French Supermarket Cyberattack Heats Fridges to 50°C, Spoiling Food and Triggering Fires
A major cyberattack targeting connected refrigeration systems has disrupted supermarket operations across France, raising temperatures in some refrigerators and freezers to as high as 50°C. The incident caused food losses and fires at several hundred stores, highlighting how cybercriminals can damage physical infrastructure by exploiting technology that businesses rely on every day.
The attack affected major retailers, including Carrefour, Intermarché and Coopérative U. French authorities have launched an investigation, while the country’s National Cybersecurity Agency is examining the incident and possible risks to other businesses. A potential software vulnerability involving refrigeration-management systems supplied by Danish company Danfoss has also come under scrutiny. Danfoss
The incident is more than a supermarket disruption. It demonstrates how cybersecurity risks can translate directly into wasted inventory, operational interruptions, safety hazards and financial losses—even when attackers do not appear to target traditional IT systems such as payment platforms or customer databases.
What Happened in the French Supermarket Cyberattack?
The attack occurred overnight, when connected refrigeration equipment at supermarkets was manipulated to raise temperatures. According to reporting published on October 12, 2026, some units reached approximately 50°C and remained affected for several hours.
Intermarché’s parent group, Les Mousquetaires, said around 150 stores had been hit. The company discarded affected food to avoid potential health risks. Carrefour reported that 80 of its supermarkets were affected, although the vast majority of its approximately 6,000 stores were not hit. Coopérative U also reported an impact.
The Paris prosecutor’s office described the incident as a large-scale attack affecting connected refrigerators at several major food retailers. Reported damage included spoiled food and fires. Prime Minister Sébastien Lecornu instructed France’s National Cybersecurity Agency, known as ANSSI, to investigate.
The precise total financial damage, the identity of the attackers and the full extent of the incident remained unclear in the initial reporting. Authorities were also coordinating with European counterparts to assess whether the threat extended beyond France.
Intermarché, Carrefour and other retailers now face the immediate task of assessing affected equipment, disposing of unsafe products, restoring refrigeration and preventing further disruption.
How Hackers Could Control Supermarket Refrigerators Remotely
Modern supermarkets increasingly use connected control panels to manage refrigeration across entire stores. These systems regulate temperatures, monitor equipment performance and allow maintenance teams or service providers to diagnose problems remotely.
That connectivity can make operations more efficient. It can also create an entry point for attackers if software is outdated, access controls are weak or internet-connected equipment is insufficiently protected.
In this incident, authorities identified a vulnerability involving software supplied by Danfoss. The company said affected refrigeration-management systems were running outdated firmware, while cybersecurity research had previously documented vulnerabilities in certain Danfoss refrigeration controllers.
However, investigators still need to establish precisely how the attackers gained access and whether a previously identified vulnerability was directly exploited in this attack. The existence of a software flaw does not, by itself, prove the exact method used by the attackers.
The reported disruption involved refrigerators being forced into defrosting or otherwise losing their ability to maintain safe temperatures. When chilled and frozen food warms for an extended period, it can become unsafe for consumption even if it looks normal.
The episode illustrates a key cybersecurity problem: systems designed to control physical equipment can be as important to protect as computers containing confidential information.
Financial Impact: Spoiled Inventory, Store Disruption and Higher Costs
For supermarket operators, the immediate financial damage comes from inventory that must be discarded, repairs, equipment inspections and operational disruption.
Intermarché said it disposed of affected food to eliminate health risks. Its chief executive estimated that the attack could generate losses of tens of millions of euros nationwide in a single day. That was an early estimate, not a final audited figure covering all affected retailers.
The financial impact can extend beyond the value of discarded products.
Inventory losses: Fresh produce, dairy products, meat and frozen food may need to be destroyed if their safety cannot be established.
Operational costs: Stores must inspect equipment, arrange repairs and verify that refrigeration systems are safe to use again.
Lost sales: Closed or unavailable refrigerated sections can prevent customers from purchasing essential items.
Supply-chain disruption: Retailers may need emergency deliveries and replacement stock, putting pressure on suppliers and distribution networks.
Reputational damage: Customers expect supermarkets to maintain food safety. Poor communication or repeated outages could weaken consumer confidence.
For retailers operating on relatively thin margins, even a short interruption across multiple stores can be expensive. The cost becomes more severe when several locations are affected simultaneously, because businesses have fewer opportunities to shift stock or maintenance resources between unaffected and affected branches.
The final financial consequences will depend on the number of stores affected, how much inventory was lost, insurance coverage and the time required to restore normal operations.
