- Carrefour, Intermarché, E. Leclerc and Coopérative U reported disruptions to refrigeration systems.
- Some refrigerators reportedly reached temperatures of up to 50°C, putting fresh and frozen food stocks at risk.
- Investigators are examining a possible vulnerability in refrigeration control systems supplied by Danish manufacturer Danfoss.
French supermarket chains have been hit by a cyberattack that reportedly caused refrigeration systems to overheat, spoiling food and raising concerns about the vulnerability of equipment used to preserve essential supplies.
The incident affected retailers including Carrefour, Intermarché, E. Leclerc and Coopérative U, according to reports from Reuters and Agence France-Presse (AFP) on Monday (12). Some refrigeration units reportedly reached temperatures of up to 50°C overnight, forcing stores to discard fresh and frozen products.
Coopérative U chief executive Dominique Schelcher confirmed that cyberattacks had affected refrigeration facilities at several stores. In a statement on social media, he described the incident as “extremely serious and unprecedented."
“Attacking equipment that is essential to the preservation of fresh products and the food supply of the French people is extremely serious and unprecedented. It is unacceptable,” Schelcher said.
The scale of the disruption varied by retailer. Carrefour reportedly said 80 of its supermarkets had been affected, while Intermarché and its Netto brand reported hundreds of affected outlets in statements to AFP. Coopérative U also confirmed disruptions at more than 100 stores, according to the news agency.
The Les Mousquetaires group, which operates Intermarché and Netto, said the damage could result in losses of several million euros. It added that some fresh and frozen food displays had been taken out of service after the attack affected a service provider responsible for managing refrigeration systems.
The group said affected products were being removed and disposed of to protect consumers. Although some stores reportedly experienced smoke from overheating equipment, Les Mousquetaires said it had received no reports of fires at its affected outlets.
How did the cyberattack affect supermarket refrigeration?
According to French media reports, the attackers may have remotely triggered forced defrosting across numerous refrigeration units, causing temperatures to rise and food stocks to spoil.
A source close to the investigation told AFP that refrigeration control systems supplied by Danish manufacturer Danfoss had been targeted. The company said most of the equipment involved was older technology that no longer received software or security updates.
Danfoss identified its AK-SM800 and AK-SC355 refrigeration control systems among the models affected. It said a version of the AK-SM800 used outdated firmware and that it had previously advised supermarkets to upgrade from those systems. The company did not disclose how many units had been affected.
The findings have not established the full extent of the attack or who was responsible. France's cybersecurity agency has reportedly identified a vulnerability in software supplied by a Danish company and contacted the vendor, according to a source close to French Prime Minister Sébastien Lecornu.
The agency is also liaising with European counterparts to establish whether businesses in other countries may be at risk.
Dutch supermarket operator Ahold Delhaize, which also owns US grocery businesses, separately reported a security issue within its network and said some systems had been taken offline. Its Albert Heijn supermarket chain also experienced disruption to online grocery deliveries, according to reports.
Why is the attack raising wider security concerns?
The incident has drawn attention to the risks facing equipment that is essential to everyday services but may not have been designed with modern cybersecurity threats in mind.
Refrigeration systems are increasingly connected to remote monitoring networks and digital control platforms, allowing operators to manage equipment across multiple locations. However, those connections can also create vulnerabilities if software is outdated or security protections are inadequate.
Antoine Hautin, of cybersecurity consultancy Almond, told AFP that industrial equipment once isolated from the internet was increasingly connected through sensors and remote monitoring systems. The apparent ability to affect large numbers of refrigeration units simultaneously suggested a degree of sophistication, he said.
European Commissioner for Agriculture and Food Christophe Hansen condemned the attack on social media, warning that food security required greater attention.
“Food security requires more attention at all levels. Because the weaponisation of food has become a reality,” he said.
The Paris prosecutor's office confirmed that an investigation had been opened into the large-scale cyberattack affecting refrigeration systems at major food retailers. Investigators are seeking to identify those responsible and establish the links between the attack, reported food losses and any fires.
The incident comes amid broader European concerns about cyberattacks targeting critical infrastructure. French President Emmanuel Macron has called for stronger protection against what his government describes as hybrid threats, including hostile cyber activity.
For supermarket operators, the immediate priority is to remove potentially affected food, restore refrigeration systems and establish the extent of their losses. The longer-term challenge is to secure connected equipment that plays a critical role in food safety, particularly where older systems may no longer receive security updates.
The investigation is continuing, and the full financial damage and geographical reach of the attack have yet to be established.
