Hackers seized control of refrigeration systems at hundreds of French supermarkets overnight on October 11–12, forcing fridges and freezers into defrost mode and driving internal temperatures to 50°C — spoiling tonnes of fresh and frozen food and even sparking fires at several stores, according to Reuters and AFP.

The Paris prosecutor's office confirmed a "large-scale" attack affecting connected refrigerators across several major food retailers. Prime Minister Sébastien Lecornu instructed France's National Cybersecurity Agency (ANSSI) to investigate, and authorities are coordinating with European counterparts amid signs the campaign spread beyond France.

Table of Contents

What happened overnight

The attackers remotely hijacked the systems that control refrigerators, freezers, display cabinets and cold rooms at stores belonging to some of France's biggest retail chains. Rather than locking data or knocking websites offline — the usual playbook of ransomware groups — this operation tampered directly with the equipment that keeps food safe, forcing it into defrost cycles for roughly six hours overnight.

Groupement Les Mousquetaires, owner of Intermarché, said around 150 of its stores were hit, with fridges heated to 50°C (122°F). All affected food had to be discarded to eliminate health risks. Coopérative U said just under 100 of its outlets were targeted; its chief executive Dominique Schelcher called the incident "unprecedented." Carrefour and E. Leclerc confirmed attacks on several of their stores, while Auchan, Monoprix and Metro had not confirmed whether they were affected.

In some stores, the overheating refrigeration units started fires. Paris resident Geert de Clercq described staff at an Intermarché in central Paris dumping cartfuls of defrosted frozen food into a giant rubbish container on the street, with melted ice cream sloshing from broken tubs.

The Danfoss connection

Investigators and retailers quickly zeroed in on a common supplier: Danish manufacturer Danfoss, whose refrigeration control systems are widely used by the affected chains. An internal Intermarché communication cited by BFMTV confirmed the cyberattack had hit Danfoss-connected systems during the night, and a crisis meeting was scheduled for Monday morning between refrigeration-sector service providers — including maintenance specialist Axima — and Danfoss itself.

Danfoss told AFP that most of the affected equipment consisted of "legacy" products which no longer receive software or security updates — a detail that underscores a chronic problem in industrial cybersecurity. Refrigeration controllers, like countless other connected devices in factories and food chains, are often installed, networked, and then forgotten for years.

This attack also differs from France's recent high-profile cyber incidents, such as the cyberattack on the Socialist Party and the Arizona court data breach, in that it caused physical destruction in the real world — a hallmark of attacks on industrial control systems.

A cross-border campaign

The incident may not be confined to France. Sekoia Threat Detection and Research analyst Felix Aime told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. French authorities said they were assessing whether other French companies were at risk and coordinating with European partners.

France was already on high alert over cyber threats. The attack lands amid broader European anxiety about hybrid threats targeting critical infrastructure — a concern that recently prompted a UK–Germany cyber-sabotage partnership. The Paris prosecutor's office has opened its own investigation alongside the ANSSI probe.

Food security in the crosshairs

EU food and agriculture commissioner Christophe Hansen condemned the attack on X, saying "food security requires more attention at all levels" and that the exploitation of food systems was now "a reality." Experts estimated losses could run into the millions of euros, with individual stores facing damage worth tens or even hundreds of thousands of euros.

The episode is a stark demonstration of how digitised supply chains have widened the attack surface: a vulnerability in one Danish vendor's refrigeration controllers cascaded into empty frozen-food aisles across one of Europe's largest food markets. Expect regulators to take a hard look at whether legacy industrial systems connected to the internet need mandatory security baselines — because the next target could be a power grid, a water plant, or a hospital.

Key takeaways

  • Hackers remotely forced refrigeration systems at hundreds of French supermarkets into defrost mode (50°C) overnight, destroying food and sparking fires.
  • Intermarché (~150 stores), Coopérative U (~100 stores), Carrefour and E. Leclerc confirmed they were hit; a Danfoss refrigeration-control vulnerability is the suspected entry point.
  • ANSSI and the Paris prosecutor are investigating; Spain, Portugal, Poland, Germany and Belgium may also have been affected.
  • The EU's food commissioner condemned the attack and called for greater attention to food security.

Frequently Asked Questions

Which supermarket chains were affected by the cyberattack?

Intermarché (around 150 stores), Coopérative U (just under 100 stores), Carrefour and E. Leclerc all confirmed attacks on their refrigeration systems. Auchan, Monoprix and Metro had not confirmed impacts at the time of reporting, according to AFP.

How did the hackers damage the fridges?

The attackers seized control of the remotely manageable refrigeration control systems — made by Danish manufacturer Danfoss — and forced them into defrost mode, heating fridges and freezers to about 50°C for roughly six hours overnight, according to Reuters.

Who is investigating the attack?

The Paris prosecutor's office opened an investigation, and Prime Minister Sébastien Lecornu instructed France's National Cybersecurity Agency (ANSSI) to investigate. France is also coordinating with European partners, as the attack may have crossed borders.

Why was Danfoss equipment vulnerable?

Danfoss told AFP that most of the affected equipment consisted of legacy products that no longer receive software or security updates — a common weak point in industrial control systems that remain networked long after vendor support ends.