Why This Matters for Cybersecurity and the Retail Industry
The attack exposes a growing weakness in the digital transformation of physical businesses.
Supermarkets, warehouses, factories and distribution centres increasingly rely on connected sensors, automated controls and remote maintenance. These technologies can reduce operating costs and improve efficiency, but they also expand the number of systems that need security monitoring.
This category of technology is often described as operational technology, or OT. It includes the equipment and software that monitor or control physical processes rather than simply handling data.
A compromised office computer might disrupt email or internal files. A compromised refrigeration controller can damage goods, interrupt food distribution and potentially create physical safety hazards.
That difference changes how companies should approach cybersecurity. Traditional IT protection alone may not be enough. Businesses also need to understand which connected devices can affect physical operations, how those devices are accessed and what happens if their controls are manipulated.
The attack also raises questions about responsibility across the technology supply chain. Equipment manufacturers develop and maintain the software, service providers may manage systems remotely, and retailers operate the stores. Effective protection requires coordination between all three.
Danfoss and the Risk of Outdated Software
Danfoss has said the affected systems were running outdated firmware and reiterated its advice that customers keep supported systems updated and move away from legacy equipment where necessary.
Firmware is the software embedded in a device that helps it operate. When vulnerabilities are discovered, manufacturers may release updates to correct them. If businesses delay installing those updates—or continue using equipment that no longer receives security support—known weaknesses can remain exposed.
But updating industrial equipment is not always as straightforward as updating a personal computer. Retailers must consider whether an update could interrupt refrigeration, whether replacement equipment is available and how to test changes without disrupting stores.
That makes a planned upgrade programme essential. Companies need an accurate inventory of their connected devices, clear schedules for security updates, restricted remote access and contingency procedures for equipment failures.
The incident does not automatically establish the extent of Danfoss's legal or financial liability. That will depend on the investigation, the systems involved, contractual responsibilities and the evidence showing how the attack occurred.
For businesses using similar equipment, the immediate priority is to determine whether their own systems are exposed and follow applicable manufacturer and cybersecurity guidance.
Could the Attack Spread Beyond France?
French authorities said they were coordinating with European counterparts because other countries could also be affected. A cybersecurity analyst cited in reporting identified possible impacts in Spain, Portugal, Poland, Germany and Belgium.
Separately, Dutch supermarket operator Ahold Delhaize reported a cybersecurity issue and took some systems offline as a precaution. Its online grocery services experienced disruption, while physical stores remained open. The company said there was no reason to assume its incident was connected to the French supermarket attack.
That distinction matters. Similar timing or overlapping business sectors does not prove that incidents share the same attackers, vulnerability or campaign.
The investigation will need to establish whether the French attack exploited a common weakness in refrigeration-management systems, whether other retailers use vulnerable configurations and whether any related incidents have the same technical origin.
For multinational retailers, this uncertainty strengthens the case for checking equipment across all locations rather than treating the incident as an isolated French problem.
What Businesses and Investors Should Watch Next
The most important developments will be the findings of the French investigation, confirmation of the attack method and the scale of losses reported by affected retailers.
Investors following European retail companies should avoid drawing conclusions about share-price movements without verified market data. The incident creates potential costs, but the impact on any individual company's financial performance will depend on its exposure, insurance arrangements, operational recovery and ability to prevent further attacks.
Several indicators deserve attention:
Confirmed financial losses: Whether retailers provide estimates of inventory write-offs, repairs and other expenses.
Operational recovery: How quickly affected stores restore refrigeration and resume normal sales.
Security remediation: Whether vulnerable equipment is updated, isolated or replaced.
Regulatory and legal consequences: Whether the investigation identifies failures that could lead to further scrutiny or claims.
Wider industry response: Whether European retailers introduce stricter cybersecurity standards for refrigeration and other connected equipment.
The broader lesson is that cybersecurity spending is not simply an IT expense. For businesses dependent on physical infrastructure, it is part of protecting inventory, revenue, customer safety and business continuity.
Conclusion
The French supermarket cyberattack shows how vulnerabilities in connected refrigeration systems can lead to spoiled food, fires and substantial commercial losses. With authorities investigating and the full financial damage still uncertain, the next priorities are identifying how the systems were compromised, restoring affected operations and preventing similar incidents elsewhere.
For retailers, the takeaway is clear: connected equipment must be secured and maintained as carefully as conventional computer networks. Follow our blog for more updates on business, technology, cybersecurity and global markets.
This article is for informational and educational purposes only and should not be considered investment advice.