French supermarkets face cyberattack as hackers overheat refrigeration systems

An unprecedented cyberattack struck hundreds of supermarkets across France and other European nations over the weekend, remotely manipulating refrigeration systems to cause extreme overheating, food spoilage, and store fires. The assault unfolded between the night of Sunday, 11 October 2026, and Monday, 12 October 2026, targeting central building management and operational technology used to preserve perishable goods. The incident has drawn urgent intervention from state prosecutors, national security agencies, and European Union officials, exposing vulnerabilities in interconnected food supply infrastructure.

According to Siliconrepublic reporting, hackers infiltrated cooling systems and forced continuous defrost cycles lasting roughly six hours. Rather than maintaining chilled storage, the compromised units generated severe heat, with temperatures peaking between 50°C (122°F) and 80°C (176°F) in enclosed storage spaces and near built-in heating elements. The sudden thermal spike overwhelmed heat resistance limits, causing equipment to melt and sparking localized fires in several stores, as noted by NBC News.

Media additions

Hundreds of French supermarkets hit by cyberattack

The scale of the disruption varied across retail groups and reporting channels. Les Mousquetaires reported that roughly 150 to 200 Intermarché and Netto stores were hit, though Time and Securityweek noted broader estimates from French media reaching up to 300 locations for that brand alone. Coopérative U confirmed that approximately 80 to 100 of its outlets were impacted out of its wider group total. Carrefour reported disruptions at 80 supermarkets, while Monoprix stated that about 5 percent of its roughly 490 stores experienced failures. E. Leclerc and Auchan also confirmed or were reported to have affected sites.

The financial toll on retailers is substantial. Intermarché CEO Thierry Cotillard told Saccoreview that nationwide losses could reach tens of millions of euros in a single day. Individual stores faced immediate write-offs ranging from tens of thousands of euros to over 200,000 euros per hypermarket, as staff discarded entire dumpsters of spoiled meat, fish, dairy, and melted ice cream. Retailers emphasized that once perishable goods spend prolonged periods above safe temperature thresholds, restoring power cannot make them saleable again.

Investigators probing the incident have focused on centralised management interfaces supplied by Danish engineering firm Danfoss, specifically the AK-SC and AK-SM refrigeration controller series. A spokesperson for Danfoss told Bloomberg that a majority of the affected systems are old and no longer receive updates. Danfoss stated that the impacted units were running outdated firmware and reiterated longstanding warnings urging customers to keep supported systems updated and migrate legacy equipment to current-generation solutions.

Independent cybersecurity researchers previously highlighted vulnerabilities in the Danfoss AK-SM 800A platform that could permit authentication bypasses and arbitrary code execution. However, official sources have not publicly confirmed whether those specific disclosure flaws were directly exploited in the French supermarket incident. French authorities noted that exposing building management interfaces directly to the internet violates best practices, and security scans identified numerous exposed controllers globally, with France holding a significant concentration of visible devices.

The cyberattack prompted swift political and regulatory reactions across Europe. The Paris prosecutor’s office opened a formal criminal investigation to identify victims, establish liability, and link the cyber intrusions directly to property damage and food loss. Prime Minister Sébastien Lecornu instructed France’s National Cybersecurity Agency (ANSSI) to lead national investigations while coordinating closely with European counterparts. European Union Agriculture and Food Commissioner Christophe Hansen condemned the incident on social media, warning that the weaponization of food supply chains has become a reality.

Security analysts speaking to international outlets emphasized that the attack underscores wider operational risks facing connected infrastructure. Unlike ransomware incidents designed to encrypt data for financial extortion, this assault targeted physical operational technology to disrupt society and destroy food stocks. Analysts suggested that supply chain vulnerabilities could similarly impact other sectors if industrial control networks remain flatly connected to corporate IT environments without rigorous segmentation or multi-factor authentication.

As retail associations call for full transparency from equipment manufacturers, affected supermarkets continue working with refrigeration technicians to verify hardware integrity, replace melted components, and restore normal supply operations. Authorities and cybersecurity regulators are expected to release further technical findings as cross-border investigations progress across Europe.