A cyberattack disrupted refrigeration systems at French supermarkets on Monday, forcing stores to discard chilled and frozen food as investigators examined how attackers gained control of temperature settings.The attack, detected overnight on 11–12 October, affected outlets operated by Intermarché and Coopérative U, with E. Leclerc stores also identified among those hit. Disruption was linked to refrigeration controls associated with Danish equipment manufacturer Danfoss, rather than supermarkets' payment terminals or customer databases.
Dominique Schelcher, chairman of Coopérative U, confirmed that several stores in the cooperative's network had suffered an attack on their refrigeration installations. He said teams were working with refrigeration specialists to restore normal operations and that an investigation would be needed to establish what happened.
The cybercrime division of the Paris public prosecutor's office has taken up the investigation. The identity of the attackers, their means of entry and any possible demands had not been established publicly on Monday.
Around 150 Intermarché shops were understood to have been affected, although that figure was not accompanied by a complete, independently verified national tally. The overall number of outlets hit across different supermarket groups remained uncertain, as did the precise financial cost.
The incident appears to have involved unauthorised changes to equipment settings that regulate refrigeration and defrosting. Some affected systems were reportedly instructed to operate at temperatures as high as 50 degrees Celsius, compromising the safe storage of food. That figure describes a reported equipment setting, not necessarily the measured temperature of every refrigerator or freezer involved.
Fresh meat, dairy products and frozen goods were among the merchandise removed from sale. Shops where refrigeration had failed for extended periods faced the prospect of destroying substantial amounts of stock rather than allowing potentially unsafe products back onto shelves.
The scale of losses varied by location. Two outlets in Haguenau, eastern France, were associated with estimated combined damage of €270,000. Such preliminary figures do not establish the eventual nationwide cost, which will depend on the duration of failures, quantities discarded and the extent of damaged equipment.
The Les Mousquetaires group, which operates Intermarché, identified an attack involving Danfoss refrigeration systems as the source of the disruption affecting its stores. The exact technical vulnerability, however, has not been independently established, and it remains unclear whether attackers breached a central service, individual controllers or remote maintenance access.
Other store networks, including Carrefour Market and Monoprix, were identified as potentially affected by Jonathan Le Borgne, a specialist in French food retail. Their inclusion in initial accounts should not be taken as confirmation that either chain experienced disruption throughout its wider network.
Schelcher described the targeting of equipment essential to food preservation and supplies as exceptionally serious. His remarks underscored the practical consequences of a cyber intrusion directed at store infrastructure: food can be lost even when sales systems remain operational and personal information is not known to have been stolen.
Maintenance teams faced two separate tasks: restoring secure control of refrigeration equipment and checking whether stored goods had remained within permitted temperatures. A refrigerator returning to normal settings does not by itself establish that its contents are safe for sale after an interruption.
The incident also brought attention to the remote management of supermarket refrigeration. Such systems allow technicians to monitor installations and adjust operating conditions without visiting each store, but their network connections require controls over access, software updates and credentials.
Early technical accounts suggested that older versions of refrigeration management software might be involved. Neither that explanation nor a specific exploited flaw had been conclusively demonstrated, making it premature to assign responsibility to a particular product version or security failure.
The disruption raised questions about whether individual stores could isolate refrigeration controls from remote connections while repairs were carried out. Authorities had not announced a timetable for completing the forensic examination, and there was no confirmed assessment of whether the same access route remained available to attackers at other installations on Monday.
The attack did not amount to evidence of a nationwide food shortage. Its established effects concerned products held in affected stores, and the extent to which deliveries or replacement stock could restore availability differed between locations.
Some affected retailers used public notices and social media messages to explain empty chilled cabinets to customers. Store-level inspections and stock disposal were continuing while refrigeration contractors worked to recover affected systems.
Topics
Technology