France supermarket cyberattack hits hundreds of stores as hackers manipulate refrigeration systems

A large-scale cyberattack targeting internet-connected refrigeration systems has disrupted hundreds of supermarkets across France, causing freezers and refrigerators to overheat, destroying large quantities of food and raising new concerns about how vulnerable everyday physical infrastructure has become to hackers.

French authorities said approximately 700 of the country’s roughly 10,000 supermarkets were affected to varying degrees as attackers remotely interfered with refrigeration controls. At some locations, temperatures reportedly climbed as high as 50 degrees Celsius, or 122 degrees Fahrenheit, after cooling equipment was forced into abnormal operating modes. Several stores reported fires or heat-related equipment damage, while retailers were forced to discard fresh and frozen products that could no longer be safely sold.

Major supermarket operators including Intermarché, Netto, Coopérative U, Carrefour and Monoprix were among those affected. France’s national cybersecurity agency and the Paris prosecutor’s cybercrime unit have opened investigations, but officials have not identified the hackers, announced a motive or reported receiving a ransom demand.

The incident is particularly significant because the attackers did not merely steal information or disable a website. They appear to have manipulated digital systems controlling physical equipment inside stores, demonstrating how weaknesses in connected devices can translate directly into damaged infrastructure, wasted food and potentially dangerous conditions.

Hundreds of French supermarkets lose refrigerated food after hackers alter temperatures

The disruption became apparent after refrigeration units at stores across France began behaving abnormally during the night. Instead of maintaining the low temperatures needed to preserve meat, dairy products, frozen foods and other perishables, some refrigeration systems entered continuous heating or defrosting cycles.

Groupement Mousquetaires, which operates Intermarché and Netto, reported hundreds of affected stores, while Coopérative U confirmed disruption at dozens of its locations. Carrefour and Monoprix also experienced problems, although the impact varied significantly between stores.

Retailers were left with little choice but to dispose of products whenever temperatures rose above food-safety thresholds. Even when individual packages looked normal, supermarkets could not reliably determine whether frozen or chilled goods had spent too long at unsafe temperatures, creating potential risks from bacterial growth or contamination.

That precaution has translated into substantial food waste and financial losses. Some supermarket operators have described losing entire refrigerated inventories, while industry estimates suggest the combined cost could reach millions of euros once destroyed food, damaged equipment, disrupted sales and technical repairs are included.

The attack also demonstrates how quickly a digital intrusion can affect consumers without compromising their personal information. Customers arriving at some supermarkets encountered empty or closed refrigerated sections even though checkout systems and other parts of the stores continued operating normally.

Hackers appear to have targeted internet-connected refrigeration control systems

Investigators are concentrating heavily on the electronic controllers used to remotely monitor and manage supermarket refrigeration. Modern stores increasingly rely on network-connected systems that allow technicians to adjust temperatures, monitor equipment performance and diagnose problems without physically visiting each location.

That connectivity provides considerable operational benefits but also creates potential entry points for attackers. France’s cybersecurity agency identified refrigeration controllers from several manufacturers among equipment affected during the incident, including systems associated with Danfoss, Copeland and Dixell.

Earlier reporting initially focused on older Danfoss controllers running outdated firmware. Danfoss said some affected products were legacy systems for which security updates had previously been recommended, while cybersecurity researchers had already identified vulnerabilities affecting certain refrigeration-control interfaces.

Authorities subsequently determined that equipment from additional manufacturers was also affected, making the attack broader than an exploitation of a single company’s technology. Investigators must now determine whether attackers used one common vulnerability, compromised remote-management credentials or exploited several separate weaknesses across different systems.

The precise method matters because it will determine what supermarkets and equipment manufacturers must do to prevent another attack. Installing software updates may be sufficient if outdated firmware was the primary vulnerability, while compromised credentials or poorly secured internet-facing control systems could require much wider changes.

