Hackers hit 700 French supermarkets, spoiling food and hijacking refrigeration systems as cyberattacks spread to more equipment

Hackers targeted refrigeration systems at approximately 700 supermarkets across France, forcing freezers and refrigerators to heat up, destroying food and triggering fires in one of the most disruptive cyberattacks to hit the country’s retail industry. The attack, which began overnight on October 11, exposed how vulnerable everyday commercial equipment can become when connected to the internet.

The hackers didn’t need to break into payment networks or steal customer information. Instead, they took control of the systems that keep food cold, manipulating temperature settings and defrost cycles until refrigerators stopped doing their jobs.

French officials put the number of supermarkets targeted at roughly 700, according to the Associated Press. The affected retailers included Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc. The number of stores suffering confirmed damage remains lower than the total targeted.

“Cyberattacks have disrupted European supermarket chains, causing refrigeration systems to overheat at hundreds of stores in France and forcing a major grocer to shut down websites serving customers in Europe and the United States. French Finance Minister Roland Lescure told Parliament on Tuesday that about 700 of the country’s 10,000 supermarkets were affected,” the Associated Press reported.

In some locations, refrigeration temperatures climbed to 50°C (122°F), leaving meat, frozen products and other perishable goods unsafe to sell. Store workers spent Monday and Tuesday removing spoiled inventory, cleaning refrigeration units and working with technicians to restore normal operations.

The damage went beyond spoiled groceries. The Paris prosecutor’s office confirmed reports of fires linked to the attack and opened an investigation into what French authorities described as a large-scale cybercrime.

How hackers turned supermarket refrigerators into a liability

The attack targeted refrigeration management systems, the electronic controllers supermarkets use to regulate cooling equipment, monitor temperatures and manage automatic defrost cycles.

These systems are essential to modern food retail. A single supermarket can operate dozens of refrigerated display cases, freezers and cold-storage rooms, many connected to centralized controllers that technicians can access remotely.

That convenience became a weakness.

According to Reuters, attackers manipulated refrigeration settings, causing temperatures to rise far beyond safe food-storage levels.

Rather than simply shutting equipment down, the hackers reportedly altered temperature controls and defrost functions. In some stores, refrigeration systems remained in abnormal operating conditions for hours before staff discovered the problem.

A major focus of the investigation is equipment supplied by Danish industrial technology company Danfoss.

The company said affected systems included devices running outdated firmware and older models that had reached the end of their supported life. Some no longer receive software or security updates.

Danfoss said it had previously advised customers to update supported equipment and replace legacy systems with newer alternatives.

The incident highlights a problem that extends far beyond supermarkets: industrial equipment can remain in service for decades, long after its software stops receiving security support.

Cyberattacks spread to refrigeration equipment from other manufacturers

The threat did not end with the first wave of attacks.

On Tuesday, October 13, French newspaper Le Monde reported that attackers had begun targeting refrigeration systems supplied by Dixell, a separate equipment manufacturer.

At a supermarket near Bordeaux, technicians discovered that hackers had altered temperature and defrost settings overnight.

One refrigeration specialist told Le Monde that attackers changed a frozen-food temperature setting from minus 22°C to 150°C. That figure represented the maliciously configured setting, not the actual temperature reached inside the freezer.

Technicians intervened before the store lost food.

A separate E.Leclerc supermarket in southern France was less fortunate. The store reported discarding refrigerated goods after the attack compromised its cold-storage conditions.

The expanding attacks prompted France’s national cybersecurity response team, CERT-FR, to update its security warning on October 13.

The official advisory, CERTFR-2026-ALE-012, now identifies compromised refrigeration controllers across four equipment families: Danfoss AK-SM, Danfoss AK-SC, Copeland xweb and Dixell xweb.

French cybersecurity officials warned that further attacks were probably still underway.

The agency urged operators to remove exposed refrigeration controllers from the public internet, restore compromised equipment, update firmware and restrict remote access through protected networks.

The precise method used to compromise every affected system has not been established.

Investigators search for attackers as supermarkets count their losses

French investigators have yet to publicly identify the hackers or establish their motive.

In an October 13 report, Reuters said no group had claimed responsibility, and investigators had found no ransom demand. That makes the incident unusual compared with ransomware attacks, in which criminals typically demand payment to restore systems or prevent the release of stolen information.

The financial consequences could be substantial.

Supermarkets have reported losing large quantities of meat, frozen food and other temperature-sensitive products. Some locations faced costly inventory disposal, equipment inspections and interruptions to normal operations.

The national damage total has not been independently established, though losses could run into millions of euros.

Coopérative U CEO Dominique Schelcher described the incident as unprecedented, raising concerns about attacks against infrastructure that consumers depend on every day.

France’s cybersecurity agency ANSSI is investigating, and authorities are examining whether other businesses or countries could face similar attacks.

A warning for businesses far beyond supermarkets

The most troubling part of the attack is how little the hackers needed to disrupt physical operations.

Refrigeration controllers are not typically treated with the same security attention as banking systems, customer databases or corporate networks. Yet controlling a refrigerator’s operating temperature can be enough to destroy inventory, interrupt business and create safety hazards.

Reuters reported that thousands of Danfoss management interfaces remained visible on the public internet after the attacks, highlighting the continuing exposure of commercial refrigeration systems.

The implications extend to cold-storage warehouses, pharmaceutical distribution, food processing, and other industries that depend on connected equipment to maintain safe operating conditions.

For retailers, the immediate priority is restoring refrigeration and protecting remaining inventory. For cybersecurity teams, the incident raises a larger question: how many business-critical machines remain accessible through outdated software and poorly secured remote connections?

The French supermarket attacks show that a cyberattack doesn’t have to steal a single record to cause serious damage. Sometimes, changing a temperature setting is enough.