Hackers Turn French Supermarket Fridges Up To 50°C As Massive Cyberattack Forces Stores To Destroy Food
France's Refrigeration Systems Hacked
France's Food Supply Chain Under Attack
Intermarché, Super U And Leclerc Are Among The Chains Affected After Attackers Reportedly Manipulated Refrigeration Controls, Leaving Fresh Food Unsellable And Triggering A Criminal Investigation
French supermarkets have been hit by an extraordinary cyberattack that interfered with refrigeration systems, reportedly raising temperature settings to as much as 50 degrees Celsius and forcing stores to throw away fresh and frozen food.
The attack began overnight between Sunday 11 October and Monday 12 October 2026. It affected multiple supermarket chains, including Intermarché, Coopérative U and Leclerc, with around 150 Intermarché stores initially identified as affected.
Estimates have suggested that approximately 250 supermarkets could be involved across France, although that national figure has not been independently established. The confirmed impact already stretches across different retailers and regions.
Unlike a conventional cyberattack designed to steal passwords, customer records or financial information, this operation targeted equipment responsible for keeping food cold.
Its consequences were physical and immediate. Refrigerated displays stopped maintaining safe temperatures, perishable goods became unsuitable for sale, and supermarkets faced potentially substantial financial losses.
French judicial authorities have opened an investigation into an incident that raises urgent questions about the cybersecurity of connected industrial equipment.
How Hackers Turned Supermarket Refrigeration Into A Liability
The attack centred on digital refrigeration controls associated with Danfoss, a Danish manufacturer whose technology is used in commercial cooling installations.
Modern supermarket refrigeration is not controlled entirely through mechanical thermostats.
Digital systems regulate temperature, monitor equipment and manage functions such as automatic defrosting. Depending on their configuration, these systems can also be accessed remotely for maintenance and supervision.
That connectivity helps technicians manage complex installations. It can also create an entry point if remote access or the underlying control environment is compromised.
The initial account of the French attack indicates that intruders were able to interfere with refrigeration settings, reportedly activating or manipulating defrost functions and setting temperatures as high as 50 degrees Celsius.
Automatic defrosting is a normal refrigeration function. It helps remove ice from components so that cooling equipment can operate effectively.
But if a system is forced into an inappropriate operating state, food-storage temperatures can rise well beyond safe limits.
The reported 50-degree figure relates to manipulated temperature controls. It does not establish that every affected refrigerator, freezer or food product physically reached that temperature.
Investigators have not yet publicly established the precise technical entry point, the extent of attacker access or whether a particular software vulnerability enabled the operation.
Intermarché, Super U And Leclerc Among Affected Retailers
Intermarché appears to have suffered one of the largest identified disruptions.
Early estimates placed the number of affected Intermarché stores at approximately 100 to 150, although figures varied as information emerged.
The chain's parent group, Les Mousquetaires, identified the refrigeration technology supplier Danfoss in connection with the incident.
Coopérative U, which operates supermarkets under brands including Super U, Hyper U and U Express, also confirmed disruption within its network.
Its president, Dominique Schelcher, publicly acknowledged the attack on Monday 12 October.
Schelcher said the incident affected refrigeration installations at several of the group's stores and confirmed that technical teams were working with refrigeration specialists to restore operations.
He described the targeting of equipment essential for preserving fresh products and supplying food to the French population as exceptionally serious and unprecedented.
Leclerc stores were also identified among those affected.
Other local supermarket locations reported disruption, illustrating how an attack involving widely used technology can affect retailers that otherwise operate as separate businesses.
The precise number of affected shops remains subject to verification, and there is no evidence that every branch of these chains experienced the same consequences.
Food Destroyed As Shops Discover Empty Refrigerated Shelves
The clearest evidence of damage appeared in supermarkets where refrigeration failures interrupted the cold chain.
The cold chain is the controlled system of low temperatures used to preserve food from production and transport through to storage and sale.
