A coordinated cyberattack on internet-connected refrigeration equipment struck hundreds of supermarkets across France overnight into Monday, forcing cooling units into high-heat defrost modes that spoiled vast amounts of food and triggered isolated fires.
Major French grocers including Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc confirmed that their stores were targeted. The intrusions remotely altered cooling settings, pushing temperatures inside display cases and freezers as high as 50 degrees Celsius (122 degrees Fahrenheit) for up to six hours, according to retailer statements and French media reports.
The Paris prosecutor’s office announced a specialized cybercrime investigation into what it described as a large-scale breach targeting connected refrigerators across multiple national supermarket chains. French Prime Minister Sébastien Lecornu instructed the National Cybersecurity Agency, known as ANSSI, to lead a technical probe into the disruptions, an official in his office told Reuters.
Vulnerabilities in connected refrigeration
Investigators linked the intrusion to industrial control software manufactured by Danish engineering company Danfoss. Supermarkets frequently use internet-linked control panels to let external contractors monitor cold aisles, review temperatures, schedule defrosting and adjust system settings remotely.
Danfoss acknowledged that a limited number of refrigeration management controllers in France experienced incidents. In comments to industry publication Cooling Post, the manufacturer stated that the affected units, including its AK-SM800 and AK-SC355 controllers, were running outdated firmware that could no longer receive security defenses against known risks. The company noted that it has long advised clients to replace legacy equipment and keep supported hardware updated.
The incident followed research published Aug. 9 by cybersecurity company Claroty, which documented vulnerabilities in Danfoss controllers that could let intruders bypass access controls and run unauthorized code on vulnerable hardware.
Tens of millions in spoiled stock
The operational fallout forced grocery chains to clear out entire aisles of fresh and frozen merchandise to prevent consumer illness. Mousquetaires Group, which owns Intermarché and Netto, said approximately 150 to 180 of its shops suffered direct temperature surges, while about 100 more stores were taken offline preventatively to shield them from intrusion. Intermarché Chief Executive Thierry Cotillard told broadcaster BFM TV that nationwide losses from the single-day event would reach tens of millions of euros.
Coopérative U reported disruptions at more than 100 outlets. Chief Executive Dominique Schelcher described the sabotage on X as “extremely serious and unprecedented,” saying that interference with critical food distribution infrastructure was intolerable.
Carrefour reported that 80 of its roughly 6,000 stores faced cooling disruptions, while Monoprix said about 5 percent of its approximately 490 locations were impacted. Industry data compiled by the BBC suggested that around 400 supermarkets across France were affected out of roughly 15,000 nationwide.
International concerns and supply chain risks
French authorities are coordinating with European partners to determine the broader geographic scope of the attack. Félix Aimé, a senior cyberthreat intelligence analyst at the security firm Sekoia, told Reuters that similar incidents had appeared in Belgium, Germany, Poland, Portugal and Spain.
The European Union’s commissioner for food, Christophe Hansen, condemned the sabotage on X, warning that the deliberate disruption showed how food systems are increasingly vulnerable to digital weaponization.
Separately on Monday, Dutch grocery giant Ahold Delhaize reported an unrelated cybersecurity problem that forced systems offline and halted delivery operations for its Albert Heijn chain, while several of its U.S. supermarket websites experienced temporary outages. The company stated that it saw no evidence connecting its network problems to the refrigeration breaches in France.
Investigators have not yet publicly identified who orchestrated the attack or what motivations drove the sabotage. French retail groups said many affected locations have already restored normal operations, though technicians continue working to insulate legacy control hardware from further network intrusions.
