retail food depends on a continuous cold chain: refrigerated transport, storage facilities, supermarket display cabinets and distribution centers must maintain appropriate temperatures to protect perishable products. Disrupting even one part of that chain can lead to significant waste and costly operational shutdowns.
The risks are particularly serious when digital controls are connected to equipment responsible for physical safety. A compromised system can damage stock without stealing a single customer record or encrypting a single file.
Retailers and infrastructure operators therefore face a broader cybersecurity challenge: protecting not only information technology, but also the industrial systems that keep essential services running.
That means reviewing remote access, replacing unsupported firmware, segmenting operational networks, monitoring abnormal temperature changes and establishing procedures for switching to safe manual controls when necessary.
The Investigation: Who Was Behind the Attack?
As of October 13, authorities had not publicly established the identity of the attackers or confirmed their motive.
The Paris prosecutor’s office has opened an investigation into the large-scale attack, including the reported food losses and fires. ANSSI is also examining the incident and possible risks to other French businesses.
There is no verified basis at this stage to attribute the operation to a particular country, criminal group or political actor. Nor is it yet clear whether the primary objective was financial, destructive or intended to expose weaknesses in connected industrial systems.
Those answers will depend on forensic evidence, technical analysis and the investigation’s findings.
The Bottom Line: Cybersecurity Is Now a Food-Security Issue
The French supermarket attack offers a stark lesson for businesses across Europe and beyond: the systems that keep essential goods safe can themselves become targets.
A remote command can do more than disrupt a screen or interrupt a transaction. When it reaches industrial controls, it can spoil food, damage equipment, threaten safety and generate losses across an entire supply chain.
For France, the immediate task is to restore affected stores, establish the scale of the damage and identify how the attackers gained access. For retailers elsewhere, the warning is already clear: connected refrigeration equipment must be protected with the same seriousness as payment systems, customer data and other critical infrastructure.