Once certain perishable products become too warm for too long, their safety cannot be guaranteed simply by cooling them again.
Meat, seafood, dairy products, prepared meals and frozen goods can all require disposal if storage temperatures exceed safe limits for an unacceptable period.
At the Super U supermarket in Mirepoix, in southern France, refrigeration problems left sections of the fresh-food department depleted.
The store informed customers that a cyberattack affecting its refrigeration service provider had caused refrigerator failures and that some fresh products might temporarily be unavailable.
In nearby Lavelanet, a Carrefour supermarket was also affected, with products discarded following the incident.
These local examples show why this attack differs from an ordinary website outage.
Staff cannot simply restart a computer and recover food that has spent hours outside its required storage temperature.
Even when technicians restore the refrigeration equipment, stores must assess affected goods, document losses, clean or inspect equipment where necessary and arrange replacement deliveries.
How Much Could The Cyberattack Cost?
The financial damage could reach millions of euros nationally, although no verified total loss figure has yet been established.
Individual supermarket losses depend on several factors: the size of the affected refrigeration areas, the value of stock, the duration of the temperature disruption and whether products can be safely recovered.
In Haguenau, eastern France, losses at two affected supermarkets were estimated at a combined €270,000.
Those early estimates are not a national financial assessment. However, they demonstrate how quickly a refrigeration failure can become expensive in a large grocery store.
The cost extends beyond the food itself.
Retailers may need emergency technicians, replacement products, additional transport and waste disposal. Some could also lose sales while shelves remain empty.
Insurance claims and contractual disputes may follow, particularly if investigators establish that weaknesses in third-party equipment, configuration or servicing contributed to the incident.
Responsibility cannot yet be assigned on the basis of the equipment manufacturer's involvement alone.
Why This Cyberattack Is Unusual
Cybercriminals typically target organisations for several recognisable reasons.
Some steal personal information to sell or exploit. Others encrypt computer systems and demand payment through ransomware. Certain attackers attempt to disable websites, communications or payment services.
The French supermarket attack appears to have taken a different path.
The immediate reported damage came from manipulating equipment that controls physical conditions inside stores.
That places the incident within the wider cybersecurity field known as operational technology.
Operational technology refers to hardware and software used to monitor or control machinery and physical processes.
It is found in factories, power stations, water-treatment facilities, transport networks, hospitals and food-production operations.
The distinction matters because the effects of an operational technology compromise can move beyond lost information.
A digital command may alter a temperature, stop a production line, interrupt a pump or change the behaviour of machinery.
Not every such incident creates a danger to human life, and there is no confirmed evidence of injuries resulting from this supermarket attack.
Nevertheless, it demonstrates how equipment connected to computer networks can become a source of physical and economic disruption.
Across Europe, the cybersecurity resilience of essential services has become a growing concern as public infrastructure and private businesses rely on interconnected technology.
Was Danfoss Itself Hacked?
Danfoss has been named in accounts of the attack because its refrigeration control systems are associated with the affected installations.
But an important distinction remains unresolved.
An attack involving a manufacturer's products does not automatically mean hackers breached that manufacturer's corporate network.
There are several possible routes into connected equipment.
Attackers might exploit a vulnerable controller, compromise a remote maintenance account, obtain credentials from an authorised user or gain access through an improperly secured network.
A shared software weakness could potentially expose multiple stores using similar equipment.
Alternatively, attackers might compromise systems operated by a service provider responsible for maintaining installations at different locations.
These are plausible technical scenarios, not established findings about this incident.
Investigators will need to determine which systems were accessed, how commands were issued and why equipment at separate stores could be affected within the same period.
The answers will help establish whether the attack exploited a common technical vulnerability, compromised access credentials or another weakness.
France Opens Criminal Investigation
The cybercrime division of the Paris prosecutor's office has taken up the investigation.
Authorities face several distinct questions.
