Cyberattack heats French supermarket refrigeration systems, causing fires and food loss
A coordinated cyberattack raised temperatures in refrigeration units at hundreds of French supermarkets, leading to fires, spoiled food and estimated losses of tens of millions of euros.
Hackers manipulated internet-connected refrigeration control panels at hundreds of supermarkets across France, raising temperatures to as high as 122°F (50°C) overnight on Monday. The Paris prosecutor’s office described the incident as a large-scale attack affecting major food retailers and resulting in fires and extensive food spoilage.
Prime Minister Sébastien Lecornu ordered the National Cybersecurity Agency (ANSSI) to investigate, and French authorities are coordinating with European counterparts to assess potential risks to other companies. A senior cyber-threat analyst said that retailers in Spain, Portugal, Poland, Germany and Belgium may also have been impacted.
Carrefour reported that 80 of its stores were affected, while Monoprix said about 5% of its locations experienced the breach. Les Mousquetaires, the owner of Intermarché, confirmed that refrigeration units in roughly 150 stores were heated for six hours, and all compromised food was discarded. A spokesperson noted that the discarded items were removed to eliminate health hazards.
Dominique Schelcher, CEO of the cooperative retailer U, said 80 of the chain’s 2,000 stores were impacted, estimating losses ranging from several tens of thousands of euros for smaller outlets to up to €200,000 for larger hypermarkets. Intermarché CEO Thierry Cotillard told BFM TV that the attack could result in losses of "tens of millions of euros nationwide in a single day."
Eurocommerce director general Christel Delberghe highlighted the incident as a reminder of the need for resilience throughout the supply chain. The compromised refrigeration systems rely on control panels that can be accessed remotely for maintenance, and ANSSI identified a vulnerability in software supplied by Danish firm Danfoss. Danfoss said the affected units were running outdated firmware and that it had previously advised customers to update to supported versions.
Research published by Claroty’s Team82 in August detailed vulnerabilities in the Danfoss controller that could allow attackers to bypass authentication and execute code. French retail association Fédération du Commerce et de la Distribution called for full transparency from Danfoss, noting that some stores have already resumed normal operations.
Dutch retailer Ahold Delhaize, which operates Albert Heijn and several U.S. chains, reported a separate security issue on its network and temporarily took systems offline. The company said there was no evidence linking its incident to the French attacks. Its online platforms displayed notices of temporary downtime, but physical stores remained open.