Cyberattack Hits Hundreds of French Supermarkets as Hackers Overheat Refrigerators

Hundreds of supermarkets across France have been hit by a cyberattack that remotely disrupted refrigeration systems, sending temperatures soaring and causing widespread food losses, in an incident that has exposed the risks of connecting essential retail equipment to digital networks.

The attack, reported overnight between Sunday and Monday, affected major supermarket groups including Intermarché, Coopérative U and Carrefour. Retailers and media reports also identified Monoprix and E.Leclerc among the affected businesses, although the precise scale of the disruption varies across reports. France’s Paris prosecutor’s office confirmed that an investigation had been opened into the large-scale attack, which caused food losses and fires at some locations.

Rather than targeting payment terminals or stealing customer information, the attackers reportedly manipulated the systems controlling supermarket refrigerators and freezers. By triggering forced defrost cycles, they caused temperatures to rise sharply, compromising food that depended on continuous refrigeration.

Reuters reported that temperatures in affected units reached as high as 50°C. Intermarché’s parent company, Les Mousquetaires, said refrigeration systems in around 150 stores had been affected for approximately six hours. The company said the food was discarded to avoid potential health risks.

The disruption extended beyond Intermarché. Coopérative U reported that nearly 100 of its outlets were affected, while Carrefour said 80 supermarkets had been hit. Monoprix also reported that approximately five per cent of its French stores were affected. Reports concerning E.Leclerc indicated that some of its stores were targeted, although the full extent of the impact was not immediately clear.

The financial consequences could be substantial. Intermarché chief executive Thierry Cotillard estimated that the incident could result in losses running into tens of millions of euros nationwide in a single day. That figure is an industry-wide estimate, not a confirmed final accounting of damages. Retailers also face the costs of replacing discarded stock, inspecting equipment and restoring affected systems.

French authorities are investigating how the attackers gained access to the equipment. Prime Minister Sébastien Lecornu has instructed the country’s National Cybersecurity Agency, ANSSI, to examine the incident, while France is coordinating with European counterparts over concerns that other businesses or countries could also be affected.

Attention has turned to refrigeration management systems supplied by Danish engineering company Danfoss. The company acknowledged incidents involving refrigeration controls in France and said many of the affected units were older systems or equipment running outdated firmware. It has urged customers to keep supported systems updated and migrate legacy equipment to newer solutions where necessary.

That information points to a possible security weakness, but it does not by itself establish the precise method used by the attackers or confirm that every affected store was compromised through the same vulnerability. Investigators will need to establish how access was obtained, which systems were involved and whether the incident was coordinated across the different retail chains.

The attack also highlights a growing problem in cybersecurity: equipment traditionally treated as part of a building’s physical infrastructure is increasingly connected to remote monitoring and maintenance networks. Supermarket refrigeration controls can allow technicians to manage cooling systems without being physically present, improving efficiency but creating another potential route for unauthorized access if devices or networks are not adequately protected.

The risks extend beyond financial losses. Refrigeration is essential to food safety, and retailers cannot simply return temperature-compromised meat, dairy products or frozen goods to display cabinets without establishing that they remain safe. Discarding affected stock is costly, but selling food that has not been stored safely could expose consumers to illness.

The incident has prompted concern beyond France. Cybersecurity analysts have warned that similar equipment or vulnerabilities may exist elsewhere in Europe, including Spain, Portugal, Poland, Germany and Belgium. Authorities are assessing the wider risk, but reports of potential exposure should not be treated as confirmation that every country named has suffered the same attack.

The case also follows reports of refrigeration-related cyber disruptions at US military commissaries in August, although investigators have not established that the French incident and the US cases were connected. The similarities underline why cybersecurity experts increasingly stress the need to protect operational technology, the systems that control physical equipment, not just computers and databases.

For retailers, the immediate priorities are restoring safe operations, identifying the compromised systems and preventing further access. Longer term, businesses may need to review remote-access permissions, isolate critical equipment from exposed networks, install security updates and develop procedures for keeping essential services running during a cyber incident.

The wider significance is that cyberattacks no longer need to steal data or shut down an entire company to cause serious damage. By manipulating a system designed to keep food cold, attackers can disrupt supply chains, destroy valuable stock and create potential public-health risks. As more essential services rely on connected technology, protecting the digital systems behind everyday necessities is becoming as important as securing the physical infrastructure itself.