Temperatures reportedly reached 122 degrees as some equipment overheated and fires broke out

Perhaps the most striking feature of the attack was the extreme temperature manipulation. Refrigeration equipment designed to keep food cold was reportedly pushed to temperatures approaching 50 degrees Celsius in some locations, creating conditions dramatically outside normal operation.

Investigators believe attackers may have repeatedly activated built-in defrosting functions. Refrigeration systems periodically use heat to prevent ice from accumulating on components, but forcing that process to run continuously can raise internal temperatures and eventually destroy the products being stored.

At some locations, the abnormal operation reportedly contributed to smoke or fires, adding a physical safety dimension to an incident initially categorized as a cyberattack. Paris prosecutors are examining the property damage alongside the unauthorized access to computer systems.

The episode illustrates a growing cybersecurity concern surrounding operational technology, the digital systems that control physical machinery. Attacks against these systems can have consequences very different from conventional data breaches because manipulating software can potentially alter temperatures, shut down equipment or interfere with processes occurring in the physical world.

For supermarkets, refrigeration is particularly critical because a relatively short disruption can destroy large quantities of inventory. A hacker does not need to permanently disable a store to cause significant losses if food becomes unsafe before technicians can restore normal temperatures.

Investigators still have no clear motive and no group has claimed responsibility

French investigators have yet to identify who carried out the attacks, and no organization has publicly claimed responsibility. Authorities have also reported no ransom demand, making the motive unusually difficult to determine compared with conventional ransomware attacks in which criminals explicitly demand payment.

That uncertainty leaves several possibilities open. The attackers could have been financially motivated criminals, hackers experimenting with exposed systems, an ideologically motivated group or actors seeking primarily to create disruption. Authorities have not publicly presented evidence establishing any of those explanations.

The absence of a ransom demand is particularly noteworthy because supermarkets are attractive targets for extortion. Retailers operate on tight schedules, hold large quantities of perishable inventory and cannot easily suspend operations for extended periods, characteristics that can make them vulnerable to criminals attempting to force rapid payments.

French investigators are therefore examining technical evidence that could reveal where the attackers connected from, which vulnerabilities were exploited and whether the same infrastructure was used against multiple retailers. Attribution can take considerable time because attackers frequently conceal their locations through compromised servers and other intermediaries.

Officials have also cautioned against connecting the incident to a foreign government without evidence. France has faced previous warnings about state-backed cyber activity and hybrid threats, but investigators have not attributed the supermarket attack to Russia, another government or any known cybercrime organization.

Cyberattack exposes security risks created by increasingly connected supermarkets

Modern supermarkets contain far more connected technology than shoppers may realize. Refrigeration equipment, electronic shelf labels, security cameras, inventory systems, payment terminals and building-management systems can all communicate over internal networks or the internet.

The technology can reduce costs and allow businesses to monitor hundreds of locations from centralized control centers. Refrigeration technicians, for example, can identify equipment failures remotely and adjust settings without traveling to a supermarket.

Those benefits can become vulnerabilities when older equipment remains connected long after manufacturers stop supplying regular security updates. Industrial systems are frequently designed to remain operational for many years, meaning hardware installed a decade ago may now be exposed to cybersecurity threats that were far less sophisticated when it was originally deployed.

Cybersecurity specialists have repeatedly warned that organizations should avoid exposing industrial-control interfaces directly to the public internet, change default credentials and install security patches whenever possible. The French supermarket incident provides an unusually visible example of what can happen when attackers gain access to seemingly mundane connected infrastructure.

The lesson extends well beyond grocery stores. Similar technologies manage heating systems in offices, machinery in factories, water infrastructure, warehouses and parts of the energy sector, meaning vulnerabilities in operational technology can have consequences across modern economies.

