France Supermarket Cyberattack Hits Hundreds of Stores, Spoils Food

PARIS, October 13, 2026: A major cyberattack targeting refrigeration systems at French supermarkets has disrupted store operations and caused significant food losses. The incident, which occurred overnight between October 11 and 12, affected several major retail groups after connected cooling equipment was reportedly manipulated, allowing temperatures in some refrigerators and freezers to rise to as high as 50°C.

The Paris prosecutor’s office confirmed that an investigation had been opened into the large-scale cyberattack. Reported damage includes spoiled food and fires at several stores. France’s government has also asked its National Cybersecurity Agency, known as ANSSI, to investigate the incident.

Which Supermarket Chains Were Affected?

The incident affected outlets associated with Intermarché, Netto and Coopérative U. Reports also identified Carrefour, Monoprix and E.Leclerc among the potentially affected retailers, although the level of confirmation differed between companies and reports.

According to AFP, approximately 150–200 Intermarché stores and nearly 100 Coopérative U outlets were initially reported as affected. Subsequent reporting by Le Monde put the number of affected Intermarché and Netto locations at around 300, with approximately 100 Coopérative U outlets, 80 Carrefour stores, several E.Leclerc locations and around 30 Monoprix stores also affected.

These figures come from different reports and updates, so they should not be treated as a final, independently verified national total. Retailers and investigators may establish a more precise count as the inquiry progresses.

How Did the Attack Affect Refrigeration Systems?

Supermarkets use refrigeration controllers to manage the temperature of display cabinets, freezers and cold-storage rooms. Some systems can be monitored and adjusted remotely, allowing maintenance teams to respond to equipment problems without visiting each location.

In this incident, hackers reportedly interfered with refrigeration controls and triggered prolonged defrosting operations. This allowed temperatures to rise and compromised the storage conditions needed to preserve perishable food.

Reuters reported that refrigeration units at around 150 Intermarché stores reached temperatures of up to 50°C for approximately six hours. Le Monde reported that the defrosting cycle had allegedly been extended, potentially delaying the detection of the problem. The temperature figures relate to reported affected equipment and should not be interpreted as conditions across every targeted stored.

The incident illustrates how a cyberattack on industrial equipment can cause physical damage even when the primary target is not a retailer’s payment system or customer database.

Food Waste and Financial Damage

The immediate consequence was the loss of fresh and frozen products that could no longer be reliably preserved. Intermarket told AFP that affected branches would need to discard their fresh and frozen stock.

Some stores also faced disruption while staff inspected equipment, removed damaged products and worked to restore normal operations. Retailers must additionally consider restocking costs, technical inspections and potential insurance disputes.

The final financial impact remains uncertain.supermarket chief executive Thierry Cotillard told French broadcaster BFM TV that nationwide losses could amount to tens of millions of euros in a single day. Cooperative U chief executive Dominique Schelcher separately estimated that losses could reach tens of thousands of euros at smaller stores and as much as €200,000 at larger hypermarkets. These are preliminary estimates, not a confirmed total for the entire retail sector.

Danfoss Software Under Scrutiny

The investigation has drawn attention to refrigeration-control software supplied by Danish company Danfoss. Reporting by Le Monde linked the incident to vulnerabilities involving older refrigeration-control systems that had reached the end of their supported life and were no longer receiving security updates.

However, identifying a possible software weakness is not the same as conclusively establishing the full method used in the attack. Investigators still need to determine how the attackers gained access, which systems were compromised and whether the same vulnerability explains every reported incident.

The case highlights the importance of updating supported software, replacing obsolete equipment and restricting remote access to industrial control systems.

French Authorities Open Investigation

The Paris prosecutor’s office has opened an investigation to identify the affected businesses and establish the link between the cyberattack and the reported food losses and fires. Prime Minister Sébastien Lecornu has instructed ANSSI to examine the incident, while French authorities are coordinating with European counterparts to assess whether other businesses could also be at risk.

As of October 13, the reports cited here had not established the identity of the attackers or confirmed their motive. No individual or organisation should therefore be held responsible without further evidence.

What Happens Next?

Affected retailers are working to restore refrigeration services, assess damaged stock and resume normal operations. The investigation will focus on how the systems were accessed, the extent of the damage and the measures needed to prevent similar incidents.

The attack is a reminder that cybersecurity extends beyond websites, financial records and customer data. Connected equipment used to preserve food can also become a target, potentially disrupting businesses and creating serious operational risks.

The final scale of the incident and the identities of those responsible remain matters for investigators to establish.