French supermarket refrigeration cyberattack spoils food and disrupts stores

French supermarkets discarded fresh and frozen food and some temporarily closed after a cyberattack on connected refrigeration systems overnight on 11–12 October 2026. Retailers reported hundreds of affected stores across France, while the Paris prosecutor’s office opened an investigation into the incident and its reported losses and fires. The attack matters beyond a technical outage: refrigeration failures can quickly make food unsaleable and interrupt supplies to shoppers.

Reports said the attackers manipulated refrigeration or defrost controls, with some equipment reaching about 50°C. Les Mousquetaires, the parent of Intermarché and Netto, told Reuters its affected fridges stayed at that temperature for six hours overnight. The company said it discarded the food to avoid health risks. Investigators have yet to establish the perpetrators or the full method used, according to Le Monde.

How many French supermarket stores were affected?

There is no settled count. Reuters reported that Les Mousquetaires put its affected stores at about 150, while Le Monde reported roughly 300 Intermarché and Netto stores. The BBC gave another figure: 180 affected stores, with 100 more disconnected as a precaution. Those figures describe different reported totals and, in the BBC’s account, distinguish affected outlets from precautionary disconnections. They should not be added together.

Le Monde also reported about 100 Coopérative U outlets, 80 Carrefour stores, several E.Leclerc locations and about 30 Monoprix stores affected. The BBC reported more than 100 Coopérative U supermarkets targeted. Carrefour separately told Reuters that 80 of its supermarkets were hit; Monoprix said 5% of its approximately 490 French stores were affected. The reports have not produced a consolidated total across chains.

Food losses and the response in stores

Stores removed affected products after the cold chain was broken, Le Monde reported, and some closed temporarily while staff cleared stock. At one Intermarché, owner Charles Dezon told the newspaper that a cold room reached 50°C and triggered a sprinkler. He reported a €21,000 loss at purchase cost and expected his shelves to be restocked on 13 October. His estimate describes one store, not the industry’s final bill.

Intermarché chief executive Thierry Cotillard told Reuters that nationwide losses could reach tens of millions of euros in a day. Reuters said there was no immediate industry-wide estimate; Le Monde likewise reported that the overall loss was unknown. Some stores were already operating again, Reuters reported, but Le Monde said wider recovery could take several days as retailers replenished stock.

Coopérative U chief executive Dominique Schelcher called the attack unprecedented and serious in comments to Reuters, citing its target: equipment essential to preserving fresh food and maintaining the food supply. The French retail association FCD called for transparency from refrigeration systems supplier Danfoss, while the prime minister’s office asked France’s cybersecurity agency ANSSI to take up the incident, according to Reuters and Le Monde.

What is known about the refrigeration systems?

Danfoss told Reuters it was aware of incidents in France affecting a limited number of refrigeration management systems. It said the affected units ran outdated firmware and advised customers to update supported systems and migrate legacy equipment. Danfoss told Le Monde that most affected units were obsolete and no longer received software or security updates. Those statements describe the equipment involved; they do not by themselves establish how attackers gained access in this incident.

Le Monde reported earlier Danfoss security alerts in March and August 2025. Reuters cited research published on 9 August by Claroty’s Team82 describing vulnerabilities in the Danfoss AK-SM 800A controller and fixes for authentication-bypass and code-execution risks. Neither report established that those particular vulnerabilities were exploited in the supermarket attack.

The Paris prosecutor’s office is seeking to identify victims and connect reported food losses and fires to the attack. Le Monde said there was no known public claim of responsibility at the time of its report. Reuters quoted a Sekoia cyber threat analyst reporting effects in Spain, Portugal, Poland, Germany and Belgium, but did not establish whether those incidents were linked to the French attack. The final store count, losses and attack path therefore remain open questions.