French authorities are investigating a large-scale cyberattack that targeted refrigeration systems at hundreds of supermarkets across the country, causing extensive food spoilage and operational disruptions. The attacks, which occurred overnight on October 11, affected major retail chains including Carrefour, Cooperative U, Intermarché, Netto, E. Leclerc, and Monoprix.
The perpetrators gained control of refrigeration management software supplied by Danish engineering company Danfoss, manipulating freezer thermostats to raise temperatures as high as 50 degrees Celsius, and in some instances reportedly up to 80 degrees Celsius. This forced affected stores to dispose of significant quantities of perishable goods, including meat, frozen items, and vegetables. Some supermarket managers described the losses as severe, with one rural Intermarché location reporting a "total loss of fresh and frozen" products.
Estimates suggest that roughly 400 to 700 supermarkets—out of France’s approximately 15,000 nationwide—were impacted, though exact figures vary by source. The Groupement Mousquetaires, which owns Intermarché and Netto, reported damage in around 300 of its outlets, while Cooperative U said fewer than 100 of its 2,000 stores were affected. Carrefour confirmed around 80 locations experienced disruptions.
Danfoss stated that most affected refrigeration systems were older models no longer supported with software or security updates. The company emphasized it had previously advised customers to keep firmware updated and employ cybersecurity best practices, such as operating systems behind firewalls and virtual private networks. Danfoss said it was working closely with customers to mitigate the damage.
Cybersecurity experts analyzing the incident described it as a targeted exploitation of known vulnerabilities in legacy systems. The relatively straightforward nature of the attack has led some analysts to suggest it may have been carried out by opportunistic individuals rather than sophisticated state actors. Notably, the attack did not appear to include ransom demands or political claims of responsibility, which are typical motives in cybercrime. This has left investigators puzzled about the attackers' intentions.
Authorities in Paris have launched an inquiry led by the cybercrime division of the public prosecutor’s office. The investigation aims to identify those responsible and assess the full extent of damages, including food waste and any reported incidents such as fires connected to the attack.
French government officials have highlighted the incident as a significant challenge to the country’s food security, with Finance Minister Roland Lescure referring to it as a “wake-up call.” Following warnings from French President Emmanuel Macron about heightened cyber threats from geopolitical tensions, including concerns about “hybrid” operations linked to Russia, the National Cybersecurity Agency has intensified its oversight and cooperation with European counterparts to prevent similar attacks.
The breach underscores growing global concerns over cybersecurity vulnerabilities in operational technology systems that manage physical infrastructure, such as refrigeration units, water facilities, and industrial equipment. Experts warn that attacks targeting these systems can cause tangible physical damage and economic disruption beyond traditional data theft or ransomware.
Separately, Dutch retailer Ahold Delhaize reported its websites for brands serving Europe and the United States were offline due to an unspecified security issue following the French incidents, although its stores remained open with no evidence of data being compromised.
Overall, the attack has spotlighted the risks posed by outdated technology and exposed supply chain vulnerabilities in critical sectors such as food retail, emphasizing the need for ongoing investment in cybersecurity and infrastructure modernization.