A cyberattack targeting connected refrigeration systems has disrupted supermarket operations across France, causing widespread food spoilage and reportedly triggering fires at some locations. The incident, reported on October 12, 2026, affected several major retail groups and has raised concerns about the security of internet-connected industrial equipment.
According to Reuters, refrigeration and freezer systems at multiple supermarket chains were remotely manipulated, with temperatures in some stores reportedly reaching 50 degrees Celsius. Intermarché said around 150 of its stores were affected, while Carrefour reported disruptions at approximately 80 supermarkets. Other retailers, including Coopérative U and Monoprix, also reported incidents. The precise total remains subject to investigation and reporting differs across outlets.
How the Attack Disrupted Supermarket Refrigeration
Modern supermarkets often use connected refrigeration management systems to monitor temperatures, control defrost cycles and coordinate equipment across a store. These systems can make maintenance easier, but remote connectivity also creates a potential attack surface if access controls, software and network protections are inadequate.
In this incident, attackers reportedly manipulated refrigeration controls to raise temperatures and defrost equipment. Fresh and frozen products were spoiled, forcing affected retailers to discard stock to avoid food-safety risks. Some locations also reported fires, according to information provided to news agencies by French authorities and retailers.
The incident demonstrates how a cyberattack against operational technology can cause physical and financial damage without directly targeting payment systems or customer databases. A compromised control system can interrupt an essential business process even when the store's ordinary computers remain operational.
Why Outdated Firmware Is Under Scrutiny
French authorities reportedly identified a software vulnerability involving refrigeration management equipment supplied by Danish company Danfoss. Danfoss acknowledged incidents involving a limited number of refrigeration management systems and said the affected units were running outdated firmware. The company has advised customers to keep supported systems updated and migrate legacy equipment to current-generation solutions.
Cybersecurity researchers at Claroty's Team82 had previously disclosed vulnerabilities affecting Danfoss AK-SM 800A refrigeration controllers. Those earlier findings included issues involving authentication and code execution. However, the existence of previously documented vulnerabilities does not by itself prove precisely which weakness or entry point was used in the current attack. Investigators still need to establish the technical details.
French Authorities Launch an Investigation
The Paris prosecutor's office confirmed that an investigation was opened into the large-scale attack affecting refrigeration systems at several major food retailers. France's National Cybersecurity Agency, ANSSI, was also brought into the response as officials examined the cause and potential wider risks.
Authorities and industry representatives are assessing the extent of the damage and whether similar systems elsewhere could be exposed. Reports have raised the possibility of effects beyond France, but the extent of any international impact should be treated cautiously until confirmed by the relevant authorities.
The Business and Food-Safety Consequences
Refrigeration is a critical part of supermarket operations. When temperature controls fail, retailers may need to dispose of large quantities of meat, dairy products, frozen food and other perishables. Stores may also face temporary disruption while equipment is inspected, restored and verified as safe to use.
Intermarché said affected products had to be discarded. Reuters reported that the financial losses across the French retail sector could reach tens of millions of euros, although a final industry-wide assessment was not yet available. The incident also raises questions about business continuity, insurance coverage and the resilience of equipment maintained by external suppliers.
What Businesses Can Learn From the Incident
Organizations operating connected refrigeration, heating, building-management or other industrial control systems should treat these systems as part of their cybersecurity perimeter. They should identify internet-facing devices, remove unnecessary remote access, restrict management interfaces to authorized networks and apply vendor security updates promptly.
Businesses should also separate operational technology from ordinary office networks wherever practical, use strong authentication for remote administration, maintain secure backups of configuration settings and monitor for unexpected changes to temperatures, operating modes and controller settings. Alerts should be configured so that unusual changes are noticed before they cause extensive physical damage.
Why This Cyberattack Matters
The French supermarket incident illustrates the growing relationship between cybersecurity and physical infrastructure. Connected control systems can improve efficiency and maintenance, but poorly secured or outdated equipment can also create opportunities for attackers to disrupt real-world operations.
The investigation will need to establish how the attackers gained access, which systems were affected and whether the incident involved previously known vulnerabilities. For operators of industrial and commercial equipment, the immediate lesson is clear: maintain supported firmware, restrict remote access and include operational technology in routine security monitoring and incident-response planning.
