Hundreds of supermarkets across France have been targeted in a coordinated cyberattack that allowed hackers to remotely manipulate refrigeration systems, forcing temperatures to rise to 50°C for approximately six hours and resulting in significant food losses and reports of fires.
French supermarket operator Les Mousquetaires confirmed that approximately 150 of its Intermarché stores were affected by the attack, which occurred overnight on 11–12 October 2026. The company said all affected refrigerated and frozen food products were discarded to eliminate potential health risks.
The attack extended beyond Intermarché, with other major French supermarket chains, including Coopérative U, Carrefour and Monoprix, reporting similar incidents. French Finance Minister Roland Lescure subsequently indicated that approximately 700 supermarkets across the country had been affected.
The Paris prosecutor’s office confirmed an investigation into the large-scale attack against connected refrigeration equipment and reported that the damage included food losses and fires at some locations.
Unlike conventional cyberattacks targeting financial information or customer records, the incident directly affected operational technology responsible for maintaining food safety and temperature-controlled storage.
Attackers reportedly gained remote access to refrigeration management systems and activated defrost functions, causing refrigerators and freezers to heat well beyond their normal operating temperatures.
In some cases, the attackers allegedly extended defrost cycles and delayed alarms, increasing the time before store operators became aware of the abnormal conditions.
The incident resulted in substantial quantities of meat, vegetables, frozen food and other temperature-sensitive products being destroyed. Intermarché subsequently reported financial losses amounting to tens of millions of euros.
French Prime Minister Sébastien Lecornu directed the country’s national cyber security agency, ANSSI, to investigate the attack and coordinate with European counterparts amid concerns that other countries could also be affected.
Investigators identified vulnerabilities involving refrigeration management technology supplied by Danish manufacturer Danfoss.
Danfoss acknowledged incidents affecting a limited number of refrigeration management systems in France and said the affected equipment was operating outdated firmware. The company reiterated its longstanding advice for customers to install security updates and migrate legacy systems to supported technology.
Cyber security researchers had previously identified vulnerabilities in Danfoss refrigeration controllers, including weaknesses that could potentially allow attackers to bypass authentication controls and execute unauthorised commands.
However, investigators have not publicly established that a specific previously disclosed vulnerability was responsible for every affected system.
The attack demonstrates the risks associated with internet-connected building management and industrial control systems, particularly where equipment can be remotely accessed by maintenance providers or third-party contractors.
Modern supermarket refrigeration installations commonly rely on centralised controllers to manage multiple refrigerators, freezers and cold-storage facilities. These systems can be accessed remotely for monitoring, maintenance and temperature adjustments.
While remote connectivity improves operational efficiency, inadequately secured systems can provide attackers with opportunities to manipulate physical processes without requiring direct access to individual appliances.
The consequences can extend beyond data theft to equipment damage, business interruption, public safety risks and disruption to essential supply chains.
The incident has also raised questions about the cyber security responsibilities of equipment manufacturers, maintenance contractors and facility operators, particularly where legacy operational technology remains connected to corporate networks or the public internet.
For Australian retailers, logistics providers and operators of temperature-controlled facilities, the attack provides a case study in the convergence of cyber and physical security risks.
Refrigeration and building management systems are widely deployed across supermarkets, food distribution centres, hospitals, pharmaceutical facilities and other critical environments where temperature control is essential.
The incident underscores the importance of maintaining accurate inventories of connected operational technology, updating firmware, restricting remote access, segmenting operational networks and implementing independent monitoring and alarm mechanisms capable of identifying abnormal equipment behaviour.
Security teams must also consider whether existing incident response arrangements adequately address cyber incidents that can create immediate physical consequences, including fire hazards, product contamination and the loss of essential services.
French authorities have not publicly identified the perpetrators, and no confirmed attribution has been announced. Europol has acknowledged its involvement in coordinating with national authorities as investigations continue.
The French cyber security agency has warned that malicious activity may still be ongoing and has advised affected organisations to secure remote connections, update vulnerable equipment and replace compromised credentials.
The attack highlights how compromised operational technology can be used to cause physical and economic disruption across a distributed commercial network.
