Cyberattack disrupts refrigeration at French supermarkets
Several chains say connected cooling systems were remotely switched to defrost mode, destroying food stocks.
Update
The attack affected hundreds of stores, including an estimated 150–200 Intermarché shops and almost 100 Cooperative U outlets; other major chains were also reportedly hit. The resulting food losses were estimated at several million euros. (The Guardian, The Independent)
A cyberattack disrupted refrigeration systems at supermarkets across France on Monday, forcing affected stores to discard fresh and frozen food. Paris prosecutors have opened an investigation into the incident, while the precise method and full scale of the attack remain unclear.
Intermarché and Coopérative U said their stores were affected during the night of 11 to 12 October. Intermarché told AFP that between 150 and 200 of its shops were targeted, while Coopérative U said almost 100 outlets were affected.
The retailers said attackers interfered with refrigeration controls, causing equipment to defrost rather than preserve chilled and frozen goods. Intermarché said affected branches would have to dispose of their fresh and frozen products, but did not give a national estimate for the losses.
French broadcaster BFM TV also reported that E.Leclerc had been affected. AFP said the company had not immediately confirmed the report. A specialist retail publication also mentioned other chains, including Carrefour Market and Monoprix, but the companies had not confirmed those reports.
The Paris prosecutor’s office said it had opened an investigation into what it called a large-scale cyberattack affecting refrigerators at several major food retailers. Prosecutors said the inquiry would identify victims and examine the reported food losses and reports of fires connected with the incident.
French technology publication Les Numériques reported that some refrigeration settings may have been raised to 50°C through a continuous defrost cycle. That detail has not been independently confirmed by the retailers or prosecutors, and the investigation has not established how the attackers gained access.
The incident highlights the risk created when physical infrastructure is managed remotely. Security company Claroty reported in August that it had found vulnerabilities in Danfoss AK-SM 800A refrigeration controllers, including authentication and remote-code vulnerabilities, and said Danfoss had issued updated firmware. Claroty did not link those findings to Monday’s attack.
The available reports establish the disruption and the investigation, but not the identity or motive of the attackers. They also do not establish any impact on British supermarkets. French retailers and investigators are expected to clarify the number of affected sites, the financial losses and whether the incident involved a previously known security weakness.
Fact-check Approved · Priya Shah — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The central event, affected retailers, investigation and reported losses are supported by AFP and French reporting published on 12 October 2026. The article clearly labels the reported 50°C setting and the possible link to earlier Danfoss vulnerabilities as unconfirmed.
- confirmed A cyberattack disrupted refrigeration systems at French supermarkets on 12 October 2026. — AFP reported that Intermarché and Coopérative U told it their refrigeration systems were hit. source
- confirmed Between 150 and 200 Intermarché shops and almost 100 Coopérative U outlets were affected. — The figures were reported by AFP from the retailers. source
- confirmed Affected stores had to discard fresh and frozen food. — Intermarché told AFP that affected branches would throw away fresh and frozen products. source
- confirmed Paris prosecutors opened an investigation. — The Paris prosecutor’s office confirmed the investigation to AFP. source
- uncertain Some refrigeration settings may have been raised to 50°C. — Les Numériques attributed the detail to reports from BFM Business; it was not confirmed by the retailers or prosecutors. source
- confirmed Claroty reported vulnerabilities in Danfoss AK-SM 800A controllers and said updated firmware was issued. — Claroty’s August 2026 research describes the vulnerabilities and the coordinated disclosure and fix. source
- confirmed The available reports do not establish any impact on British supermarkets. — The cited reports concern French retailers and do not report British stores as affected. source
Editor's note
The attack, affected retailers, reported food losses and Paris investigation are well supported. The reported 50°C setting and the exact attack method remain unconfirmed; no attacker or motive has been identified.Sources
More on this in other media
- BBC News — „cybersecurity supermarkets”
- The Guardian — „cybersecurity supermarkets”
- Sky News — „cybersecurity supermarkets”