A large-scale cyberattack targeting supermarket refrigeration systems has disrupted operations at hundreds of stores across France, causing significant food losses and fires. Hackers reportedly manipulated connected refrigerators and freezers, raising temperatures to as high as 50°C (122°F) overnight and damaging perishable and frozen products.
The Paris prosecutor’s office confirmed on Monday that a large-scale attack was affecting connected refrigeration systems at several major food retailers across the country. French authorities have launched an investigation, with Prime Minister Sébastien Lecornu directing the National Cybersecurity Agency (ANSSI) to examine the incident and assess its wider implications.
According to Intermarche CEO Thierry Cotillard, the attack could result in losses worth tens of millions of euros nationwide in a single day. The incident has also raised concerns about the cybersecurity of connected equipment used to manage essential retail operations.
Major Retail Chains Report Refrigeration Disruptions
Several leading French supermarket operators reported being affected by the attack. Carrefour said around 80 of its stores were hit, while Monoprix reported that approximately 5% of its nearly 490 stores in France were affected.
Les Mousquetaires, which owns Intermarche, said refrigeration systems at around 150 stores had been manipulated, with temperatures rising for approximately six hours overnight. The retailer said all affected food had been discarded to eliminate potential health risks.
Cooperative U also confirmed that its supermarket group had been targeted. The French retail association Fédération du Commerce et de la Distribution called for full transparency regarding the incident and said retailers were working to protect consumers and restore normal operations. Some affected stores had already resumed operations.
Connected Refrigeration Systems Under Scrutiny
The incident has highlighted the risks associated with internet-connected operational technology used in supermarkets. Refrigeration systems are commonly managed through control panels that regulate temperatures across multiple fridges and freezers. Internet connectivity allows maintenance providers to monitor and adjust these systems remotely, but poorly secured or outdated software can expose them to cyber threats.
A source close to the French prime minister said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss. The company acknowledged incidents in France affecting a limited number of refrigeration management systems and said the affected units were running outdated firmware.
Danfoss stated that it had advised customers to keep supported systems updated and migrate legacy systems to current-generation solutions.
The incident follows cybersecurity research published by Claroty’s Team82 on August 9, which detailed vulnerabilities in the Danfoss AK-SM 800A controller. According to the research, software updates addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.
However, the available information does not establish the precise method used in the French attack or confirm that the previously documented vulnerabilities were directly exploited.
Investigation Expands Beyond France
French authorities are coordinating with European counterparts to determine whether other countries or businesses could be affected. Felix Aime, a senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, said Spain, Portugal, Poland, Germany and Belgium had also experienced impacts.
The reported incidents have drawn attention to the potential consequences of cyberattacks against operational technology, where disruptions can extend beyond digital systems to physical equipment, food safety and supply-chain continuity.
A similar pattern of disruption was reported at around a dozen US military commissaries in late August, where refrigeration problems following cyber incidents resulted in food losses.
Dutch Retailer Ahold Delhaize Reports Security Issue
Separately, Dutch retailer Ahold Delhaize, which operates Albert Heijn in the Netherlands and several supermarket chains in the United States, reported a security issue affecting its network. The company took several systems offline as a precaution, while Albert Heijn's mobile application informed customers that grocery deliveries were unavailable because of a cybersecurity incident.
Physical stores remained open, although some websites operated by its US retail chains displayed temporary outage notices. Ahold Delhaize said there was no reason to link its incident to the attacks in France.
The incidents underline the need for stronger cybersecurity across connected retail infrastructure. As supermarkets increasingly depend on remotely managed systems to maintain food storage, monitor equipment and coordinate operations, securing legacy devices, applying firmware updates and restricting remote access remain important measures for reducing operational risks.
𝐒𝐭𝐚𝐲 𝐢𝐧𝐟𝐨𝐫𝐦𝐞𝐝 𝐰𝐢𝐭𝐡 𝐨𝐮𝐫 𝐥𝐚𝐭𝐞𝐬𝐭 𝐮𝐩𝐝𝐚𝐭𝐞𝐬 𝐛𝐲 𝐣𝐨𝐢𝐧𝐢𝐧𝐠 𝐭𝐡𝐞 WhatsApp Channel now! 👈📲
𝑭𝒐𝒍𝒍𝒐𝒘 𝑶𝒖𝒓 𝑺𝒐𝒄𝒊𝒂𝒍 𝑴𝒆𝒅𝒊𝒂 𝑷𝒂𝒈𝒆𝐬 👉 Facebook, LinkedIn, Twitter, Instagram
