A French supermarket cyberattack disabled refrigeration systems at hundreds of stores this week, pushing fridges and freezers as high as 50°C and forcing retailers to throw out large volumes of spoiled food. Carrefour said 80 of its stores were hit, Les Mousquetaires (owner of Intermarché) reported about 150 affected locations, Monoprix said roughly 5% of its 490 stores were struck, and Cooperative U also confirmed it was targeted. E.Leclerc and Auchan did not respond to requests for comment.
At Intermarché, cooling units stayed overheated for six hours overnight, well past the point where stored food becomes unsafe to sell. The retailer’s chief executive said the attack would cost “tens of millions of euros nationwide in a single day” once spoiled stock across the network is tallied.
How the French supermarket cyberattack worked
Supermarket cold aisles are typically run by networked control panels that let maintenance contractors adjust temperatures remotely over the internet — a convenience that also creates an attack surface. A source close to Prime Minister Sébastien Lecornu said France’s national cybersecurity agency, ANSSI, traced the intrusion to a vulnerability in refrigeration control software made by the Danish manufacturer Danfoss.
Danfoss said the affected units were running outdated firmware and that it had repeatedly urged customers to update their systems. Security researchers at Claroty’s Team82 had already published findings in August about vulnerabilities in a specific Danfoss controller model, the AK-SM 800A, which later firmware updates addressed — though the company has not confirmed that this was the exact model exploited in this week’s attack.
A wider European footprint than first reported
France was the hardest-hit country, but security researcher Felix Aime of the firm Sekoia said similar disruptions also hit retailers in Spain, Portugal, Poland, Germany and Belgium. No group has claimed responsibility for the campaign, and investigators have not yet said whether the European incidents share a single origin or represent copycat activity exploiting the same known flaw.
The Paris prosecutor’s office has opened an investigation and described the campaign as a large-scale attack. Lecornu ordered ANSSI to lead the technical response, and French officials are coordinating with counterparts elsewhere in Europe while assessing whether other companies using similar industrial control systems are exposed.
Food safety and the clean-up
Affected stores discarded spoiled stock rather than risk selling food that had sat above safe temperatures for hours, a decision retailers described as necessary to eliminate health risk rather than optional caution. The French retail federation FCD publicly called on Danfoss for full transparency about the scope of the vulnerability, and some of the hardest-hit stores had reopened for business by midweek once technicians restored manual control over the cooling systems.
The incident echoes a smaller episode in late August, when roughly a dozen US military commissaries reported similar refrigeration failures and food losses, though officials have not formally linked the two events. Separately, Dutch retailer Ahold Delhaize reported what it called a “security issue” on its own network around the same time, while stating there was no reason to connect it to the French attacks.
Where this investigation goes from here
With no group claiming responsibility and the entry point only partly confirmed, French investigators face a familiar challenge in industrial-control cyberattacks: proving exactly how attackers got in versus simply patching the hole they used. Retailers across the affected countries are now under pressure to audit which of their own refrigeration and building-management systems run outdated firmware, since the underlying weakness — internet-connected equipment nobody got around to updating — is common across the sector, not unique to Danfoss customers in France.
Expect regulators in Brussels and national cybersecurity agencies to use the episode to push for mandatory patching timelines on industrial control systems, a debate that has simmered in EU policy circles for years without resulting in binding rules for retail infrastructure specifically.
Common questions about the attack
How many stores were affected?
At least 80 Carrefour stores, about 150 Intermarché locations, roughly 5% of Monoprix’s 490 stores, and an unconfirmed number of Cooperative U stores — likely several hundred in total across France.
What caused the fridges to overheat?
Investigators say attackers exploited a vulnerability in Danfoss refrigeration control software running outdated firmware, letting them remotely push temperatures as high as 50°C.
Did other countries get hit?
Yes. A security researcher reported similar disruptions in Spain, Portugal, Poland, Germany and Belgium, though France was hit hardest.
Has anyone claimed responsibility?
No group had claimed the attack at the time of reporting.
How much will this cost retailers?
Intermarché’s CEO estimated losses of tens of millions of euros nationwide in a single day; no industry-wide total has been published.
Is the food safe once stores reopen?
Retailers discarded stock that sat above safe temperatures and reopened only after restoring manual control of cooling systems, according to the French retail federation.
Sources
- ABC News Australia — Hackers raise fridge temperatures at hundreds of French supermarkets to spoil food. abc.net.au
- BleepingComputer — Cyberattack shuts down refrigerators at French supermarkets. bleepingcomputer.com
For more on recent breaches, see our coverage of the Denmark CPR register breach and the Berlin ransomware attack.