First, investigators must establish how the attackers obtained access to refrigeration controls.
Second, they need to determine whether the affected installations shared a common weakness and whether any additional systems remain vulnerable.
Third, police will need to examine the attackers' motives and identify those responsible.
At the time of writing, no publicly verified attribution establishes that a named criminal organisation, foreign intelligence service or state carried out the operation.
There is also no confirmed public evidence of a ransom demand linked to the refrigeration disruption.
The deliberate targeting of food-storage equipment does not, by itself, establish terrorism, sabotage directed by a foreign state or an attempt to destabilise France.
Those distinctions matter because the technical evidence may establish what happened before investigators can reliably establish why.
France has already faced significant cybersecurity incidents involving sensitive government information.
An earlier attack on the country's tax systems demonstrated the consequences of unauthorised access to personal and financial records.
The supermarket incident involves a different kind of exposure: the possibility that attackers can manipulate the machinery on which everyday services depend.
Could Similar Attacks Affect Britain And Other European Countries?
The underlying risk is not confined to France.
British supermarkets, warehouses, food manufacturers and distribution centres also rely on automated refrigeration and digitally managed infrastructure.
The existence of those systems does not mean they share the specific weakness involved in the French attack.
But it raises an important question for businesses across Europe.
Can the equipment responsible for preserving food continue operating safely if connected software, maintenance access or network services are compromised?
The most effective safeguards depend on the installation.
They can include separating refrigeration controls from ordinary business networks, restricting remote access, applying supported security updates and monitoring for unusual changes to temperature settings.
Independent temperature alarms and local safety controls can help detect or limit disruption when central software behaves incorrectly.
Businesses also need procedures for responding to suspected manipulation, preserving technical evidence and deciding when stock must be discarded.
These measures cannot prevent every cyberattack. They can, however, reduce the chance that one compromised digital connection produces large physical losses.
The wider European debate over cyber disruption increasingly concerns whether essential systems can keep working when part of their technological infrastructure fails.
What Happens To The Affected Supermarkets Now?
The immediate task is restoring safe refrigeration.
Affected retailers must establish that equipment is functioning correctly and that fresh and frozen products can be stored within their required temperature ranges.
Stores that lost stock will need replacement deliveries. The pace of recovery will vary according to the damage sustained and the availability of technicians and new supplies.
Customers may encounter temporary gaps in refrigerated food ranges at individual affected locations, although there is no established evidence of a nationwide food shortage caused by the attack.
Investigators must also determine whether the attackers retain access to any systems and whether additional sites could be exposed to the same method.
For the companies involved, the longer-term consequences will depend on the final damage assessment, the findings of the criminal investigation and the technical measures required to prevent a recurrence.
The central unanswered question is how attackers were able to interfere with refrigeration equipment across multiple retailers, and whether the underlying weakness has been fully contained.
Sources
Anadolu Agency — Major Cyberattack Disrupts Refrigeration Systems Across French Supermarket Chains — Chain involvement, preliminary impact figures, Danfoss connection and the Paris cybercrime investigation, 12 October 2026.
TF1 Info — Cyberattack On Refrigeration Systems Affects At Least 150 Stores — Initial scale of the disruption at Intermarché and other affected chains, 12 October 2026.
La Dépêche du Midi — Cyberattack Hits Supermarkets In Ariège, With Fresh Products Destroyed — Local evidence of empty refrigerated shelves, destroyed food and retailers' responses, 12 October 2026.
Next Reads
Cyber Incidents In Europe Are Turning Routine Services Into A Resilience Stress Test — How cyber incidents can interrupt essential services even when personal information is not stolen.
France's Tax System Hacked As Data On 678,000 People And Businesses Is Stolen — Another major French cyber incident, involving a different category of risk.
UK Foreign Office Cyberattack Confirmed: What's Known, What's Still Unclear, And Why It Matters Now — A separate example of the difficulties involved in assessing and containing a serious security breach.