Attack raises wider questions about cybersecurity and European food infrastructure

The disruption is also prompting discussion about whether food distribution systems should receive stronger cybersecurity protection. Supermarkets represent the final stage of complex supply chains involving farms, food processors, refrigerated warehouses, transportation companies and distribution centers, many of which increasingly depend on connected equipment.

A temporary refrigeration failure at several stores is unlikely to threaten France’s overall food supply. A larger coordinated attack affecting warehouses or logistics centers, however, could potentially produce more serious disruptions because those facilities hold considerably larger inventories and supply many stores simultaneously.

European Food Commissioner Christophe Hansen has expressed concern about the growing vulnerability of food systems to cyber interference, while French authorities are coordinating with European counterparts as they determine whether similar systems elsewhere could be exposed.

Reports of cybersecurity problems have also emerged elsewhere in Europe, although officials have not established that every incident is connected to the French refrigeration attack. Dutch retailer Ahold Delhaize experienced separate disruption affecting online services and temporarily restricted some systems as a precaution, but no confirmed link has been established.

The distinction is important because several cybersecurity problems occurring simultaneously do not necessarily mean Europe is experiencing one coordinated attack. Investigators will need technical evidence showing shared infrastructure, malware or methods before treating separate incidents as part of the same campaign.

French fridge attack could become a warning for businesses using older connected equipment

The lasting significance of the attack may ultimately be less about supermarkets than about the enormous number of older connected devices still operating across businesses worldwide. Equipment such as refrigeration controllers is often expected to function reliably for many years, meaning replacing it simply because cybersecurity technology has evolved can appear unnecessarily expensive.

The cost calculation changes dramatically once a successful attack destroys merchandise, damages equipment and forces businesses to suspend operations. Companies may now face greater pressure to identify older internet-connected devices and determine whether they are still receiving security updates.

Manufacturers could face similar scrutiny over how long they support industrial hardware and how clearly customers are warned when devices reach the end of their cybersecurity support period. Retailers, meanwhile, may need to separate operational equipment more aggressively from publicly accessible networks.

France’s investigation could provide important information for companies worldwide if authorities establish exactly how attackers gained control of the refrigeration systems. A relatively simple weakness would be particularly concerning because it could indicate that other internet-connected industrial equipment remains exposed to similar attacks.

For the supermarkets affected, the immediate task is much more practical: restore refrigeration, dispose of unsafe food and reopen sections that were temporarily closed. For cybersecurity authorities, however, the incident represents a warning that attacks traditionally associated with computers can increasingly reach directly into physical infrastructure that consumers rely on every day.

Key takeaways from the cyberattack on French supermarkets

• A large-scale cyberattack disrupted refrigeration systems at hundreds of French supermarkets, with government figures indicating that around 700 stores were affected to varying degrees.
• Hackers remotely manipulated refrigerators and freezers, reportedly driving temperatures as high as 50 degrees Celsius, or 122 degrees Fahrenheit, at some locations.
• Intermarché, Netto, Coopérative U, Carrefour and Monoprix were among the major retailers affected, forcing stores to discard significant quantities of fresh and frozen food.
• Some refrigeration equipment overheated or contributed to fires, showing how attacks on connected digital systems can cause physical damage rather than simply compromising data.
• French investigators are examining refrigeration controllers produced by multiple manufacturers, including Danfoss, Copeland and Dixell, while outdated software has emerged as one potential vulnerability.
• No hacking group has claimed responsibility, no clear ransom demand has been reported and French authorities have not publicly attributed the attack to any government or known cybercrime organization.
• The Paris prosecutor’s cybercrime unit and France’s national cybersecurity agency are investigating how attackers gained access and whether the same method was used across different supermarket chains.
• The incident highlights the cybersecurity risks surrounding older internet-connected operational technology used not only in supermarkets but also across factories, warehouses and other critical infrastructure.
• The wider concern is whether similar vulnerabilities exist elsewhere in Europe’s food supply chain, particularly in refrigerated warehouses and distribution systems where disruption could have much larger consequences.